{ "analysis_id": "fa0da8be-03fb-404d-a526-6c99c6b4f000", "session_id": "48b1b9f6-8efb-4b8c-9a75-698c3c1c2789", "status": "completed", "filename": "2019-12-03-traffic-analysis-exercise.pcap", "source_sha256": "01da378585edbbc7d97e9cd91418a50cc506468d615ff0002b7f4bc34e0cbe0a", "source_size_bytes": 11052333, "schema_version": "pcap-analysis-v1", "semantic_sha256": "2ce5685240d4e8d4a57342c7b2fcec99b8925adbdbc1f79c94697f24e9fa6993", "analyzer_manifest": { "limits": { "max_flows": 50000, "max_endpoints": 20000, "max_upload_bytes": 536870912, "max_exported_files": 50000, "max_events_per_kind": 50000, "max_exported_objects": 500, "tool_timeout_seconds": 300, "max_object_hash_index": 50000, "max_tool_output_bytes": 268435456, "max_exported_total_bytes": 268435456, "max_exported_object_bytes": 52428800 }, "profile_id": "tshark-evidence-v6", "profile_sha256": "aff64bf3786902d5d7a2c1a9be158a5246cc81aecea6c44eda74701431070465", "schema_version": "pcap-analyzer-manifest-v1", "tshark_version": "TShark (Wireshark) 4.4.18.", "manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0", "capinfos_version": "Capinfos (Wireshark) 4.4.18.", "rulepack_version": "pcap-rules-v5", "implementation_sha256": "1a7d19199ff58059a12b34656620481b502fadc52d115b5f4b42fc28e5817c3c", "requested_fields_sha256": "e7a6eff11f7ae2101845897ce7e3b0a0e9cea31bdea4a824734869f39f3fb4f3", "supported_profile_fields_sha256": "6d94b9bc3aea93d5f7f4f815bdd025560ceba0d5e27b380ad14da28b44947994" }, "summary": "Decoded 21171 packets across 123 IP endpoints and 683 transport flows. Observed 379 DNS events, 33 HTTP requests, 423 TLS ClientHello events, and 18 recovered file/message object(s). Deterministic rules produced 4 finding(s): 0 high, 0 medium, and 4 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "report": "# AdversaryGraph Deterministic PCAP Analysis\n\nSource: 2019-12-03-traffic-analysis-exercise.pcap\nCapture SHA-256: `01da378585edbbc7d97e9cd91418a50cc506468d615ff0002b7f4bc34e0cbe0a`\nSemantic result SHA-256: `2ce5685240d4e8d4a57342c7b2fcec99b8925adbdbc1f79c94697f24e9fa6993`\nAnalyzer manifest SHA-256: `1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0`\n\n## Executive summary\n\nDecoded 21171 packets across 123 IP endpoints and 683 transport flows. Observed 379 DNS events, 33 HTTP requests, 423 TLS ClientHello events, and 18 recovered file/message object(s). Deterministic rules produced 4 finding(s): 0 high, 0 medium, and 4 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.\n\n## Capture facts\n\n- Packets: 21171\n- Duration: 1712.223434 seconds\n- Captured bytes: 10713573\n- Endpoints: 123\n- Flows: 683\n\n## Deterministic findings\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 142 / TCP stream 14, frame 144 / TCP stream 14, frame 146 / TCP stream 14, frame 148 / TCP stream 14.\n\nMetrics: `{\"destination\":\"10.18.20.97\",\"event_count\":4,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"10.18.20.8\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 6 / TCP stream 0, frame 11 / TCP stream 0, frame 13 / TCP stream 0, frame 15 / TCP stream 0, frame 17 / TCP stream 0.\n\nMetrics: `{\"destination\":\"10.18.20.97\",\"event_count\":15,\"operation_numbers\":[\"1\",\"4,19,19,19,5\",\"4,5\",\"5\"],\"protocol\":\"ldap\",\"source\":\"10.18.20.8\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 141 / TCP stream 14, frame 143 / TCP stream 14, frame 145 / TCP stream 14, frame 147 / TCP stream 14.\n\nMetrics: `{\"destination\":\"10.18.20.8\",\"event_count\":4,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"10.18.20.97\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 4 / TCP stream 0, frame 9 / TCP stream 0, frame 12 / TCP stream 0, frame 14 / TCP stream 0, frame 16 / TCP stream 0.\n\nMetrics: `{\"destination\":\"10.18.20.8\",\"event_count\":19,\"operation_numbers\":[\"0\",\"2\",\"3\"],\"protocol\":\"ldap\",\"source\":\"10.18.20.97\"}`\n\n## ATT&CK candidates\n\n- No deterministic ATT&CK candidates.\n\n## Identities\n\n- account: `JUANITA-WORK-PC$`; client IPs: 10.18.20.97; frames: 32, 40, 42, 54\n- account: `momia.juanita`; client IPs: 10.18.20.97; frames: 89, 97, 99, 111, 130\n- hostname: `Juanita-Work-PC`; client IPs: unbound subject; frames: 16506\n\n## Observed network and file inventory — not an IOC verdict\n\n- domain: `222.222.67.208.in-addr.arpa`; roles: dns-query\n- domain: `a.tribalfusion.com`; roles: dns-query, tls-sni\n- domain: `aa.agkn.com`; roles: dns-query, tls-sni\n- domain: `ad.doubleclick.net`; roles: dns-query, tls-sni\n- domain: `ad.turn.com`; roles: dns-query, tls-sni\n- domain: `ad.turn.com.akadns.net`; roles: dns-cname\n- domain: `ads.pubmatic.com`; roles: dns-query, tls-sni\n- domain: `ads.yahoo.com`; roles: dns-query, tls-sni\n- domain: `ads.yap.yahoo.com`; roles: dns-query, tls-sni\n- domain: `adserver-vpc-alb-0-2072243822.us-east-1.elb.amazonaws.com`; roles: dns-cname\n- domain: `adserver.adtech.advertising.com`; roles: dns-query, tls-sni\n- domain: `aero.bankofamerica.com`; roles: dns-query, tls-sni\n- domain: `aka-cdn.adtechus.com`; roles: dns-query, tls-sni\n- domain: `api.bing.com`; roles: dns-query\n- domain: `api.login.aol.com`; roles: dns-query, tls-sni\n- domain: `api2.casus.at`; roles: dns-query, http-host\n- domain: `apx.moatads.com`; roles: dns-query, tls-sni\n- domain: `at.atwola.com`; roles: dns-query, tls-sni\n- domain: `audex.userreport.com`; roles: dns-query, tls-sni\n- domain: `awuseb.advanced-web-analytics.com`; roles: dns-query, tls-sni\n- domain: `b.aol.com`; roles: dns-query\n- domain: `b1sync.zemanta.com`; roles: dns-query, tls-sni\n- domain: `bankofamerica.tt.omtrdc.net`; roles: dns-query, tls-sni\n- domain: `beap.gemini.yahoo.com`; roles: dns-query, tls-sni\n- domain: `beap1.cb.g01.yahoodns.net`; roles: dns-cname\n- domain: `bh.contextweb.com`; roles: dns-query, tls-sni\n- domain: `bm.adentifi.com`; roles: dns-query, tls-sni\n- domain: `boss.bankofamerica.com`; roles: dns-query, tls-sni\n- domain: `c.fqtag.com`; roles: dns-query, tls-sni\n- domain: `c1.adform.net`; roles: dns-query, tls-sni\n- domain: `casale-match.dotomi.com`; roles: dns-query, tls-sni\n- domain: `cdn.fqtag.com`; roles: dns-query, tls-sni\n- domain: `cm.adgrx.com`; roles: dns-query, tls-sni\n- domain: `cm.eyereturn.com`; roles: dns-query, tls-sni\n- domain: `cm.g.doubleclick.net`; roles: dns-query, tls-sni\n- domain: `cms.analytics.yahoo.com`; roles: dns-query, tls-sni\n- domain: `consent.cmp.oath.com`; roles: dns-query, tls-sni\n- domain: `cookie.brealtime.com`; roles: dns-query, tls-sni\n- domain: `cookie.brealtime.com.cdn.cloudflare.net`; roles: dns-cname\n- domain: `crt.usertrust.com`; roles: dns-query, http-host\n- domain: `cs550162656.adn.psicdn.net`; roles: dns-cname\n- domain: `cs629.wpc.lambdacdn.net`; roles: dns-cname\n- domain: `cs737157920.wpc.omicroncdn.net`; roles: dns-cname\n- domain: `cs747173190.wac.omegacdn.net`; roles: dns-cname\n- domain: `csm2waycm-atl.netmng.com`; roles: dns-query, tls-sni\n- domain: `d.adroll.com`; roles: dns-query, tls-sni\n- domain: `d.agkn.com`; roles: dns-query, tls-sni\n- domain: `d2u28gf9o4d1cv.cloudfront.net`; roles: dns-cname\n- domain: `dart.l.doubleclick.net`; roles: dns-cname\n- domain: `data.coremetrics.com`; roles: dns-query, tls-sni\n- domain: `dis.criteo.com`; roles: dns-query, tls-sni\n- domain: `dns.msftncsi.com`; roles: dns-query\n- domain: `dpm.demdex.net`; roles: dns-query, tls-sni\n- domain: `ds-ats.member.g02.yahoodns.net`; roles: dns-cname\n- domain: `ds-geoycpi-uno-lite.gycpi.b.yahoodns.net`; roles: dns-cname\n- domain: `ds-pr-bh.ybp.gysm.yahoodns.net`; roles: dns-cname\n- domain: `dsum-sec.casalemedia.com`; roles: dns-query, tls-sni\n- domain: `dsum.casalemedia.com`; roles: dns-query, tls-sni\n- domain: `dull.bankofamerica.com`; roles: dns-query, tls-sni\n- domain: `dxedge-prod-lb-946522505.us-east-1.elb.amazonaws.com`; roles: dns-cname\n- domain: `e.serverbid.com`; roles: dns-query, tls-sni\n- domain: `edge.gycpi.b.yahoodns.net`; roles: dns-cname\n- domain: `f2.taboola.map.fastly.net`; roles: dns-cname\n- domain: `fam-geo-atsv2.prod.media.g03.yahoodns.net`; roles: dns-cname\n- domain: `fc.yahoo.com`; roles: dns-query, tls-sni\n- domain: `fo-fd-world-new.yax.gysm.yahoodns.net`; roles: dns-cname\n- domain: `fonts.googleapis.com`; roles: dns-query, tls-sni\n- domain: `fonts.gstatic.com`; roles: dns-query, tls-sni\n- domain: `geo.moatads.com`; roles: dns-query, tls-sni\n- domain: `geo.yahoo.com`; roles: dns-query, tls-sni\n- domain: `geoycpi-uno.gycpi.b.yahoodns.net`; roles: dns-cname\n- domain: `go.microsoft.com`; roles: dns-query, http-host\n- domain: `googleads.g.doubleclick.net`; roles: dns-query, tls-sni\n- domain: `googleads4.g.doubleclick.net`; roles: dns-query, tls-sni\n- domain: `gstaticadssl.l.google.com`; roles: dns-cname\n- domain: `guce.advertising.com`; roles: dns-query, tls-sni\n- domain: `guce.aol.com`; roles: dns-query, tls-sni\n- domain: `gxp2.mail.aol.com`; roles: dns-query, tls-sni\n- domain: `h1.wensa.at`; roles: dns-query, http-host\n- domain: `ib.adnxs.com`; roles: dns-query, tls-sni\n- domain: `iecvlist.microsoft.com`; roles: dns-query, tls-sni\n- domain: `image2.pubmatic.com`; roles: dns-query, tls-sni\n- domain: `image4.pubmatic.com`; roles: dns-query, tls-sni\n- domain: `image6.pubmatic.com`; roles: dns-query, tls-sni\n- domain: `login.aol.com`; roles: dns-query, tls-sni\n- domain: `m-node-alb-us-east-1-prod-530825477.us-east-1.elb.amazonaws.com`; roles: dns-cname\n- domain: `mail.aol.com`; roles: dns-query, http-host, tls-sni\n- domain: `match-975362022.us-east-1.elb.amazonaws.com`; roles: dns-cname\n- domain: `match.adsrvr.org`; roles: dns-query, tls-sni\n- domain: `match.prod.bidr.io`; roles: dns-query, tls-sni\n- domain: `match.rundsp.com`; roles: dns-query, tls-sni\n- domain: `match.taboola.com`; roles: dns-query, tls-sni\n- domain: `match.zorosrv.com`; roles: dns-query, tls-sni\n- domain: `matchuseast-1393638539.us-east-1.elb.amazonaws.com`; roles: dns-cname\n- domain: `media-router-flurry1.prod.media.wg1.b.yahoo.com`; roles: dns-cname\n- domain: `myip.opendns.com`; roles: dns-query\n- domain: `myip.opendns.com.icemaiden.com`; roles: dns-query\n- domain: `o.aolcdn.com`; roles: dns-query, tls-sni\n- domain: `oao-js-tag.onemobile.yahoo.com`; roles: dns-query, tls-sni\n- domain: `oidc.mail.aol.com`; roles: dns-query, tls-sni\n- domain: `opus.analytics.yahoo.com`; roles: dns-query, tls-sni\n- domain: `p.adsymptotic.com`; roles: dns-query, tls-sni\n- domain: `p.rfihub.com`; roles: dns-query, tls-sni\n- domain: `pagead-googlehosted.l.google.com`; roles: dns-cname\n- domain: `pagead.l.doubleclick.net`; roles: dns-cname\n- domain: `pagead2.googlesyndication.com`; roles: dns-query, tls-sni\n- domain: `pagead46.l.doubleclick.net`; roles: dns-cname\n- domain: `pixel-a.sitescout.com`; roles: dns-cname\n- domain: `pixel-origin.mathtag.com`; roles: dns-cname\n- domain: `pixel-sync.sitescout.com`; roles: dns-query, tls-sni\n- domain: `pixel.advertising.com`; roles: dns-query, tls-sni\n- domain: `pixel.quantserve.com`; roles: dns-query, tls-sni\n- domain: `pixel.tapad.com`; roles: dns-query, tls-sni\n- domain: `pm.w55c.net`; roles: dns-query, tls-sni\n- domain: `pmp.mxptint.net`; roles: dns-query, tls-sni\n- domain: `pr-bh.ybp.yahoo.com`; roles: dns-query, tls-sni\n- domain: `prod-lb-10-490190718.us-east-1.elb.amazonaws.com`; roles: dns-cname\n- domain: `prod-lb-13-1730166618.us-east-1.elb.amazonaws.com`; roles: dns-cname\n- domain: `prod-lb-8-1772099769.us-east-1.elb.amazonaws.com`; roles: dns-cname\n- domain: `prod-lb-9-1476932994.us-east-1.elb.amazonaws.com`; roles: dns-cname\n- domain: `prod-m-node-1111.ssp.advertising.com`; roles: dns-query, tls-sni\n- domain: `prod.contextweb.map.fastlylb.net`; roles: dns-cname\n- domain: `prod.gxp.pse.public.aol.com`; roles: dns-cname\n- domain: `prod.ups-yahoo.aolp-ds-prd.aws.oath.cloud`; roles: dns-cname\n- domain: `pubmatic-match.dotomi.com`; roles: dns-query, tls-sni\n- domain: `pubmatic2waycm-atl.netmng.com`; roles: dns-query, tls-sni\n- domain: `px.adhigh.net`; roles: dns-query, tls-sni\n- domain: `px.moatads.com`; roles: dns-query, tls-sni\n- domain: `px.owneriq.net`; roles: dns-query, tls-sni\n- domain: `r20swj13mr.microsoft.com`; roles: dns-query, tls-sni\n- domain: `rail.bankofamerica.com`; roles: dns-query, tls-sni\n- domain: `resolver1.opendns.com`; roles: dns-query\n- domain: `rp.gwallet.com`; roles: dns-query\n- domain: `rtb.adentifi.com`; roles: dns-query, tls-sni\n- domain: `rtb.mfadsrvr.com`; roles: dns-query, tls-sni\n- domain: `s.aolcdn.com`; roles: dns-query, tls-sni\n- domain: `s.blogsmithmedia.com`; roles: dns-query, tls-sni\n- domain: `s.yimg.com`; roles: dns-query, tls-sni\n- domain: `s0-2mdn-net.l.google.com`; roles: dns-cname\n- domain: `s0.2mdn.net`; roles: dns-query, tls-sni\n- domain: `sb.scorecardresearch.com`; roles: dns-query, tls-sni\n- domain: `sdarlasplitroute.gapx.yahoodns.net`; roles: dns-cname\n- domain: `secure.adnxs.com`; roles: dns-query, tls-sni\n- domain: `secure.bankofamerica.com`; roles: dns-query, tls-sni\n- domain: `secure.ecglb.bac.com`; roles: dns-cname\n- domain: `service.idsync.analytics.yahoo.com`; roles: dns-query, tls-sni\n- domain: `service.sp.aolp-ds-prd.aws.oath.cloud`; roles: dns-cname\n- domain: `simage2.pubmatic.com`; roles: dns-query, tls-sni\n- domain: `simage4.pubmatic.com`; roles: dns-query, tls-sni\n- domain: `sofa.bankofamerica.com`; roles: dns-query, tls-sni\n- domain: `spcms-global.pbp.gysm.yahoodns.net`; roles: dns-cname\n- domain: `ssum-sec.casalemedia.com`; roles: dns-query, tls-sni\n- domain: `sync-tm.everesttech.net`; roles: dns-query, tls-sni\n- domain: `sync.1rx.io`; roles: dns-query, tls-sni\n- domain: `sync.ipredictive.com`; roles: dns-query, tls-sni\n- domain: `sync.mathtag.com`; roles: dns-query, tls-sni\n- domain: `sync.srv.stackadapt.com`; roles: dns-query, tls-sni\n- domain: `t.myvisualiq.net`; roles: dns-query, tls-sni\n- domain: `tag.idsync.analytics.yahoo.com`; roles: dns-query, tls-sni\n- domain: `tag.sp.advertising.com`; roles: dns-query, tls-sni\n- domain: `tags.bkrtx.com`; roles: dns-query, tls-sni\n- domain: `tags.bluekai.com`; roles: dns-query, tls-sni\n- domain: `tpc.googlesyndication.com`; roles: dns-query, tls-sni\n- domain: `track-eu.adformnet.akadns.net`; roles: dns-cname\n- domain: `track.adform.net`; roles: dns-query, tls-sni\n- domain: `trc.taboola.com`; roles: dns-query, tls-sni\n- domain: `trc.taboola.map.fastly.net`; roles: dns-cname\n- domain: `uca20a5adbe8d64fd0c7a816e1ec.dl.dropboxusercontent.com`; roles: dns-query, tls-sni\n- domain: `udc.yahoo.com`; roles: dns-query, tls-sni\n- domain: `uipus.semasio.net`; roles: dns-query, tls-sni\n- domain: `um.simpli.fi`; roles: dns-query, tls-sni\n- domain: `ups.analytics.yahoo.com`; roles: dns-query, tls-sni\n- domain: `us-east-1.onemobile.yahoo.com`; roles: dns-query, tls-sni\n- domain: `us.y.atwola.com`; roles: dns-query, tls-sni\n- domain: `w8.wensa.at`; roles: dns-query, http-host\n- domain: `wpad.icemaiden.com`; roles: dns-query\n- domain: `wpad.localdomain`; roles: dns-query\n- domain: `www.aol.com`; roles: dns-query, tls-sni\n- domain: `www.bankofamerica.com`; roles: dns-query, tls-sni\n- domain: `www.bing.com`; roles: dns-query, http-host, tls-sni\n- domain: `www.download.windowsupdate.com`; roles: dns-query, http-host\n- domain: `www.dropbox-dns.com`; roles: dns-cname\n- domain: `www.dropbox.com`; roles: dns-query, tls-sni\n- domain: `www.googletagservices.com`; roles: dns-query, tls-sni\n- domain: `wwwui.ecglb.bac.com`; roles: dns-cname\n- domain: `x.bidswitch.net`; roles: dns-query, tls-sni\n- domain: `z.moatads.com`; roles: dns-query, tls-sni\n- ipv4: `10.18.20.255`; roles: network-endpoint\n- ipv4: `10.18.20.8`; roles: network-endpoint\n- ipv4: `10.18.20.97`; roles: network-endpoint\n- ipv4: `100.24.88.255`; roles: dns-answer\n- ipv4: `101.226.79.205`; roles: dns-answer\n- ipv4: `104.17.119.107`; roles: dns-answer, network-endpoint\n- ipv4: `104.17.120.107`; roles: dns-answer\n- ipv4: `104.193.80.60`; roles: dns-answer, network-endpoint\n- ipv4: `104.254.148.133`; roles: dns-answer\n- ipv4: `104.254.148.165`; roles: dns-answer\n- ipv4: `104.254.148.196`; roles: dns-answer, network-endpoint\n- ipv4: `104.254.148.198`; roles: dns-answer\n- ipv4: `104.254.149.100`; roles: dns-answer\n- ipv4: `104.254.149.101`; roles: dns-answer, network-endpoint\n- ipv4: `104.254.149.68`; roles: dns-answer\n- ipv4: `104.254.149.69`; roles: dns-answer\n- ipv4: `104.36.113.17`; roles: dns-answer, network-endpoint\n- ipv4: `104.36.113.23`; roles: dns-answer, network-endpoint\n- ipv4: `104.36.113.24`; roles: dns-answer, network-endpoint\n- ipv4: `104.69.23.209`; roles: dns-answer, network-endpoint\n- ipv4: `107.178.246.49`; roles: dns-answer, network-endpoint\n- ipv4: `107.23.111.253`; roles: dns-answer\n- ipv4: `107.23.112.106`; roles: dns-answer\n- ipv4: `107.23.26.245`; roles: dns-answer\n- ipv4: `107.23.4.236`; roles: dns-answer\n- ipv4: `107.23.73.96`; roles: dns-answer, network-endpoint\n- ipv4: `119.28.48.231`; roles: dns-answer\n- ipv4: `129.33.138.31`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.21.200`; roles: dns-answer\n- ipv4: `13.107.5.80`; roles: dns-answer\n- ipv4: `13.249.22.105`; roles: dns-answer\n- ipv4: `13.249.22.83`; roles: dns-answer, network-endpoint\n- ipv4: `13.249.22.84`; roles: dns-answer\n- ipv4: `13.249.22.87`; roles: dns-answer\n- ipv4: `130.248.144.16`; roles: dns-answer\n- ipv4: `130.248.144.17`; roles: dns-answer\n- ipv4: `130.248.144.18`; roles: dns-answer\n- ipv4: `130.248.144.19`; roles: dns-answer\n- ipv4: `130.248.144.23`; roles: dns-answer\n- ipv4: `131.107.255.255`; roles: dns-answer\n- ipv4: `134.209.129.254`; roles: dns-answer, network-endpoint\n- ipv4: `151.101.0.166`; roles: dns-answer, network-endpoint\n- ipv4: `151.101.128.166`; roles: dns-answer\n- ipv4: `151.101.130.2`; roles: dns-answer\n- ipv4: `151.101.130.49`; roles: dns-answer\n- ipv4: `151.101.192.166`; roles: dns-answer\n- ipv4: `151.101.194.2`; roles: dns-answer\n- ipv4: `151.101.194.49`; roles: dns-answer\n- ipv4: `151.101.2.2`; roles: dns-answer, network-endpoint\n- ipv4: `151.101.2.49`; roles: dns-answer, network-endpoint\n- ipv4: `151.101.64.166`; roles: dns-answer\n- ipv4: `151.101.66.2`; roles: dns-answer\n- ipv4: `151.101.66.49`; roles: dns-answer, network-endpoint\n- ipv4: `152.195.14.41`; roles: dns-answer, network-endpoint\n- ipv4: `152.195.32.163`; roles: dns-answer, network-endpoint\n- ipv4: `152.195.55.192`; roles: dns-answer, network-endpoint\n- ipv4: `152.199.24.48`; roles: dns-answer, network-endpoint\n- ipv4: `152.199.6.11`; roles: dns-answer, network-endpoint\n- ipv4: `152.199.6.14`; roles: dns-answer, network-endpoint\n- ipv4: `152.199.6.24`; roles: dns-answer, network-endpoint\n- ipv4: `156.154.136.36`; roles: dns-answer\n- ipv4: `156.154.202.36`; roles: dns-answer, network-endpoint\n- ipv4: `162.125.8.1`; roles: dns-answer, network-endpoint\n- ipv4: `162.125.8.6`; roles: dns-answer, network-endpoint\n- ipv4: `169.62.192.207`; roles: dns-answer, network-endpoint\n- ipv4: `171.161.198.200`; roles: dns-answer, network-endpoint\n- ipv4: `171.161.202.100`; roles: dns-answer, network-endpoint\n- ipv4: `172.217.1.130`; roles: dns-answer, network-endpoint\n- ipv4: `172.217.12.38`; roles: dns-answer, network-endpoint\n- ipv4: `172.217.12.65`; roles: dns-answer, network-endpoint\n- ipv4: `172.217.12.67`; roles: dns-answer, network-endpoint\n- ipv4: `172.217.14.166`; roles: dns-answer, network-endpoint\n- ipv4: `173.231.184.20`; roles: dns-answer, network-endpoint\n- ipv4: `174.129.98.238`; roles: dns-answer\n- ipv4: `18.190.121.125`; roles: dns-answer\n- ipv4: `18.207.32.160`; roles: dns-answer\n- ipv4: `18.208.41.141`; roles: dns-answer\n- ipv4: `18.209.186.85`; roles: dns-answer\n- ipv4: `18.210.147.153`; roles: dns-answer, network-endpoint\n- ipv4: `18.211.132.79`; roles: dns-answer\n- ipv4: `18.214.122.84`; roles: dns-answer, network-endpoint\n- ipv4: `18.215.90.62`; roles: dns-answer\n- ipv4: `18.232.193.181`; roles: dns-answer\n- ipv4: `18.233.175.78`; roles: dns-answer\n- ipv4: `18.233.219.152`; roles: dns-answer\n- ipv4: `18.235.19.208`; roles: dns-answer\n- ipv4: `18.235.25.252`; roles: dns-answer\n- ipv4: `180.163.8.114`; roles: dns-answer\n- ipv4: `184.172.48.71`; roles: dns-answer\n- ipv4: `184.203.37.188`; roles: dns-answer\n- ipv4: `184.86.155.127`; roles: dns-answer, network-endpoint\n- ipv4: `185.167.164.42`; roles: dns-answer, network-endpoint\n- ipv4: `185.167.164.43`; roles: dns-answer\n- ipv4: `185.167.164.49`; roles: dns-answer\n- ipv4: `185.167.164.51`; roles: dns-answer\n- ipv4: `192.184.69.155`; roles: dns-answer\n- ipv4: `192.184.69.156`; roles: dns-answer\n- ipv4: `192.184.69.183`; roles: dns-answer\n- ipv4: `192.184.69.197`; roles: dns-answer\n- ipv4: `192.184.69.204`; roles: dns-answer\n- ipv4: `192.184.69.225`; roles: dns-answer, network-endpoint\n- ipv4: `192.184.69.243`; roles: dns-answer\n- ipv4: `192.184.69.244`; roles: dns-answer\n- ipv4: `192.229.210.141`; roles: dns-answer, network-endpoint\n- ipv4: `192.229.211.36`; roles: dns-answer, network-endpoint\n- ipv4: `193.183.98.66`; roles: network-endpoint\n- ipv4: `198.70.69.154`; roles: dns-answer, network-endpoint\n- ipv4: `198.70.69.161`; roles: dns-answer\n- ipv4: `198.8.70.128`; roles: dns-answer, network-endpoint\n- ipv4: `199.255.32.89`; roles: dns-answer, network-endpoint\n- ipv4: `204.74.252.20`; roles: dns-answer, network-endpoint\n- ipv4: `204.74.252.28`; roles: dns-answer\n- ipv4: `204.79.197.200`; roles: dns-answer, network-endpoint\n- ipv4: `205.180.86.172`; roles: dns-answer, network-endpoint\n- ipv4: `208.67.222.222`; roles: dns-answer, network-endpoint\n- ipv4: `209.15.36.35`; roles: dns-answer, network-endpoint\n- ipv4: `216.200.232.201`; roles: dns-answer\n- ipv4: `216.200.232.221`; roles: dns-answer, network-endpoint\n- ipv4: `216.58.193.130`; roles: dns-answer, network-endpoint\n- ipv4: `216.58.194.106`; roles: dns-answer, network-endpoint\n- ipv4: `224.0.0.22`; roles: network-endpoint\n- ipv4: `224.0.0.252`; roles: network-endpoint\n- ipv4: `23.11.217.11`; roles: dns-answer, network-endpoint\n- ipv4: `23.11.217.71`; roles: dns-answer, network-endpoint\n- ipv4: `23.11.218.15`; roles: dns-answer, network-endpoint\n- ipv4: `23.67.118.68`; roles: dns-answer, network-endpoint\n- ipv4: `23.67.120.135`; roles: dns-answer, network-endpoint\n- ipv4: `23.7.93.115`; roles: dns-answer, network-endpoint\n- ipv4: `239.255.255.250`; roles: http-host, network-endpoint\n- ipv4: `255.255.255.255`; roles: network-endpoint\n- ipv4: `3.13.100.77`; roles: dns-answer\n- ipv4: `3.135.8.221`; roles: dns-answer\n- ipv4: `3.136.2.145`; roles: dns-answer\n- ipv4: `3.136.4.126`; roles: dns-answer\n- ipv4: `3.136.40.187`; roles: dns-answer, network-endpoint\n- ipv4: `3.18.142.126`; roles: dns-answer\n- ipv4: `3.19.254.171`; roles: dns-answer\n- ipv4: `3.213.234.38`; roles: dns-answer\n- ipv4: `3.213.8.28`; roles: dns-answer\n- ipv4: `3.215.246.105`; roles: dns-answer\n- ipv4: `3.216.103.132`; roles: dns-answer\n- ipv4: `3.218.16.73`; roles: dns-answer, network-endpoint\n- ipv4: `3.220.227.225`; roles: dns-answer, network-endpoint\n- ipv4: `3.221.250.206`; roles: dns-answer\n- ipv4: `3.223.16.87`; roles: dns-answer\n- ipv4: `3.225.187.149`; roles: dns-answer\n- ipv4: `3.226.23.55`; roles: dns-answer\n- ipv4: `3.232.65.116`; roles: dns-answer\n- ipv4: `3.83.197.207`; roles: dns-answer, network-endpoint\n- ipv4: `34.193.46.35`; roles: dns-answer, network-endpoint\n- ipv4: `34.194.106.87`; roles: dns-answer\n- ipv4: `34.196.158.70`; roles: dns-answer\n- ipv4: `34.197.7.23`; roles: dns-answer\n- ipv4: `34.199.169.142`; roles: dns-answer\n- ipv4: `34.200.67.128`; roles: dns-answer\n- ipv4: `34.201.90.208`; roles: dns-answer\n- ipv4: `34.204.123.32`; roles: dns-answer\n- ipv4: `34.204.232.247`; roles: dns-answer, network-endpoint\n- ipv4: `34.204.4.212`; roles: dns-answer, network-endpoint\n- ipv4: `34.224.172.188`; roles: dns-answer\n- ipv4: `34.225.20.218`; roles: dns-answer\n- ipv4: `34.226.173.88`; roles: dns-answer\n- ipv4: `34.228.100.37`; roles: dns-answer\n- ipv4: `34.231.235.125`; roles: dns-answer, network-endpoint\n- ipv4: `34.232.21.42`; roles: dns-answer\n- ipv4: `34.232.64.168`; roles: dns-answer, network-endpoint\n- ipv4: `34.233.8.16`; roles: dns-answer\n- ipv4: `34.235.254.111`; roles: dns-answer\n- ipv4: `34.235.45.38`; roles: dns-answer, network-endpoint\n- ipv4: `34.236.118.184`; roles: dns-answer\n- ipv4: `34.236.135.105`; roles: dns-answer\n- ipv4: `34.236.202.21`; roles: dns-answer\n- ipv4: `34.237.248.89`; roles: dns-answer\n- ipv4: `34.238.112.88`; roles: dns-answer\n- ipv4: `34.239.215.228`; roles: dns-answer\n- ipv4: `35.153.187.227`; roles: dns-answer\n- ipv4: `35.153.21.25`; roles: dns-answer\n- ipv4: `35.153.252.120`; roles: dns-answer\n- ipv4: `35.161.118.229`; roles: dns-answer\n- ipv4: `35.165.180.187`; roles: dns-answer\n- ipv4: `35.169.207.73`; roles: dns-answer, network-endpoint\n- ipv4: `35.170.121.134`; roles: dns-answer\n- ipv4: `35.170.22.17`; roles: dns-answer\n- ipv4: `35.171.168.180`; roles: dns-answer, network-endpoint\n- ipv4: `35.171.202.176`; roles: dns-answer\n- ipv4: `35.171.48.153`; roles: dns-answer\n- ipv4: `35.172.104.215`; roles: dns-answer\n- ipv4: `35.173.158.96`; roles: dns-answer\n- ipv4: `35.174.30.193`; roles: dns-answer\n- ipv4: `35.186.239.238`; roles: dns-answer, network-endpoint\n- ipv4: `35.190.36.172`; roles: dns-answer, network-endpoint\n- ipv4: `35.190.72.161`; roles: dns-answer, network-endpoint\n- ipv4: `35.207.24.140`; roles: dns-answer, network-endpoint\n- ipv4: `35.211.144.153`; roles: dns-answer, network-endpoint\n- ipv4: `35.211.183.51`; roles: dns-answer\n- ipv4: `37.157.2.236`; roles: dns-answer\n- ipv4: `37.157.2.237`; roles: dns-answer\n- ipv4: `37.157.4.23`; roles: dns-answer\n- ipv4: `37.157.4.41`; roles: dns-answer\n- ipv4: `37.157.6.246`; roles: dns-answer, network-endpoint\n- ipv4: `37.157.6.252`; roles: dns-answer\n- ipv4: `38.67.14.233`; roles: dns-answer, network-endpoint\n- ipv4: `50.116.194.21`; roles: dns-answer, network-endpoint\n- ipv4: `50.16.169.17`; roles: dns-answer\n- ipv4: `50.57.31.206`; roles: dns-answer, network-endpoint\n- ipv4: `50.97.145.208`; roles: dns-answer\n- ipv4: `52.0.90.21`; roles: dns-answer\n- ipv4: `52.2.220.123`; roles: dns-answer\n- ipv4: `52.20.183.229`; roles: dns-answer\n- ipv4: `52.20.71.5`; roles: dns-answer\n- ipv4: `52.200.145.54`; roles: dns-answer\n- ipv4: `52.201.28.115`; roles: dns-answer\n- ipv4: `52.202.0.127`; roles: dns-answer\n- ipv4: `52.202.126.226`; roles: dns-answer\n- ipv4: `52.202.174.197`; roles: dns-answer\n- ipv4: `52.202.55.102`; roles: dns-answer, network-endpoint\n- ipv4: `52.203.83.158`; roles: dns-answer\n- ipv4: `52.204.252.186`; roles: dns-answer\n- ipv4: `52.204.50.104`; roles: dns-answer\n- ipv4: `52.206.226.12`; roles: dns-answer\n- ipv4: `52.21.200.160`; roles: dns-answer\n- ipv4: `52.21.98.231`; roles: dns-answer\n- ipv4: `52.22.131.123`; roles: dns-answer\n- ipv4: `52.22.146.21`; roles: dns-answer\n- ipv4: `52.22.184.73`; roles: dns-answer\n- ipv4: `52.3.11.61`; roles: dns-answer\n- ipv4: `52.3.158.69`; roles: dns-answer\n- ipv4: `52.36.218.9`; roles: dns-answer\n- ipv4: `52.38.185.101`; roles: dns-answer\n- ipv4: `52.39.132.98`; roles: dns-answer\n- ipv4: `52.42.99.244`; roles: dns-answer\n- ipv4: `52.43.190.106`; roles: dns-answer\n- ipv4: `52.44.42.164`; roles: dns-answer\n- ipv4: `52.45.100.81`; roles: dns-answer\n- ipv4: `52.45.29.95`; roles: dns-answer\n- ipv4: `52.45.82.224`; roles: dns-answer\n- ipv4: `52.5.227.122`; roles: dns-answer\n- ipv4: `52.54.122.125`; roles: dns-answer, network-endpoint\n- ipv4: `52.55.150.239`; roles: dns-answer\n- ipv4: `52.6.242.143`; roles: dns-answer\n- ipv4: `52.6.39.34`; roles: dns-answer\n- ipv4: `52.7.147.140`; roles: dns-answer, network-endpoint\n- ipv4: `52.70.198.170`; roles: dns-answer\n- ipv4: `52.70.56.26`; roles: dns-answer\n- ipv4: `52.71.118.158`; roles: dns-answer\n- ipv4: `52.71.154.85`; roles: dns-answer, network-endpoint\n- ipv4: `52.71.168.120`; roles: dns-answer\n- ipv4: `52.72.249.172`; roles: dns-answer, network-endpoint\n- ipv4: `52.73.155.113`; roles: dns-answer\n- ipv4: `52.73.52.157`; roles: dns-answer\n- ipv4: `52.73.69.206`; roles: dns-answer\n- ipv4: `52.73.9.0`; roles: dns-answer\n- ipv4: `52.86.28.222`; roles: dns-answer\n- ipv4: `52.86.75.171`; roles: dns-answer\n- ipv4: `52.87.22.170`; roles: dns-answer\n- ipv4: `52.87.90.62`; roles: dns-answer\n- ipv4: `54.145.171.0`; roles: dns-answer\n- ipv4: `54.152.229.194`; roles: dns-answer\n- ipv4: `54.152.30.174`; roles: dns-answer\n- ipv4: `54.156.168.222`; roles: dns-answer\n- ipv4: `54.158.57.141`; roles: dns-answer, network-endpoint\n- ipv4: `54.164.248.61`; roles: dns-answer\n- ipv4: `54.165.26.158`; roles: dns-answer\n- ipv4: `54.175.7.235`; roles: dns-answer, network-endpoint\n- ipv4: `54.175.88.188`; roles: dns-answer, network-endpoint\n- ipv4: `54.186.165.46`; roles: dns-answer, network-endpoint\n- ipv4: `54.208.163.85`; roles: dns-answer\n- ipv4: `54.209.191.239`; roles: dns-answer\n- ipv4: `54.209.242.98`; roles: dns-answer\n- ipv4: `54.209.58.223`; roles: dns-answer\n- ipv4: `54.209.91.178`; roles: dns-answer\n- ipv4: `54.209.98.151`; roles: dns-answer\n- ipv4: `54.226.243.22`; roles: dns-answer\n- ipv4: `54.236.178.170`; roles: dns-answer, network-endpoint\n- ipv4: `54.236.214.197`; roles: dns-answer\n- ipv4: `54.82.194.252`; roles: dns-answer, network-endpoint\n- ipv4: `54.84.47.220`; roles: dns-answer, network-endpoint\n- ipv4: `54.85.102.186`; roles: dns-answer, network-endpoint\n- ipv4: `54.88.83.158`; roles: dns-answer\n- ipv4: `54.88.96.255`; roles: dns-answer\n- ipv4: `54.89.56.97`; roles: dns-answer\n- ipv4: `58.251.121.110`; roles: dns-answer\n- ipv4: `64.58.116.196`; roles: dns-answer\n- ipv4: `64.58.116.236`; roles: dns-answer\n- ipv4: `64.58.119.36`; roles: dns-answer\n- ipv4: `66.218.84.42`; roles: dns-answer, network-endpoint\n- ipv4: `66.218.84.43`; roles: dns-answer\n- ipv4: `66.218.87.13`; roles: dns-answer, network-endpoint\n- ipv4: `66.218.87.15`; roles: dns-answer\n- ipv4: `66.235.147.232`; roles: dns-answer\n- ipv4: `66.235.147.233`; roles: dns-answer\n- ipv4: `66.235.147.234`; roles: dns-answer\n- ipv4: `66.235.147.235`; roles: dns-answer\n- ipv4: `66.235.147.236`; roles: dns-answer\n- ipv4: `66.235.147.237`; roles: dns-answer\n- ipv4: `66.235.147.238`; roles: dns-answer\n- ipv4: `66.235.147.239`; roles: dns-answer\n- ipv4: `66.235.147.240`; roles: dns-answer\n- ipv4: `66.235.147.244`; roles: dns-answer, network-endpoint\n- ipv4: `66.235.147.246`; roles: dns-answer\n- ipv4: `67.195.204.151`; roles: dns-answer, network-endpoint\n- ipv4: `69.147.64.33`; roles: dns-answer\n- ipv4: `69.147.64.34`; roles: dns-answer, network-endpoint\n- ipv4: `70.42.32.63`; roles: dns-answer, network-endpoint\n- ipv4: `72.21.81.200`; roles: dns-answer, network-endpoint\n- ipv4: `72.5.64.63`; roles: dns-answer, network-endpoint\n- ipv4: `74.119.118.138`; roles: dns-answer, network-endpoint\n- ipv4: `74.121.138.36`; roles: dns-answer\n- ipv4: `74.121.138.90`; roles: dns-answer\n- ipv4: `74.6.138.64`; roles: dns-answer\n- ipv4: `74.6.138.72`; roles: dns-answer, network-endpoint\n- ipv4: `74.6.138.75`; roles: dns-answer, network-endpoint\n- ipv4: `74.6.143.14`; roles: dns-answer\n- exported object `JSHmUi`; SHA-256 `0b504e7f3cec848c7a1c25720cc40e7fd6919e217b4f56e50f645bda49259a39`; size 327092 bytes\n SHA-1: `d13e845694be72d8a62e1bb7af710b4c2bf8465c`; MD5: `16b183514996887bc3e3048bedafd87a`; completeness: unknown; transfers: `[{\"client_ip\":\"10.18.20.97\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":15581,\"response_frame\":15940,\"server_ip\":\"8.208.24.139\",\"status_code\":\"200\",\"tcp_stream\":422,\"url\":\"http://w8.wensa.at/api1/I01zepn8d/lW8zbbQjFkfEikrpMjIM/BUpAeRTlHQ4bvFyNQ5b/QJQiaBloENVY8vhKyUyE0o/DlBxOkmYhfcXF/f83ZepX0/p4w8NwGSdWiq2d0xSm7dQRx/c9TVoEwwGP/q1ZfqVF4Kk65L3fk5/ZmA_2F4e_2Fz/EA15GMwiWYS/dM6cnd6KMsJ08_/2FGuylglowKzvlAqp_2B7/1F_2FeKeSZFlbTaP/MX93YLJkZgekq1k/2ECfT2iPz4_2FLNdDL/PjdGytsj5/j_2BwGYOG_0A_0DWVnLJ/lblBYSp5hbm4QlU/JSHmUi\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `2`; SHA-256 `cf63a226cdfefcc50f0ebd036df2729d1a6493cac1a5b814eec81ce4eed0f948`; size 260872 bytes\n SHA-1: `4c758999f8f453338ecc4c7b8423354393195458`; MD5: `3bbf78b6d010c727ca7932776c2cb01a`; completeness: unknown; transfers: `[{\"client_ip\":\"10.18.20.97\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":15288,\"response_frame\":15565,\"server_ip\":\"8.208.24.139\",\"status_code\":\"200\",\"tcp_stream\":420,\"url\":\"http://w8.wensa.at/api1/PUbKL64xdNDApQ_2FhOvR/PzVuL7v93RbB1xfc/OEnwN9VtRcH8Ccu/jPgnw0d37uDEzDiVOf/KHgo0k5Uc/k6JCnK_2FBZ4yd9zeeiC/VpJpc2JMgFpc_2BUK2N/MNdoh0fThkbLeh37DCpXrm/guVivsIWc_2FM/aKnRfxy_/2FhTlme15XsXbjEQesbQbAJ/Z9BLtjy3Zi/ZcwiqStUG_2BZapZN/hqA8oHVvfrmy/sqq6RrFWUhE/NiEXX3DV0k2wcp/3ypM4pRUl6ezpp8W_0A_0/Dq6VuunS4q_2BKna/0dWjHSjvGD9y/2\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":260872,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `t64.dat`; SHA-256 `1f0bad278e2bf2f41979f2144a94cb85ac19d93abd041230b236463a992d9190`; size 138820 bytes\n SHA-1: `29bcf5a91dc0c57a1f63bc821d7d0604e53a15de`; MD5: `734a5661b2e66e8bf5775eb104ad9ec3`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.18.20.97\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":15971,\"response_frame\":16124,\"server_ip\":\"8.208.24.139\",\"status_code\":\"200\",\"tcp_stream\":426,\"url\":\"http://api2.casus.at/jvassets/xI/t64.dat\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":138820,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `beBzLG`; SHA-256 `8bbbecf9c7b14eab33a19f0ab1529dd595dbd2ba51ef0dab65201aef80ce18b6`; size 23137 bytes\n SHA-1: `1b347332e5bbb4081cebdcbe7366a73cfaa6e4f4`; MD5: `dd76eb0d848c9b3c9c9719049ee91a38`; completeness: unknown; transfers: `[]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `AEHAZk`; SHA-256 `a2f75fb154555d2877b0648f52b549a947b9c82bcff786d7c81ba712e9c3f3f8`; size 2416 bytes\n SHA-1: `21b9614cbbf79437a0acb12672c0f7240b8ca57e`; MD5: `c5884be3621775b99a38b617db6060c1`; completeness: unknown; transfers: `[{\"client_ip\":\"10.18.20.97\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":15956,\"response_frame\":15961,\"server_ip\":\"8.208.24.139\",\"status_code\":\"200\",\"tcp_stream\":424,\"url\":\"http://w8.wensa.at/api1/yHuijzBzQc46MJ8Hh_2B3To/h6eUe0SPQ_/2FyC9fDGgAdh4u0V0/Y_2F7w0Pe86d/_2FTkP74EP4/K1gu1U6e0AQB5l/cREXUjyc5L8u6LnRWbbL1/uRyhvKc_2FJntmF6/2AoYMEWtimRTV2a/PtgF_2F7ZN3svdTbI8/iP951uoBL/13G66amAYJslhDbJ9LRx/3TnU8ybVEHD70NlfPgK/H8jUEtFKAt07GB5iuDJECi/UWsRrR1g_2FwB/Fis0q36f/6B9w_2F9mwHOMRaRAywS_0A/_0DXkcCzh7/ICclVahOB309_2F/AEHAZk\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":2416,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `USERTrustRSAAddTrustCA(1).crt`; SHA-256 `1a5174980a294a528a110726d5855650266c48d9883bea692b67b6d726da98c5`; size 1403 bytes\n SHA-1: `eab040689a0d805b5d6fd654fc168cff00b78be3`; MD5: `db78cbd190952735d940bc80ac2432c0`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.18.20.97\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":10625,\"response_frame\":10693,\"server_ip\":\"91.199.212.52\",\"status_code\":\"200\",\"tcp_stream\":254,\"url\":\"http://crt.usertrust.com/USERTrustRSAAddTrustCA.crt\"},{\"client_ip\":\"10.18.20.97\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":10629,\"response_frame\":10698,\"server_ip\":\"91.199.212.52\",\"status_code\":\"200\",\"tcp_stream\":253,\"url\":\"http://crt.usertrust.com/USERTrustRSAAddTrustCA.crt\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":1403,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `D69B561148F01C77C54578C10926DF5B856976AD(1).crt`; SHA-256 `cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b`; size 867 bytes\n SHA-1: `d69b561148f01c77c54578c10926df5b856976ad`; MD5: `c5dfb849ca051355ee2dba1ac33eb028`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.18.20.97\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":10681,\"response_frame\":10735,\"server_ip\":\"198.70.69.154\",\"status_code\":\"200\",\"tcp_stream\":256,\"url\":\"http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt\"},{\"client_ip\":\"10.18.20.97\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":10684,\"response_frame\":10737,\"server_ip\":\"198.70.69.154\",\"status_code\":\"200\",\"tcp_stream\":257,\"url\":\"http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt\"},{\"client_ip\":\"10.18.20.97\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":10744,\"response_frame\":10807,\"server_ip\":\"198.70.69.154\",\"status_code\":\"200\",\"tcp_stream\":256,\"url\":\"http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt\"},{\"client_ip\":\"10.18.20.97\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":10746,\"response_frame\":10808,\"server_ip\":\"198.70.69.154\",\"status_code\":\"200\",\"tcp_stream\":257,\"url\":\"http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":867,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `XLm`; SHA-256 `78f53c3a83a6e9d23f3903efc3a5635ea95fd21264ada13ebb8af23eb761fa40`; size 433 bytes\n SHA-1: `4c3abfe84c34632aacb5c201fc5faf5c59208fdf`; MD5: `2a64b4a8cfe95fbaebe9cd4a3a847c62`; completeness: unknown; transfers: `[]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `raR9XNN`; SHA-256 `a08902c478721cb65ddbb075d5dea373db29f80c15d67cdb23f25ebfb6284fc7`; size 433 bytes\n SHA-1: `a40d03c3b5f1d2682a6a309ad8c53fd0506304f6`; MD5: `8e0fa72d4d0a797cfdc53604a2dd36ea`; completeness: unknown; transfers: `[]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `%2f`; SHA-256 `c65cb1829bda38e033f2c42d891e2f0cf9cb5bf2352a74a05ffc27049a98cb56`; size 303 bytes\n SHA-1: `13f344d62c39fb6e7a49b5ca8486ab61417c502e`; MD5: `56c081b271321855dcca5d63ce7330db`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.18.20.97\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":281,\"response_frame\":283,\"server_ip\":\"69.147.64.34\",\"status_code\":\"301\",\"tcp_stream\":22,\"url\":\"http://mail.aol.com/\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":303,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `favicon(2).ico`; SHA-256 `6d8a01dc7647bc218d003b58fe04049e24a9359900b7e0cebae76edf85b8b914`; size 237 bytes\n SHA-1: `ea13848d33c2c7f4f4baa39348aeb1dbfad3df31`; MD5: `9fb559a691078558e77d6848202f6541`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.18.20.97\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":17330,\"response_frame\":17332,\"server_ip\":\"204.79.197.200\",\"status_code\":\"200\",\"tcp_stream\":449,\"url\":\"http://www.bing.com/favicon.ico\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":237,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `5p6`; SHA-256 `afb96043d1f8390179fe445d5063c434d4df10fa0194e7879ecadf4c9e8f9b78`; size 204 bytes\n SHA-1: `2cc83e7767f4ab82af35c23ba7852722d0f9533f`; MD5: `d239192a7dfc49fd6e19f7031fae9e63`; completeness: unknown; transfers: `[]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `object16193.text%2fhtml`; SHA-256 `5b80b1566219a6c3321b14127ebae23f73a18fd50a0751d2179e42d461e9ad39`; size 110 bytes\n SHA-1: `76e47a8682455d2e891b901bba7d93e5f379454a`; MD5: `87bf2951d15ae3e3c9d78a886e3e75d3`; completeness: unknown; transfers: `[{\"client_ip\":\"10.18.20.97\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":null,\"response_frame\":16193,\"server_ip\":\"8.208.24.139\",\"status_code\":\"408\",\"tcp_stream\":425,\"url\":\"\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":110,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `favicon(1).ico`; SHA-256 `839488ebc08446a096a893996ed23eac321ac166724cd8c5d9092057834d2d79`; size 107 bytes\n SHA-1: `6fbe9df856956467c1691558796c86fc392ed5b6`; MD5: `ff4ed829ffd04e9c6095842b07d11f09`; completeness: unknown; transfers: `[{\"client_ip\":\"10.18.20.97\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":15569,\"response_frame\":15571,\"server_ip\":\"8.208.24.139\",\"status_code\":\"503\",\"tcp_stream\":421,\"url\":\"http://8.208.24.139/favicon.ico\"},{\"client_ip\":\"10.18.20.97\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":15944,\"response_frame\":15946,\"server_ip\":\"8.208.24.139\",\"status_code\":\"503\",\"tcp_stream\":423,\"url\":\"http://8.208.24.139/favicon.ico\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":107,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `V`; SHA-256 `52307c67a1d0d310baf70fb8c346eb51856b73c08f9cf67535720b900023ee5e`; size 54 bytes\n SHA-1: `503e290715bf8ae66169754f06e4b1da1db433ac`; MD5: `a631e8bb1a2ef64d137dc8fb41d0cda2`; completeness: unknown; transfers: `[]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `E(1)`; SHA-256 `6c0c18274fed35e973d1c060f2f4137bb91444a78fbafd3be6c5f6d2f3cc63b8`; size 33 bytes\n SHA-1: `e80ef447e8a4e09cdcf97cb2c7f71f56b3f5be03`; MD5: `2132892e423fd11073e100e9ec6e067f`; completeness: unknown; transfers: `[{\"client_ip\":\"10.18.20.97\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":16166,\"response_frame\":16174,\"server_ip\":\"8.208.24.139\",\"status_code\":\"200\",\"tcp_stream\":428,\"url\":\"http://h1.wensa.at/api1/NdyKQBz2bkQyWRjW/DQxAC7LXQQhux0L/JG8Hy_2FKtggSPly52/OI_2Bww0d/GlhCZjLB1qzPFsZmpylg/Ms3wZA3Stl71Q46KRVb/iVLkW9gg4uKEOIATInV3zY/iLuKm_2BHFq5Q/sYBbWlUn/p_2BS4xgcBhCn0_2FVa5JBR/FwZ3dNRALU/50_2FvcGyN_2Bi_2F/gT8JmJY_2Frd/Lwf2Rf9oDBS/vn2noKvqMLt20R/8_2Fy946FBaM8_2F1ADOd/yK0bIHFjspZwtBHx/YHVqsuHv6P_0A_0/Dv9mhzaFuIXiIwIFNV/J7o6OM2pj/ergUZu91KSmAuKhCbtY2/Z7AlSzdNRd_2F_2BrH8/VYH_2BmX/E\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":33,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `E`; SHA-256 `7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6`; size 2 bytes\n SHA-1: `ba8ab5a0280b953aa97435ff8946cbcbb2755a27`; MD5: `81051bcc2cf1bedf378224b0a93e2877`; completeness: unknown; transfers: `[]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `5p6(1)`; SHA-256 `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`; size 0 bytes\n SHA-1: `da39a3ee5e6b4b0d3255bfef95601890afd80709`; MD5: `d41d8cd98f00b204e9800998ecf8427e`; completeness: unknown; transfers: `[]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n\n## Actor similarity leads\n\n- No actor lead was calculated.\n\n## Local enrichment and correlations\n\nNo match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.\nSnapshot: `7391d9a1492b61adb92cbb4caa154ab6d893d9a075ce9959761e6e0b1ed161e8`; recorded 2026-09-22T16:01:42.557567+00:00; mode: local-only.\nCoverage: `{\"matched_observables\":0,\"no_exact_match\":565,\"observable_limit\":5000,\"observables_checked\":565,\"observables_total\":565,\"prior_case_limit_reached\":true,\"prior_cases_checked\":50,\"truncated\":false}`\n\n- Prior analysis `05851801-c224-489b-b9da-9e5d035c60b4` shares 14 observations. This does not establish a common campaign.\n- Prior analysis `d9aa0de8-e06d-40b7-bffc-2e1af3c53ea0` shares 9 observations. This does not establish a common campaign.\n- Prior analysis `246dbce6-c561-4434-bedb-dd496ba758d2` shares 39 observations. This does not establish a common campaign.\n- Prior analysis `c66676ab-7276-4989-8c27-65017a63c2ba` shares 120 observations. This does not establish a common campaign.\n- Prior analysis `476c88cb-8e1a-42e4-a8bd-e2ad2e63b0cd` shares 2 observations. This does not establish a common campaign.\n- Prior analysis `044c22d0-fd65-4c60-8644-c22ff5e1b31c` shares 9 observations. This does not establish a common campaign.\n- Prior analysis `73129515-519f-4544-905f-145c9d2de3d8` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `5ddffc9a-7544-4749-b7bc-17ad98beaadb` shares 7 observations. This does not establish a common campaign.\n- Prior analysis `fc2de8b3-a6ce-4024-9d9b-5602034db53d` shares 7 observations. This does not establish a common campaign.\n- Prior analysis `b12014b8-9e64-4e70-bdb8-90620d23ac22` shares 11 observations. This does not establish a common campaign.\n- Prior analysis `ada03a66-9d3d-4c08-b448-f9758ac8bac5` shares 6 observations. This does not establish a common campaign.\n- Prior analysis `0b13588f-0835-4e15-9f97-8a9411ad7f7f` shares 14 observations. This does not establish a common campaign.\n- Prior analysis `92de15ed-01f0-4a43-8105-a56b60130430` shares 11 observations. This does not establish a common campaign.\n- Prior analysis `fdf1584a-1c2d-4a49-92b2-8dcb98436eb0` shares 8 observations. This does not establish a common campaign.\n- Prior analysis `fab22e38-ca53-4105-924e-f5722b5f53fe` shares 9 observations. This does not establish a common campaign.\n- Prior analysis `31f265dc-3055-4628-8df4-136d4058e842` shares 1 observations. This does not establish a common campaign.\n- Prior analysis `b60c4dbb-eb8f-46a7-89b9-24606fd43e46` shares 3 observations. This does not establish a common campaign.\n- Prior analysis `8174eaa7-e189-467f-b05e-fb7397bfcf16` shares 3 observations. This does not establish a common campaign.\n- Prior analysis `e37603cf-d241-45ee-95ec-bcf92a063147` shares 5 observations. This does not establish a common campaign.\n- Prior analysis `7c54479c-cce3-4570-80c9-69d03571a645` shares 7 observations. This does not establish a common campaign.\n- Prior analysis `21da2cda-3a07-4c03-b352-af8740c84bc0` shares 10 observations. This does not establish a common campaign.\n- Prior analysis `9923b3d5-8d06-4f6a-b1f1-810507712be3` shares 9 observations. This does not establish a common campaign.\n- Prior analysis `8f0da1cd-9998-4d41-9fc7-683302a6ee24` shares 10 observations. This does not establish a common campaign.\n- Prior analysis `96e0e828-93ae-49d5-8104-9f14cb584c3e` shares 8 observations. This does not establish a common campaign.\n- Prior analysis `6e50c68f-5552-400c-9835-15867ddb022d` shares 9 observations. This does not establish a common campaign.\n- Prior analysis `43bc93eb-d6db-4400-b983-b0dd404c8ca4` shares 10 observations. This does not establish a common campaign.\n- Prior analysis `6df36b51-4b44-4660-b534-2fa89705e807` shares 9 observations. This does not establish a common campaign.\n- External provider queries: 0. Not requested; no unknown indicator is classified as benign.\n\n## Coverage and limitations\n\n- Packet and protocol facts are deterministic for the recorded analyzer manifest.\n- Encrypted application payloads are not decrypted; only available metadata is reported.\n- ATT&CK mappings and actor overlaps are candidates until analyst review and promotion.\n- HTTP object inventory: `{\"compact_objects\":0,\"complete\":true,\"detailed_objects\":18,\"export_status\":\"completed\",\"exported_objects\":36,\"hashed_bytes\":760640,\"hashed_objects\":36,\"omitted_unique_hashes\":0,\"returned_unique_hashes\":18,\"selection\":\"content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index\",\"unhashed_objects\":0,\"unique_hashes\":18}`. Compact overflow hashes are retained in JSON coverage and observables.\n- A directory subject is not necessarily a logged-in user; consult identity bindings in the JSON evidence.\n- Rendered / available: findings 4/4, identities 3/3, observables 500/565, artifacts 18/18. Full returned inventory is in the JSON result.\n\n## Evidence-backed IOC assessment\n\n560 typed observations; 0 evidence-backed IOC candidates for review, including 0 with direct malicious provider reports. No automatic confirmation or attribution.\n\nPolicy: `pcap-assessment-v3`; assessment SHA-256: `796d489af3c826d2dcfae9e2bfdc42952edf1951c7f82f15a95b2ff955bfd831`.\n\n\nOrdinary observations remain in the capture inventory; they are not declared malicious IOCs.\n\nReputation snapshot: `65fc4a2052f0acba4c4954ace6998a51aae0838f08da7340788d1adc91fa7132`; updated 2026-09-22T17:46:00.926829+00:00. Each target retains its query time. Coverage: `{\"active_scans\":0,\"batch_results\":[{\"observable_id\":\"observable-433a641dc351a0c326074469\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-433a641dc351a0c326074469\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-d644a63266e91fd324da5b44\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-d644a63266e91fd324da5b44\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-b435ca743935f6703dad9358\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-b435ca743935f6703dad9358\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-f2151bfd24e041600180e837\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-f2151bfd24e041600180e837\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-a0f4a132ff9c49af306eca47\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-a0f4a132ff9c49af306eca47\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-4f087341ffe14e5fdcf290ad\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-4f087341ffe14e5fdcf290ad\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-23fcbd1b6899af2fa0be7f69\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-23fcbd1b6899af2fa0be7f69\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-43d502761133c22bac0209b2\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-43d502761133c22bac0209b2\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-a04182d0a119c4e17be36885\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-a04182d0a119c4e17be36885\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-05ef48696bde9d3fec6089a7\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-05ef48696bde9d3fec6089a7\",\"provider\":\"threatfox\",\"status\":\"not_found\"}],\"batch_targets\":10,\"cache_hits\":2,\"full_urls_disclosed\":0,\"payload_uploads\":0,\"provider_lookups_started\":8,\"retained_targets\":60,\"targets_omitted\":0}`.\n- No detections, no record, missing credentials and provider errors do not mean benign.\n- Current reputation may postdate the capture. Shared hosting, DNS resolution and graph overlap do not transfer maliciousness.\n- A recovered file is not proof of execution; hashes identify exported bytes, including partial objects.\n- Public-looking enterprise domains may still be sensitive: review selected targets before external disclosure.\n", "result": { "flows": [ { "bytes": 7133, "stream": 0, "flow_id": "flow-84c41d164648b31fc2dff865", "packets": 21, "transport": "tcp", "last_frame": 64, "first_frame": 1, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 49185, "responder_port": 389, "initiator_bytes": 3388, "last_seen_epoch": "1575413096.074454", "responder_bytes": 3745, "first_seen_epoch": "1575413096.035613" }, { "bytes": 4149, "stream": 1, "flow_id": "flow-4ed8a8db44e18a052ae98f5e", "packets": 13, "transport": "tcp", "last_frame": 62, "first_frame": 20, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 49186, "responder_port": 389, "initiator_bytes": 3339, "last_seen_epoch": "1575413096.074212", "responder_bytes": 810, "first_seen_epoch": "1575413096.046471" }, { "bytes": 981, "stream": 2, "flow_id": "flow-372ae290670ed2758cfa24ce", "packets": 8, "transport": "tcp", "last_frame": 36, "first_frame": 29, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 49187, "responder_port": 88, "initiator_bytes": 470, "last_seen_epoch": "1575413096.05351", "responder_bytes": 511, "first_seen_epoch": "1575413096.052279" }, { "bytes": 2489, "stream": 3, "flow_id": "flow-798492c697cc8465ac9c4b3b", "packets": 10, "transport": "tcp", "last_frame": 46, "first_frame": 37, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 49188, "responder_port": 88, "initiator_bytes": 604, "last_seen_epoch": "1575413096.069759", "responder_bytes": 1885, "first_seen_epoch": "1575413096.068448" }, { "bytes": 3786, "stream": 4, "flow_id": "flow-d63f9391b03d1ae99bb91c02", "packets": 12, "transport": "tcp", "last_frame": 58, "first_frame": 47, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 49189, "responder_port": 88, "initiator_bytes": 1910, "last_seen_epoch": "1575413096.071569", "responder_bytes": 1876, "first_seen_epoch": "1575413096.070253" }, { "bytes": 1574, "stream": 5, "flow_id": "flow-edf1f452dcce83ae6d21b0a7", "packets": 13, "transport": "tcp", "last_frame": 264, "first_frame": 65, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 49180, "responder_port": 445, "initiator_bytes": 832, "last_seen_epoch": "1575413125.210724", "responder_bytes": 742, "first_seen_epoch": "1575413101.218968" }, { "bytes": 558, "stream": 6, "flow_id": "flow-2b59d7e26e1c37032e0dee18", "packets": 5, "transport": "tcp", "last_frame": 73, "first_frame": 67, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 49161, "responder_port": 445, "initiator_bytes": 306, "last_seen_epoch": "1575413101.221011", "responder_bytes": 252, "first_seen_epoch": "1575413101.219804" }, { "bytes": 216, "stream": 7, "flow_id": "flow-e67f1dcb50559b5ae1c30c5f", "packets": 4, "transport": "tcp", "last_frame": 85, "first_frame": 78, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 49155, "responder_port": 135, "initiator_bytes": 108, "last_seen_epoch": "1575413113.699767", "responder_bytes": 108, "first_seen_epoch": "1575413113.698863" }, { "bytes": 216, "stream": 8, "flow_id": "flow-05141bb03c8b44d7ef83eb10", "packets": 4, "transport": "tcp", "last_frame": 83, "first_frame": 79, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 49156, "responder_port": 49158, "initiator_bytes": 108, "last_seen_epoch": "1575413113.699603", "responder_bytes": 108, "first_seen_epoch": "1575413113.699148" }, { "bytes": 918, "stream": 9, "flow_id": "flow-6f5871fe59cb473688ef412d", "packets": 8, "transport": "tcp", "last_frame": 93, "first_frame": 86, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 49190, "responder_port": 88, "initiator_bytes": 459, "last_seen_epoch": "1575413121.833362", "responder_bytes": 459, "first_seen_epoch": "1575413121.831802" }, { "bytes": 2460, "stream": 10, "flow_id": "flow-481f603f9f45f204bd7a7c47", "packets": 10, "transport": "tcp", "last_frame": 103, "first_frame": 94, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 49191, "responder_port": 88, "initiator_bytes": 593, "last_seen_epoch": "1575413121.845054", "responder_bytes": 1867, "first_seen_epoch": "1575413121.843374" }, { "bytes": 3647, "stream": 11, "flow_id": "flow-8d408489650e29668e134774", "packets": 12, "transport": "tcp", "last_frame": 115, "first_frame": 104, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 49192, "responder_port": 88, "initiator_bytes": 1808, "last_seen_epoch": "1575413121.846475", "responder_bytes": 1839, "first_seen_epoch": "1575413121.845099" }, { "bytes": 1280, "stream": 12, "flow_id": "flow-ff2fc6f7b07341acf5e1b310", "packets": 12, "transport": "tcp", "last_frame": 271, "first_frame": 116, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 49193, "responder_port": 135, "initiator_bytes": 718, "last_seen_epoch": "1575413143.699009", "responder_bytes": 562, "first_seen_epoch": "1575413122.22931" }, { "bytes": 3925, "stream": 13, "flow_id": "flow-845e2e59793ad319d3c8dd0a", "packets": 12, "transport": "tcp", "last_frame": 134, "first_frame": 123, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 49194, "responder_port": 88, "initiator_bytes": 1977, "last_seen_epoch": "1575413122.240035", "responder_bytes": 1948, "first_seen_epoch": "1575413122.232446" }, { "bytes": 5296, "stream": 14, "flow_id": "flow-8eab5df6102950f3e370aee5", "packets": 19, "transport": "tcp", "last_frame": 2862, "first_frame": 135, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 49173, "responder_port": 49155, "initiator_bytes": 3417, "last_seen_epoch": "1575413173.700563", "responder_bytes": 1879, "first_seen_epoch": "1575413122.240222" }, { "bytes": 8213, "stream": 15, "flow_id": "flow-1a64e41a8b367a2da1a3898c", "packets": 46, "transport": "tcp", "last_frame": 16455, "first_frame": 149, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 49195, "responder_port": 445, "initiator_bytes": 5746, "last_seen_epoch": "1575414090.569563", "responder_bytes": 2467, "first_seen_epoch": "1575413122.266862" }, { "bytes": 3900, "stream": 16, "flow_id": "flow-b001c1b3fbe1db68d1182ace", "packets": 12, "transport": "tcp", "last_frame": 167, "first_frame": 156, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 49196, "responder_port": 88, "initiator_bytes": 1962, "last_seen_epoch": "1575413122.270504", "responder_bytes": 1938, "first_seen_epoch": "1575413122.268942" }, { "bytes": 3607, "stream": 17, "flow_id": "flow-057ed81c777a563645182648", "packets": 12, "transport": "tcp", "last_frame": 179, "first_frame": 168, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 49197, "responder_port": 88, "initiator_bytes": 1797, "last_seen_epoch": "1575413122.271689", "responder_bytes": 1810, "first_seen_epoch": "1575413122.270564" }, { "bytes": 329, "stream": 0, "flow_id": "flow-f10024c11795c57d8ef35d2a", "packets": 2, "transport": "udp", "last_frame": 196, "first_frame": 195, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 59102, "responder_port": 53, "initiator_bytes": 128, "last_seen_epoch": "1575413122.764586", "responder_bytes": 201, "first_seen_epoch": "1575413122.764317" }, { "bytes": 267, "stream": 1, "flow_id": "flow-f39ac7e8340f24ad5fb07a61", "packets": 2, "transport": "udp", "last_frame": 198, "first_frame": 197, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 53522, "responder_port": 53, "initiator_bytes": 97, "last_seen_epoch": "1575413122.765282", "responder_bytes": 170, "first_seen_epoch": "1575413122.765075" }, { "bytes": 5180, "stream": 18, "flow_id": "flow-e36d8af47d7af6c96383274b", "packets": 15, "transport": "tcp", "last_frame": 256, "first_frame": 199, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 49198, "responder_port": 389, "initiator_bytes": 2933, "last_seen_epoch": "1575413123.294627", "responder_bytes": 2247, "first_seen_epoch": "1575413122.766534" }, { "bytes": 3900, "stream": 19, "flow_id": "flow-7bc1a31f8fc41543e00ee690", "packets": 12, "transport": "tcp", "last_frame": 213, "first_frame": 202, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 49199, "responder_port": 88, "initiator_bytes": 1962, "last_seen_epoch": "1575413122.769208", "responder_bytes": 1938, "first_seen_epoch": "1575413122.767681" }, { "bytes": 3390, "stream": 20, "flow_id": "flow-dfde97081ecbc1002bc37eea", "packets": 13, "transport": "tcp", "last_frame": 250, "first_frame": 220, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 49200, "responder_port": 389, "initiator_bytes": 2540, "last_seen_epoch": "1575413122.785217", "responder_bytes": 850, "first_seen_epoch": "1575413122.774543" }, { "bytes": 6906, "stream": 21, "flow_id": "flow-b3e776f9aab6c630e9b9b0ee", "packets": 25, "transport": "tcp", "last_frame": 732, "first_frame": 233, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 49201, "responder_port": 445, "initiator_bytes": 5048, "last_seen_epoch": "1575413161.216787", "responder_bytes": 1858, "first_seen_epoch": "1575413122.780681" }, { "bytes": 168, "stream": 2, "flow_id": "flow-d8169c8a51cefd8af4b7fbb6", "packets": 2, "transport": "udp", "last_frame": 257, "first_frame": 253, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 52634, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1575413123.352446", "responder_bytes": 92, "first_seen_epoch": "1575413123.292845" }, { "bytes": 180, "stream": 3, "flow_id": "flow-b587d57ba2ce22f7ccba4393", "packets": 2, "transport": "udp", "last_frame": 259, "first_frame": 258, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 62941, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1575413123.412011", "responder_bytes": 104, "first_seen_epoch": "1575413123.353131" }, { "bytes": 222, "stream": 4, "flow_id": "flow-952a8cce79cb1ca95375e4ba", "packets": 2, "transport": "udp", "last_frame": 276, "first_frame": 275, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 63849, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1575413155.227694", "responder_bytes": 150, "first_seen_epoch": "1575413155.172788" }, { "bytes": 1380, "stream": 5, "flow_id": "flow-d4ecdcbdd19607a245606e9c", "packets": 15, "transport": "udp", "last_frame": 16713, "first_frame": 277, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.255", "initiator_port": 137, "responder_port": 137, "initiator_bytes": 1380, "last_seen_epoch": "1575414485.622146", "responder_bytes": 0, "first_seen_epoch": "1575413155.774442" }, { "bytes": 1385, "stream": 22, "flow_id": "flow-947e69d689746af4620e5a3c", "packets": 11, "transport": "tcp", "last_frame": 4042, "first_frame": 278, "initiator_ip": "10.18.20.97", "responder_ip": "69.147.64.34", "initiator_port": 49203, "responder_port": 80, "initiator_bytes": 583, "last_seen_epoch": "1575413242.858854", "responder_bytes": 802, "first_seen_epoch": "1575413155.847475" }, { "bytes": 6756, "stream": 23, "flow_id": "flow-9a50e5d45c0317b14a9cdd99", "packets": 25, "transport": "tcp", "last_frame": 4034, "first_frame": 285, "initiator_ip": "10.18.20.97", "responder_ip": "69.147.64.34", "initiator_port": 49204, "responder_port": 443, "initiator_bytes": 1270, "last_seen_epoch": "1575413242.847527", "responder_bytes": 5486, "first_seen_epoch": "1575413156.039015" }, { "bytes": 230, "stream": 6, "flow_id": "flow-5ccb061bd434100ec486b08d", "packets": 2, "transport": "udp", "last_frame": 308, "first_frame": 307, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 57937, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1575413156.734046", "responder_bytes": 153, "first_seen_epoch": "1575413156.673565" }, { "bytes": 6124, "stream": 24, "flow_id": "flow-cb1a61d4b3ba2a26dcf25156", "packets": 21, "transport": "tcp", "last_frame": 3987, "first_frame": 309, "initiator_ip": "10.18.20.97", "responder_ip": "67.195.204.151", "initiator_port": 49205, "responder_port": 443, "initiator_bytes": 931, "last_seen_epoch": "1575413241.616441", "responder_bytes": 5193, "first_seen_epoch": "1575413156.735399" }, { "bytes": 8819, "stream": 25, "flow_id": "flow-66fa0534ee1c592d9e21d7c7", "packets": 25, "transport": "tcp", "last_frame": 350, "first_frame": 310, "initiator_ip": "10.18.20.97", "responder_ip": "67.195.204.151", "initiator_port": 49206, "responder_port": 443, "initiator_bytes": 2052, "last_seen_epoch": "1575413157.213621", "responder_bytes": 6767, "first_seen_epoch": "1575413156.735561" }, { "bytes": 230, "stream": 7, "flow_id": "flow-45d8393ac67c968ab14bbccb", "packets": 2, "transport": "udp", "last_frame": 352, "first_frame": 351, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 63013, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1575413157.278971", "responder_bytes": 153, "first_seen_epoch": "1575413157.216685" }, { "bytes": 13609, "stream": 26, "flow_id": "flow-effea7ce7228221a61bf8ca4", "packets": 30, "transport": "tcp", "last_frame": 397, "first_frame": 353, "initiator_ip": "10.18.20.97", "responder_ip": "98.137.156.136", "initiator_port": 49207, "responder_port": 443, "initiator_bytes": 2352, "last_seen_epoch": "1575413157.771881", "responder_bytes": 11257, "first_seen_epoch": "1575413157.279503" }, { "bytes": 5821, "stream": 27, "flow_id": "flow-b1e5876e28868c4794a2182c", "packets": 18, "transport": "tcp", "last_frame": 3894, "first_frame": 354, "initiator_ip": "10.18.20.97", "responder_ip": "98.137.156.136", "initiator_port": 49208, "responder_port": 443, "initiator_bytes": 769, "last_seen_epoch": "1575413239.591881", "responder_bytes": 5052, "first_seen_epoch": "1575413157.279563" }, { "bytes": 222, "stream": 8, "flow_id": "flow-e56fcf67302e0af37c1b0403", "packets": 2, "transport": "udp", "last_frame": 399, "first_frame": 398, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 62613, "responder_port": 53, "initiator_bytes": 73, "last_seen_epoch": "1575413157.843186", "responder_bytes": 149, "first_seen_epoch": "1575413157.773625" }, { "bytes": 61327, "stream": 28, "flow_id": "flow-37897eb4f737d6d2f408ffbd", "packets": 95, "transport": "tcp", "last_frame": 518, "first_frame": 400, "initiator_ip": "10.18.20.97", "responder_ip": "67.195.204.151", "initiator_port": 49210, "responder_port": 443, "initiator_bytes": 4374, "last_seen_epoch": "1575413159.09028", "responder_bytes": 56953, "first_seen_epoch": "1575413157.843689" }, { "bytes": 13788, "stream": 29, "flow_id": "flow-8580d209777abcf7c5d8da77", "packets": 33, "transport": "tcp", "last_frame": 3207, "first_frame": 401, "initiator_ip": "10.18.20.97", "responder_ip": "67.195.204.151", "initiator_port": 49209, "responder_port": 443, "initiator_bytes": 4845, "last_seen_epoch": "1575413208.999603", "responder_bytes": 8943, "first_seen_epoch": "1575413157.843754" }, { "bytes": 394, "stream": 30, "flow_id": "flow-cc47d1b695acb36315916da6", "packets": 7, "transport": "tcp", "last_frame": 4039, "first_frame": 463, "initiator_ip": "10.18.20.97", "responder_ip": "69.147.64.34", "initiator_port": 49202, "responder_port": 80, "initiator_bytes": 228, "last_seen_epoch": "1575413242.848537", "responder_bytes": 166, "first_seen_epoch": "1575413158.844551" }, { "bytes": 211, "stream": 9, "flow_id": "flow-24334169a3c23547c93ddf63", "packets": 2, "transport": "udp", "last_frame": 504, "first_frame": 502, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 59748, "responder_port": 53, "initiator_bytes": 70, "last_seen_epoch": "1575413158.967341", "responder_bytes": 141, "first_seen_epoch": "1575413158.880779" }, { "bytes": 142870, "stream": 31, "flow_id": "flow-d53c120d2d8ca496ef115c6b", "packets": 215, "transport": "tcp", "last_frame": 12168, "first_frame": 514, "initiator_ip": "10.18.20.97", "responder_ip": "69.147.64.34", "initiator_port": 49211, "responder_port": 443, "initiator_bytes": 8262, "last_seen_epoch": "1575413302.526099", "responder_bytes": 134608, "first_seen_epoch": "1575413158.970078" }, { "bytes": 168049, "stream": 32, "flow_id": "flow-8567393a97ca7a8af1f1e670", "packets": 259, "transport": "tcp", "last_frame": 12479, "first_frame": 515, "initiator_ip": "10.18.20.97", "responder_ip": "69.147.64.34", "initiator_port": 49212, "responder_port": 443, "initiator_bytes": 10181, "last_seen_epoch": "1575413302.754499", "responder_bytes": 157868, "first_seen_epoch": "1575413158.970525" }, { "bytes": 206847, "stream": 33, "flow_id": "flow-6bebd6d18f18c66a7a8015ab", "packets": 302, "transport": "tcp", "last_frame": 12473, "first_frame": 519, "initiator_ip": "10.18.20.97", "responder_ip": "69.147.64.34", "initiator_port": 49213, "responder_port": 443, "initiator_bytes": 12458, "last_seen_epoch": "1575413302.743746", "responder_bytes": 194389, "first_seen_epoch": "1575413159.09285" }, { "bytes": 265, "stream": 10, "flow_id": "flow-b278ece25f7113628074fc82", "packets": 2, "transport": "udp", "last_frame": 559, "first_frame": 550, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 57621, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1575413159.571825", "responder_bytes": 193, "first_seen_epoch": "1575413159.406992" }, { "bytes": 231, "stream": 11, "flow_id": "flow-adb27e6148f2be7fe6c68a2e", "packets": 2, "transport": "udp", "last_frame": 560, "first_frame": 551, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 63874, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1575413159.571932", "responder_bytes": 159, "first_seen_epoch": "1575413159.407057" }, { "bytes": 220, "stream": 12, "flow_id": "flow-ef65c6ff75c4cf00bc0f02db", "packets": 2, "transport": "udp", "last_frame": 561, "first_frame": 552, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 59279, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1575413159.57202", "responder_bytes": 148, "first_seen_epoch": "1575413159.407211" }, { "bytes": 276, "stream": 13, "flow_id": "flow-66268a9725222c9e25e63197", "packets": 2, "transport": "udp", "last_frame": 556, "first_frame": 553, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 50702, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1575413159.571651", "responder_bytes": 204, "first_seen_epoch": "1575413159.407451" }, { "bytes": 276, "stream": 14, "flow_id": "flow-40c8b197707e037b023d11d7", "packets": 2, "transport": "udp", "last_frame": 557, "first_frame": 554, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 61598, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1575413159.571721", "responder_bytes": 204, "first_seen_epoch": "1575413159.407503" }, { "bytes": 276, "stream": 15, "flow_id": "flow-94d72ae30cee93eefaa178b3", "packets": 2, "transport": "udp", "last_frame": 558, "first_frame": 555, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 52900, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1575413159.571772", "responder_bytes": 204, "first_seen_epoch": "1575413159.407726" }, { "bytes": 528, "stream": 16, "flow_id": "flow-4182eb0d21372b08c9abd3ff", "packets": 4, "transport": "udp", "last_frame": 13337, "first_frame": 639, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 63690, "responder_port": 53, "initiator_bytes": 150, "last_seen_epoch": "1575413306.294911", "responder_bytes": 378, "first_seen_epoch": "1575413160.313364" }, { "bytes": 233, "stream": 17, "flow_id": "flow-28c0b4067df7fda5517f2bff", "packets": 2, "transport": "udp", "last_frame": 647, "first_frame": 640, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 55634, "responder_port": 53, "initiator_bytes": 73, "last_seen_epoch": "1575413160.623478", "responder_bytes": 160, "first_seen_epoch": "1575413160.316417" }, { "bytes": 224, "stream": 18, "flow_id": "flow-d3548af23ed293897dd2530b", "packets": 2, "transport": "udp", "last_frame": 648, "first_frame": 641, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 59976, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1575413160.623583", "responder_bytes": 152, "first_seen_epoch": "1575413160.335721" }, { "bytes": 25724, "stream": 34, "flow_id": "flow-f3ac50a991107a47d2a5c794", "packets": 59, "transport": "tcp", "last_frame": 12483, "first_frame": 645, "initiator_ip": "10.18.20.97", "responder_ip": "66.218.84.42", "initiator_port": 49214, "responder_port": 443, "initiator_bytes": 14975, "last_seen_epoch": "1575413302.77018", "responder_bytes": 10749, "first_seen_epoch": "1575413160.448329" }, { "bytes": 5205, "stream": 35, "flow_id": "flow-0ac29202c0936e17c4563703", "packets": 19, "transport": "tcp", "last_frame": 10470, "first_frame": 652, "initiator_ip": "10.18.20.97", "responder_ip": "69.147.64.34", "initiator_port": 49215, "responder_port": 443, "initiator_bytes": 832, "last_seen_epoch": "1575413265.954452", "responder_bytes": 4373, "first_seen_epoch": "1575413160.624504" }, { "bytes": 25819, "stream": 36, "flow_id": "flow-43de21d499e3ff0b797cec2c", "packets": 56, "transport": "tcp", "last_frame": 2884, "first_frame": 653, "initiator_ip": "10.18.20.97", "responder_ip": "98.137.156.137", "initiator_port": 49216, "responder_port": 443, "initiator_bytes": 15231, "last_seen_epoch": "1575413185.079885", "responder_bytes": 10588, "first_seen_epoch": "1575413160.624563" }, { "bytes": 23795, "stream": 37, "flow_id": "flow-f637c150999eb2cf2cf95e7e", "packets": 49, "transport": "tcp", "last_frame": 12159, "first_frame": 654, "initiator_ip": "10.18.20.97", "responder_ip": "69.147.64.34", "initiator_port": 49217, "responder_port": 443, "initiator_bytes": 2559, "last_seen_epoch": "1575413302.525387", "responder_bytes": 21236, "first_seen_epoch": "1575413160.624674" }, { "bytes": 6707, "stream": 38, "flow_id": "flow-bc548dc13853bc02b6bfe3b3", "packets": 22, "transport": "tcp", "last_frame": 2887, "first_frame": 656, "initiator_ip": "10.18.20.97", "responder_ip": "98.137.156.137", "initiator_port": 49218, "responder_port": 443, "initiator_bytes": 981, "last_seen_epoch": "1575413185.080171", "responder_bytes": 5726, "first_seen_epoch": "1575413160.624904" }, { "bytes": 271, "stream": 19, "flow_id": "flow-868595ea3ead2a401d77f2ce", "packets": 2, "transport": "udp", "last_frame": 934, "first_frame": 919, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 60225, "responder_port": 53, "initiator_bytes": 75, "last_seen_epoch": "1575413162.915618", "responder_bytes": 196, "first_seen_epoch": "1575413162.712452" }, { "bytes": 253, "stream": 20, "flow_id": "flow-a695245ee2c46614bf157ce8", "packets": 2, "transport": "udp", "last_frame": 928, "first_frame": 920, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 49658, "responder_port": 53, "initiator_bytes": 84, "last_seen_epoch": "1575413162.912415", "responder_bytes": 169, "first_seen_epoch": "1575413162.714269" }, { "bytes": 222, "stream": 21, "flow_id": "flow-7247f7f13ab0f28dbde16d69", "packets": 2, "transport": "udp", "last_frame": 929, "first_frame": 921, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 49423, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1575413162.912621", "responder_bytes": 140, "first_seen_epoch": "1575413162.716337" }, { "bytes": 7519, "stream": 39, "flow_id": "flow-8b5a832f8dd70c9440b25322", "packets": 24, "transport": "tcp", "last_frame": 10457, "first_frame": 930, "initiator_ip": "10.18.20.97", "responder_ip": "152.195.32.163", "initiator_port": 49219, "responder_port": 443, "initiator_bytes": 1363, "last_seen_epoch": "1575413265.931271", "responder_bytes": 6156, "first_seen_epoch": "1575413162.913044" }, { "bytes": 10838, "stream": 40, "flow_id": "flow-d73cc906835f7c0aa48417f0", "packets": 29, "transport": "tcp", "last_frame": 9042, "first_frame": 931, "initiator_ip": "10.18.20.97", "responder_ip": "152.199.24.48", "initiator_port": 49220, "responder_port": 443, "initiator_bytes": 1591, "last_seen_epoch": "1575413261.191138", "responder_bytes": 9247, "first_seen_epoch": "1575413162.9131" }, { "bytes": 5876, "stream": 41, "flow_id": "flow-15b34ec6ce66dd39101d03bf", "packets": 22, "transport": "tcp", "last_frame": 10399, "first_frame": 932, "initiator_ip": "10.18.20.97", "responder_ip": "152.195.32.163", "initiator_port": 49221, "responder_port": 443, "initiator_bytes": 990, "last_seen_epoch": "1575413265.781747", "responder_bytes": 4886, "first_seen_epoch": "1575413162.913225" }, { "bytes": 20623, "stream": 42, "flow_id": "flow-c27f286405c2c8f82c00c588", "packets": 47, "transport": "tcp", "last_frame": 9043, "first_frame": 933, "initiator_ip": "10.18.20.97", "responder_ip": "152.199.24.48", "initiator_port": 49222, "responder_port": 443, "initiator_bytes": 3356, "last_seen_epoch": "1575413261.191224", "responder_bytes": 17267, "first_seen_epoch": "1575413162.913275" }, { "bytes": 8462, "stream": 43, "flow_id": "flow-34dfbb9dbe95adc671f237e1", "packets": 28, "transport": "tcp", "last_frame": 12463, "first_frame": 935, "initiator_ip": "10.18.20.97", "responder_ip": "152.199.6.14", "initiator_port": 49223, "responder_port": 443, "initiator_bytes": 3261, "last_seen_epoch": "1575413302.72738", "responder_bytes": 5201, "first_seen_epoch": "1575413162.916174" }, { "bytes": 5276, "stream": 44, "flow_id": "flow-291f060cb93a012c2ed8a7eb", "packets": 22, "transport": "tcp", "last_frame": 10402, "first_frame": 936, "initiator_ip": "10.18.20.97", "responder_ip": "152.199.6.14", "initiator_port": 49224, "responder_port": 443, "initiator_bytes": 983, "last_seen_epoch": "1575413265.782042", "responder_bytes": 4293, "first_seen_epoch": "1575413162.916254" }, { "bytes": 282, "stream": 22, "flow_id": "flow-75b8c711df4bebc1df5ca3ca", "packets": 2, "transport": "udp", "last_frame": 1072, "first_frame": 1037, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 52091, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1575413163.219942", "responder_bytes": 202, "first_seen_epoch": "1575413163.086015" }, { "bytes": 193, "stream": 23, "flow_id": "flow-11b591153f545ac968d21101", "packets": 2, "transport": "udp", "last_frame": 1069, "first_frame": 1040, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 56275, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1575413163.19855", "responder_bytes": 115, "first_seen_epoch": "1575413163.088488" }, { "bytes": 4653, "stream": 45, "flow_id": "flow-4293cdeccec67390eac573bb", "packets": 19, "transport": "tcp", "last_frame": 7779, "first_frame": 1070, "initiator_ip": "10.18.20.97", "responder_ip": "172.217.14.166", "initiator_port": 49225, "responder_port": 443, "initiator_bytes": 862, "last_seen_epoch": "1575413255.684496", "responder_bytes": 3791, "first_seen_epoch": "1575413163.199111" }, { "bytes": 27034, "stream": 46, "flow_id": "flow-ba0c261acb8e29231045d7e5", "packets": 57, "transport": "tcp", "last_frame": 12448, "first_frame": 1071, "initiator_ip": "10.18.20.97", "responder_ip": "172.217.14.166", "initiator_port": 49226, "responder_port": 443, "initiator_bytes": 5411, "last_seen_epoch": "1575413302.721022", "responder_bytes": 21623, "first_seen_epoch": "1575413163.199207" }, { "bytes": 118447, "stream": 47, "flow_id": "flow-574c3c0b4eb83de1c1f797a1", "packets": 175, "transport": "tcp", "last_frame": 10458, "first_frame": 1073, "initiator_ip": "10.18.20.97", "responder_ip": "152.199.6.11", "initiator_port": 49227, "responder_port": 443, "initiator_bytes": 5529, "last_seen_epoch": "1575413265.931304", "responder_bytes": 112918, "first_seen_epoch": "1575413163.220576" }, { "bytes": 1001485, "stream": 48, "flow_id": "flow-6730275d0d9763c029a87f8e", "packets": 1057, "transport": "tcp", "last_frame": 10459, "first_frame": 1074, "initiator_ip": "10.18.20.97", "responder_ip": "152.199.6.11", "initiator_port": 49228, "responder_port": 443, "initiator_bytes": 21113, "last_seen_epoch": "1575413265.931337", "responder_bytes": 980372, "first_seen_epoch": "1575413163.220629" }, { "bytes": 268, "stream": 24, "flow_id": "flow-b78fe6061876ad1f6bc2c295", "packets": 2, "transport": "udp", "last_frame": 1144, "first_frame": 1103, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 59553, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1575413163.522891", "responder_bytes": 178, "first_seen_epoch": "1575413163.334867" }, { "bytes": 11032, "stream": 49, "flow_id": "flow-85c695df1e88ed3715d553b8", "packets": 32, "transport": "tcp", "last_frame": 9168, "first_frame": 1145, "initiator_ip": "10.18.20.97", "responder_ip": "152.195.14.41", "initiator_port": 49229, "responder_port": 443, "initiator_bytes": 2098, "last_seen_epoch": "1575413262.384314", "responder_bytes": 8934, "first_seen_epoch": "1575413163.523298" }, { "bytes": 5112, "stream": 50, "flow_id": "flow-0a7968ec238608cfc5e67b97", "packets": 22, "transport": "tcp", "last_frame": 9142, "first_frame": 1146, "initiator_ip": "10.18.20.97", "responder_ip": "152.195.14.41", "initiator_port": 49230, "responder_port": 443, "initiator_bytes": 998, "last_seen_epoch": "1575413262.327485", "responder_bytes": 4114, "first_seen_epoch": "1575413163.523433" }, { "bytes": 196, "stream": 25, "flow_id": "flow-f05c09f2d8b47d45c792a56a", "packets": 2, "transport": "udp", "last_frame": 1448, "first_frame": 1395, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 54089, "responder_port": 53, "initiator_bytes": 71, "last_seen_epoch": "1575413164.452822", "responder_bytes": 125, "first_seen_epoch": "1575413164.03542" }, { "bytes": 469, "stream": 26, "flow_id": "flow-ecf6bfac4342d507be6de8fb", "packets": 3, "transport": "udp", "last_frame": 2223, "first_frame": 1430, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 54576, "responder_port": 53, "initiator_bytes": 150, "last_seen_epoch": "1575413165.992964", "responder_bytes": 319, "first_seen_epoch": "1575413164.247294" }, { "bytes": 281, "stream": 27, "flow_id": "flow-5c6483b8fe7445a654b0b5f3", "packets": 3, "transport": "udp", "last_frame": 2214, "first_frame": 1431, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 62857, "responder_port": 53, "initiator_bytes": 150, "last_seen_epoch": "1575413165.990675", "responder_bytes": 131, "first_seen_epoch": "1575413164.249265" }, { "bytes": 5772, "stream": 51, "flow_id": "flow-fbd5cd3526863a8bd867426c", "packets": 21, "transport": "tcp", "last_frame": 7815, "first_frame": 1520, "initiator_ip": "10.18.20.97", "responder_ip": "172.217.12.38", "initiator_port": 49231, "responder_port": 443, "initiator_bytes": 1244, "last_seen_epoch": "1575413255.910696", "responder_bytes": 4528, "first_seen_epoch": "1575413164.467939" }, { "bytes": 4592, "stream": 52, "flow_id": "flow-f887241a5ad27b95c5f1104b", "packets": 18, "transport": "tcp", "last_frame": 7816, "first_frame": 1521, "initiator_ip": "10.18.20.97", "responder_ip": "172.217.12.38", "initiator_port": 49232, "responder_port": 443, "initiator_bytes": 801, "last_seen_epoch": "1575413255.910977", "responder_bytes": 3791, "first_seen_epoch": "1575413164.468114" }, { "bytes": 313, "stream": 28, "flow_id": "flow-92acd20b5fc4f4f18b558a63", "packets": 3, "transport": "udp", "last_frame": 2224, "first_frame": 1598, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 62337, "responder_port": 53, "initiator_bytes": 166, "last_seen_epoch": "1575413165.993066", "responder_bytes": 147, "first_seen_epoch": "1575413164.774429" }, { "bytes": 7984, "stream": 53, "flow_id": "flow-27064de82ba5a18d3f24a424", "packets": 25, "transport": "tcp", "last_frame": 10387, "first_frame": 2216, "initiator_ip": "10.18.20.97", "responder_ip": "34.232.64.168", "initiator_port": 49233, "responder_port": 443, "initiator_bytes": 1916, "last_seen_epoch": "1575413265.780716", "responder_bytes": 6068, "first_seen_epoch": "1575413165.991177" }, { "bytes": 55401, "stream": 54, "flow_id": "flow-bece3b0e539c9e99121c6703", "packets": 117, "transport": "tcp", "last_frame": 12129, "first_frame": 2217, "initiator_ip": "10.18.20.97", "responder_ip": "34.232.64.168", "initiator_port": 49234, "responder_port": 443, "initiator_bytes": 41217, "last_seen_epoch": "1575413302.522696", "responder_bytes": 14184, "first_seen_epoch": "1575413165.991354" }, { "bytes": 6297, "stream": 55, "flow_id": "flow-674a7288cbc397a5bc3d28e7", "packets": 25, "transport": "tcp", "last_frame": 3518, "first_frame": 2225, "initiator_ip": "10.18.20.97", "responder_ip": "98.137.155.9", "initiator_port": 49235, "responder_port": 443, "initiator_bytes": 1434, "last_seen_epoch": "1575413212.137955", "responder_bytes": 4863, "first_seen_epoch": "1575413165.993412" }, { "bytes": 6185, "stream": 56, "flow_id": "flow-c2bb0fedc58938ba2e796714", "packets": 25, "transport": "tcp", "last_frame": 3532, "first_frame": 2227, "initiator_ip": "10.18.20.97", "responder_ip": "98.137.155.9", "initiator_port": 49236, "responder_port": 443, "initiator_bytes": 1380, "last_seen_epoch": "1575413212.138901", "responder_bytes": 4805, "first_seen_epoch": "1575413165.993638" }, { "bytes": 10730, "stream": 57, "flow_id": "flow-a550a2f5f7c4d177117d14c2", "packets": 32, "transport": "tcp", "last_frame": 12132, "first_frame": 2228, "initiator_ip": "10.18.20.97", "responder_ip": "3.136.40.187", "initiator_port": 49237, "responder_port": 443, "initiator_bytes": 5135, "last_seen_epoch": "1575413302.522959", "responder_bytes": 5595, "first_seen_epoch": "1575413165.993689" }, { "bytes": 5508, "stream": 58, "flow_id": "flow-1f9f90a558e0a9680a26cb95", "packets": 21, "transport": "tcp", "last_frame": 10390, "first_frame": 2230, "initiator_ip": "10.18.20.97", "responder_ip": "3.136.40.187", "initiator_port": 49238, "responder_port": 443, "initiator_bytes": 929, "last_seen_epoch": "1575413265.78099", "responder_bytes": 4579, "first_seen_epoch": "1575413165.993844" }, { "bytes": 8145, "stream": 59, "flow_id": "flow-9b33107eb6e64b912e5395b6", "packets": 31, "transport": "tcp", "last_frame": 3509, "first_frame": 2231, "initiator_ip": "10.18.20.97", "responder_ip": "98.137.155.9", "initiator_port": 49239, "responder_port": 443, "initiator_bytes": 2065, "last_seen_epoch": "1575413212.13429", "responder_bytes": 6080, "first_seen_epoch": "1575413165.993892" }, { "bytes": 6259, "stream": 60, "flow_id": "flow-df8b8361353cbdb50e869376", "packets": 24, "transport": "tcp", "last_frame": 3515, "first_frame": 2232, "initiator_ip": "10.18.20.97", "responder_ip": "98.137.155.9", "initiator_port": 49240, "responder_port": 443, "initiator_bytes": 1380, "last_seen_epoch": "1575413212.137796", "responder_bytes": 4879, "first_seen_epoch": "1575413165.994014" }, { "bytes": 6206, "stream": 61, "flow_id": "flow-4a034b70ce4cbd067122c166", "packets": 25, "transport": "tcp", "last_frame": 3512, "first_frame": 2233, "initiator_ip": "10.18.20.97", "responder_ip": "98.137.155.9", "initiator_port": 49241, "responder_port": 443, "initiator_bytes": 1434, "last_seen_epoch": "1575413212.137458", "responder_bytes": 4772, "first_seen_epoch": "1575413165.994071" }, { "bytes": 287, "stream": 29, "flow_id": "flow-a6f4ff52577c923c76d49254", "packets": 2, "transport": "udp", "last_frame": 2546, "first_frame": 2499, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 53972, "responder_port": 53, "initiator_bytes": 94, "last_seen_epoch": "1575413166.668934", "responder_bytes": 193, "first_seen_epoch": "1575413166.433997" }, { "bytes": 6375, "stream": 62, "flow_id": "flow-c0a4a61a788e744c2d31c1fd", "packets": 27, "transport": "tcp", "last_frame": 10378, "first_frame": 2560, "initiator_ip": "10.18.20.97", "responder_ip": "3.220.227.225", "initiator_port": 49242, "responder_port": 443, "initiator_bytes": 1637, "last_seen_epoch": "1575413265.779907", "responder_bytes": 4738, "first_seen_epoch": "1575413166.687838" }, { "bytes": 4926, "stream": 63, "flow_id": "flow-eda3c64e52680bbc5b91b653", "packets": 20, "transport": "tcp", "last_frame": 10381, "first_frame": 2568, "initiator_ip": "10.18.20.97", "responder_ip": "3.220.227.225", "initiator_port": 49243, "responder_port": 443, "initiator_bytes": 894, "last_seen_epoch": "1575413265.780201", "responder_bytes": 4032, "first_seen_epoch": "1575413166.691338" }, { "bytes": 244, "stream": 30, "flow_id": "flow-518fb5f09827a8b1ace0257c", "packets": 2, "transport": "udp", "last_frame": 2668, "first_frame": 2643, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 50143, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1575413167.222296", "responder_bytes": 168, "first_seen_epoch": "1575413167.102944" }, { "bytes": 174, "stream": 31, "flow_id": "flow-1214d041b9a9a55849164565", "packets": 2, "transport": "udp", "last_frame": 2659, "first_frame": 2655, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 53487, "responder_port": 53, "initiator_bytes": 71, "last_seen_epoch": "1575413167.210776", "responder_bytes": 103, "first_seen_epoch": "1575413167.132764" }, { "bytes": 267, "stream": 32, "flow_id": "flow-6c961200c4570d439e3a64b9", "packets": 2, "transport": "udp", "last_frame": 2663, "first_frame": 2658, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 58876, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1575413167.216789", "responder_bytes": 187, "first_seen_epoch": "1575413167.147746" }, { "bytes": 6703, "stream": 64, "flow_id": "flow-0857aa7bf9b52c31c90709fb", "packets": 21, "transport": "tcp", "last_frame": 2786, "first_frame": 2660, "initiator_ip": "10.18.20.97", "responder_ip": "156.154.202.36", "initiator_port": 49244, "responder_port": 443, "initiator_bytes": 1244, "last_seen_epoch": "1575413167.523426", "responder_bytes": 5459, "first_seen_epoch": "1575413167.212049" }, { "bytes": 5717, "stream": 65, "flow_id": "flow-c05cc322930ffda3b6fc054c", "packets": 21, "transport": "tcp", "last_frame": 10456, "first_frame": 2661, "initiator_ip": "10.18.20.97", "responder_ip": "156.154.202.36", "initiator_port": 49245, "responder_port": 443, "initiator_bytes": 909, "last_seen_epoch": "1575413265.93123", "responder_bytes": 4808, "first_seen_epoch": "1575413167.212156" }, { "bytes": 4814, "stream": 66, "flow_id": "flow-1bd65191925496dedb8f9806", "packets": 20, "transport": "tcp", "last_frame": 10368, "first_frame": 2669, "initiator_ip": "10.18.20.97", "responder_ip": "99.86.77.108", "initiator_port": 49246, "responder_port": 443, "initiator_bytes": 880, "last_seen_epoch": "1575413265.778898", "responder_bytes": 3934, "first_seen_epoch": "1575413167.222802" }, { "bytes": 6352, "stream": 67, "flow_id": "flow-0e9e1cefa3d49f11405993bd", "packets": 24, "transport": "tcp", "last_frame": 10447, "first_frame": 2670, "initiator_ip": "10.18.20.97", "responder_ip": "99.86.77.108", "initiator_port": 49247, "responder_port": 443, "initiator_bytes": 1377, "last_seen_epoch": "1575413265.928002", "responder_bytes": 4975, "first_seen_epoch": "1575413167.223241" }, { "bytes": 4209, "stream": 68, "flow_id": "flow-8c666183a492579b94c233a4", "packets": 20, "transport": "tcp", "last_frame": 10375, "first_frame": 2672, "initiator_ip": "10.18.20.97", "responder_ip": "96.6.83.178", "initiator_port": 49248, "responder_port": 443, "initiator_bytes": 890, "last_seen_epoch": "1575413265.77955", "responder_bytes": 3319, "first_seen_epoch": "1575413167.223809" }, { "bytes": 5414, "stream": 69, "flow_id": "flow-250c5291455bd8911c405e0a", "packets": 21, "transport": "tcp", "last_frame": 10455, "first_frame": 2673, "initiator_ip": "10.18.20.97", "responder_ip": "96.6.83.178", "initiator_port": 49249, "responder_port": 443, "initiator_bytes": 1237, "last_seen_epoch": "1575413265.931141", "responder_bytes": 4177, "first_seen_epoch": "1575413167.223862" }, { "bytes": 386, "stream": 33, "flow_id": "flow-6172054b4381443987a5687a", "packets": 2, "transport": "udp", "last_frame": 2703, "first_frame": 2677, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 57021, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1575413167.3112", "responder_bytes": 312, "first_seen_epoch": "1575413167.22745" }, { "bytes": 7833, "stream": 70, "flow_id": "flow-f53ae0ffb4538ae335f996f5", "packets": 30, "transport": "tcp", "last_frame": 10360, "first_frame": 2704, "initiator_ip": "10.18.20.97", "responder_ip": "54.186.165.46", "initiator_port": 49250, "responder_port": 443, "initiator_bytes": 2152, "last_seen_epoch": "1575413265.777692", "responder_bytes": 5681, "first_seen_epoch": "1575413167.311943" }, { "bytes": 4757, "stream": 71, "flow_id": "flow-f0e42f3c9850b4691a2b71a5", "packets": 22, "transport": "tcp", "last_frame": 10363, "first_frame": 2705, "initiator_ip": "10.18.20.97", "responder_ip": "54.186.165.46", "initiator_port": 49251, "responder_port": 443, "initiator_bytes": 982, "last_seen_epoch": "1575413265.778344", "responder_bytes": 3775, "first_seen_epoch": "1575413167.312182" }, { "bytes": 39287, "stream": 72, "flow_id": "flow-ad55274d023612e560b92b94", "packets": 83, "transport": "tcp", "last_frame": 3738, "first_frame": 2888, "initiator_ip": "10.18.20.97", "responder_ip": "98.137.156.137", "initiator_port": 49252, "responder_port": 443, "initiator_bytes": 22027, "last_seen_epoch": "1575413237.329471", "responder_bytes": 17260, "first_seen_epoch": "1575413185.080341" }, { "bytes": 6739, "stream": 73, "flow_id": "flow-03976ff7ac58bde9e1ab3d89", "packets": 22, "transport": "tcp", "last_frame": 3138, "first_frame": 2889, "initiator_ip": "10.18.20.97", "responder_ip": "98.137.156.137", "initiator_port": 49253, "responder_port": 443, "initiator_bytes": 1013, "last_seen_epoch": "1575413197.49182", "responder_bytes": 5726, "first_seen_epoch": "1575413185.080392" }, { "bytes": 246, "stream": 34, "flow_id": "flow-cb839486e9830d9ef93009b1", "packets": 2, "transport": "udp", "last_frame": 2902, "first_frame": 2890, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 52911, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1575413185.249277", "responder_bytes": 164, "first_seen_epoch": "1575413185.149414" }, { "bytes": 250, "stream": 35, "flow_id": "flow-69115789ee5f4de3a5bd5353", "packets": 2, "transport": "udp", "last_frame": 2904, "first_frame": 2891, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 49314, "responder_port": 53, "initiator_bytes": 84, "last_seen_epoch": "1575413185.267497", "responder_bytes": 166, "first_seen_epoch": "1575413185.149481" }, { "bytes": 27935, "stream": 74, "flow_id": "flow-b91ebc6541004363023296b9", "packets": 50, "transport": "tcp", "last_frame": 11716, "first_frame": 2903, "initiator_ip": "10.18.20.97", "responder_ip": "72.21.81.200", "initiator_port": 49254, "responder_port": 443, "initiator_bytes": 2426, "last_seen_epoch": "1575413275.199721", "responder_bytes": 25509, "first_seen_epoch": "1575413185.254028" }, { "bytes": 10153, "stream": 75, "flow_id": "flow-e0854df5bf820051d36594b9", "packets": 29, "transport": "tcp", "last_frame": 11715, "first_frame": 2905, "initiator_ip": "10.18.20.97", "responder_ip": "72.21.81.200", "initiator_port": 49255, "responder_port": 443, "initiator_bytes": 1553, "last_seen_epoch": "1575413275.199534", "responder_bytes": 8600, "first_seen_epoch": "1575413185.268528" }, { "bytes": 8968, "stream": 76, "flow_id": "flow-51f0972e39ad057208cb18f8", "packets": 26, "transport": "tcp", "last_frame": 11711, "first_frame": 2906, "initiator_ip": "10.18.20.97", "responder_ip": "72.21.81.200", "initiator_port": 49256, "responder_port": 443, "initiator_bytes": 1100, "last_seen_epoch": "1575413275.137568", "responder_bytes": 7868, "first_seen_epoch": "1575413185.268734" }, { "bytes": 8944, "stream": 77, "flow_id": "flow-905d8c4e3898c86e7e8bcba5", "packets": 25, "transport": "tcp", "last_frame": 11706, "first_frame": 2997, "initiator_ip": "10.18.20.97", "responder_ip": "72.21.81.200", "initiator_port": 49257, "responder_port": 443, "initiator_bytes": 1022, "last_seen_epoch": "1575413275.137075", "responder_bytes": 7922, "first_seen_epoch": "1575413185.551261" }, { "bytes": 27051, "stream": 78, "flow_id": "flow-e6fee56323958bd5fb7df3f9", "packets": 51, "transport": "tcp", "last_frame": 10446, "first_frame": 3004, "initiator_ip": "10.18.20.97", "responder_ip": "72.21.81.200", "initiator_port": 49258, "responder_port": 443, "initiator_bytes": 2071, "last_seen_epoch": "1575413265.927958", "responder_bytes": 24980, "first_seen_epoch": "1575413185.660695" }, { "bytes": 1280, "stream": 79, "flow_id": "flow-c612c24f3f5cb520d0fd1357", "packets": 12, "transport": "tcp", "last_frame": 3180, "first_frame": 3095, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 49259, "responder_port": 135, "initiator_bytes": 718, "last_seen_epoch": "1575413203.696348", "responder_bytes": 562, "first_seen_epoch": "1575413186.256906" }, { "bytes": 1466, "stream": 80, "flow_id": "flow-ee269667d72ef96553cd8e55", "packets": 12, "transport": "tcp", "last_frame": 3179, "first_frame": 3102, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 49260, "responder_port": 49155, "initiator_bytes": 872, "last_seen_epoch": "1575413203.696262", "responder_bytes": 594, "first_seen_epoch": "1575413186.258508" }, { "bytes": 1050, "stream": 36, "flow_id": "flow-76be9171bf2fb14c1ed9607c", "packets": 6, "transport": "udp", "last_frame": 3534, "first_frame": 3182, "initiator_ip": "10.18.20.97", "responder_ip": "239.255.255.250", "initiator_port": 49316, "responder_port": 1900, "initiator_bytes": 1050, "last_seen_epoch": "1575413212.187013", "responder_bytes": 0, "first_seen_epoch": "1575413205.860754" }, { "bytes": 19226, "stream": 81, "flow_id": "flow-dff6aa2c771bc88ef8249c6f", "packets": 38, "transport": "tcp", "last_frame": 3793, "first_frame": 3208, "initiator_ip": "10.18.20.97", "responder_ip": "67.195.204.151", "initiator_port": 49261, "responder_port": 443, "initiator_bytes": 6585, "last_seen_epoch": "1575413237.814461", "responder_bytes": 12641, "first_seen_epoch": "1575413209.02232" }, { "bytes": 18955, "stream": 82, "flow_id": "flow-b9dd6d4e0ffb4e672fc782d2", "packets": 39, "transport": "tcp", "last_frame": 3263, "first_frame": 3209, "initiator_ip": "10.18.20.97", "responder_ip": "67.195.204.151", "initiator_port": 49262, "responder_port": 443, "initiator_bytes": 5114, "last_seen_epoch": "1575413209.727653", "responder_bytes": 13841, "first_seen_epoch": "1575413209.022522" }, { "bytes": 6162, "stream": 83, "flow_id": "flow-3f0a91a27fd327f671d88dae", "packets": 23, "transport": "tcp", "last_frame": 10384, "first_frame": 3530, "initiator_ip": "10.18.20.97", "responder_ip": "98.137.155.9", "initiator_port": 49263, "responder_port": 443, "initiator_bytes": 1412, "last_seen_epoch": "1575413265.780456", "responder_bytes": 4750, "first_seen_epoch": "1575413212.138829" }, { "bytes": 4843, "stream": 84, "flow_id": "flow-b92aaa9541712a4c1a17ddc7", "packets": 19, "transport": "tcp", "last_frame": 12475, "first_frame": 3533, "initiator_ip": "10.18.20.97", "responder_ip": "98.137.155.9", "initiator_port": 49264, "responder_port": 443, "initiator_bytes": 915, "last_seen_epoch": "1575413302.749127", "responder_bytes": 3928, "first_seen_epoch": "1575413212.138971" }, { "bytes": 170, "stream": 37, "flow_id": "flow-0733b3830f5f96a067f7419c", "packets": 2, "transport": "udp", "last_frame": 3573, "first_frame": 3572, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 63591, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1575413212.855201", "responder_bytes": 93, "first_seen_epoch": "1575413212.793168" }, { "bytes": 4530, "stream": 85, "flow_id": "flow-e3f462304dd81806c3bcf2ce", "packets": 18, "transport": "tcp", "last_frame": 12467, "first_frame": 3574, "initiator_ip": "10.18.20.97", "responder_ip": "50.57.31.206", "initiator_port": 49265, "responder_port": 443, "initiator_bytes": 823, "last_seen_epoch": "1575413302.727669", "responder_bytes": 3707, "first_seen_epoch": "1575413212.855957" }, { "bytes": 7158, "stream": 86, "flow_id": "flow-6243d58c39595ee01e8dd58f", "packets": 26, "transport": "tcp", "last_frame": 12468, "first_frame": 3575, "initiator_ip": "10.18.20.97", "responder_ip": "50.57.31.206", "initiator_port": 49266, "responder_port": 443, "initiator_bytes": 1881, "last_seen_epoch": "1575413302.727722", "responder_bytes": 5277, "first_seen_epoch": "1575413212.856061" }, { "bytes": 6685, "stream": 87, "flow_id": "flow-2d4f0a41e989c1b6724346c2", "packets": 21, "transport": "tcp", "last_frame": 3741, "first_frame": 3600, "initiator_ip": "10.18.20.97", "responder_ip": "98.137.156.137", "initiator_port": 49267, "responder_port": 443, "initiator_bytes": 959, "last_seen_epoch": "1575413237.329654", "responder_bytes": 5726, "first_seen_epoch": "1575413213.109347" }, { "bytes": 288, "stream": 38, "flow_id": "flow-42171a7b174b8f437426040f", "packets": 2, "transport": "udp", "last_frame": 3635, "first_frame": 3632, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 59064, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1575413213.479991", "responder_bytes": 212, "first_seen_epoch": "1575413213.379305" }, { "bytes": 6120, "stream": 88, "flow_id": "flow-9a89d19fae64feb71c768fe3", "packets": 21, "transport": "tcp", "last_frame": 10355, "first_frame": 3636, "initiator_ip": "10.18.20.97", "responder_ip": "37.157.6.246", "initiator_port": 49268, "responder_port": 443, "initiator_bytes": 914, "last_seen_epoch": "1575413265.77724", "responder_bytes": 5206, "first_seen_epoch": "1575413213.480826" }, { "bytes": 8033, "stream": 89, "flow_id": "flow-09e0593f6ea73a5da532ff01", "packets": 28, "transport": "tcp", "last_frame": 12487, "first_frame": 3637, "initiator_ip": "10.18.20.97", "responder_ip": "37.157.6.246", "initiator_port": 49269, "responder_port": 443, "initiator_bytes": 1774, "last_seen_epoch": "1575413302.850872", "responder_bytes": 6259, "first_seen_epoch": "1575413213.481068" }, { "bytes": 6847, "stream": 90, "flow_id": "flow-70980a472ff0bf94fe6704e0", "packets": 24, "transport": "tcp", "last_frame": 6159, "first_frame": 3742, "initiator_ip": "10.18.20.97", "responder_ip": "98.137.156.137", "initiator_port": 49271, "responder_port": 443, "initiator_bytes": 1067, "last_seen_epoch": "1575413249.431143", "responder_bytes": 5780, "first_seen_epoch": "1575413237.329896" }, { "bytes": 16370, "stream": 91, "flow_id": "flow-3bf0a20200e4200751877404", "packets": 46, "transport": "tcp", "last_frame": 10409, "first_frame": 3743, "initiator_ip": "10.18.20.97", "responder_ip": "98.137.156.137", "initiator_port": 49270, "responder_port": 443, "initiator_bytes": 9008, "last_seen_epoch": "1575413265.782418", "responder_bytes": 7362, "first_seen_epoch": "1575413237.329946" }, { "bytes": 318, "stream": 39, "flow_id": "flow-9e244ee004403027d26a3503", "packets": 2, "transport": "udp", "last_frame": 3795, "first_frame": 3794, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 51589, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1575413237.89796", "responder_bytes": 246, "first_seen_epoch": "1575413237.817285" }, { "bytes": 6593, "stream": 92, "flow_id": "flow-44b295152620f24cbc9e8f7c", "packets": 21, "transport": "tcp", "last_frame": 12119, "first_frame": 3796, "initiator_ip": "10.18.20.97", "responder_ip": "107.23.73.96", "initiator_port": 49272, "responder_port": 443, "initiator_bytes": 1118, "last_seen_epoch": "1575413302.521882", "responder_bytes": 5475, "first_seen_epoch": "1575413237.898751" }, { "bytes": 25167, "stream": 93, "flow_id": "flow-184da1c7e60a17d6cdd567f3", "packets": 55, "transport": "tcp", "last_frame": 12471, "first_frame": 3797, "initiator_ip": "10.18.20.97", "responder_ip": "107.23.73.96", "initiator_port": 49273, "responder_port": 443, "initiator_bytes": 12285, "last_seen_epoch": "1575413302.734641", "responder_bytes": 12882, "first_seen_epoch": "1575413237.898838" }, { "bytes": 334, "stream": 40, "flow_id": "flow-19b28cc6f9e703593535ffc6", "packets": 2, "transport": "udp", "last_frame": 3837, "first_frame": 3836, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 61245, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1575413238.558263", "responder_bytes": 254, "first_seen_epoch": "1575413238.467239" }, { "bytes": 6601, "stream": 94, "flow_id": "flow-2e0b271a05899b2ca98d1165", "packets": 21, "transport": "tcp", "last_frame": 12115, "first_frame": 3838, "initiator_ip": "10.18.20.97", "responder_ip": "54.236.178.170", "initiator_port": 49274, "responder_port": 443, "initiator_bytes": 1126, "last_seen_epoch": "1575413302.521547", "responder_bytes": 5475, "first_seen_epoch": "1575413238.559304" }, { "bytes": 9063, "stream": 95, "flow_id": "flow-90a652078d190d798988edef", "packets": 27, "transport": "tcp", "last_frame": 12112, "first_frame": 3839, "initiator_ip": "10.18.20.97", "responder_ip": "54.236.178.170", "initiator_port": 49275, "responder_port": 443, "initiator_bytes": 1741, "last_seen_epoch": "1575413302.521348", "responder_bytes": 7322, "first_seen_epoch": "1575413238.55939" }, { "bytes": 14193, "stream": 96, "flow_id": "flow-c373ff943f99b17550f40bd8", "packets": 34, "transport": "tcp", "last_frame": 3973, "first_frame": 3888, "initiator_ip": "10.18.20.97", "responder_ip": "98.137.156.136", "initiator_port": 49277, "responder_port": 443, "initiator_bytes": 4764, "last_seen_epoch": "1575413241.48707", "responder_bytes": 9429, "first_seen_epoch": "1575413239.495348" }, { "bytes": 18121, "stream": 97, "flow_id": "flow-a879c9229b3f3d74ec46e2ff", "packets": 38, "transport": "tcp", "last_frame": 3947, "first_frame": 3889, "initiator_ip": "10.18.20.97", "responder_ip": "98.137.156.136", "initiator_port": 49276, "responder_port": 443, "initiator_bytes": 5070, "last_seen_epoch": "1575413240.157859", "responder_bytes": 13051, "first_seen_epoch": "1575413239.49541" }, { "bytes": 10859, "stream": 98, "flow_id": "flow-9a516d17930584494b7e50e7", "packets": 29, "transport": "tcp", "last_frame": 4023, "first_frame": 3976, "initiator_ip": "10.18.20.97", "responder_ip": "67.195.204.151", "initiator_port": 49278, "responder_port": 443, "initiator_bytes": 3392, "last_seen_epoch": "1575413242.723738", "responder_bytes": 7467, "first_seen_epoch": "1575413241.49012" }, { "bytes": 6156, "stream": 99, "flow_id": "flow-749e4db4d6b1729a826936ba", "packets": 21, "transport": "tcp", "last_frame": 12485, "first_frame": 3977, "initiator_ip": "10.18.20.97", "responder_ip": "67.195.204.151", "initiator_port": 49279, "responder_port": 443, "initiator_bytes": 963, "last_seen_epoch": "1575413302.776514", "responder_bytes": 5193, "first_seen_epoch": "1575413241.490177" }, { "bytes": 93000, "stream": 100, "flow_id": "flow-b2893c2b6e9281bb08389bef", "packets": 148, "transport": "tcp", "last_frame": 12478, "first_frame": 4030, "initiator_ip": "10.18.20.97", "responder_ip": "69.147.64.34", "initiator_port": 49280, "responder_port": 443, "initiator_bytes": 18049, "last_seen_epoch": "1575413302.754448", "responder_bytes": 74951, "first_seen_epoch": "1575413242.726191" }, { "bytes": 31121, "stream": 101, "flow_id": "flow-6f03dc789a2bd4186ccb0f4d", "packets": 70, "transport": "tcp", "last_frame": 12481, "first_frame": 4031, "initiator_ip": "10.18.20.97", "responder_ip": "69.147.64.34", "initiator_port": 49281, "responder_port": 443, "initiator_bytes": 19957, "last_seen_epoch": "1575413302.758781", "responder_bytes": 11164, "first_seen_epoch": "1575413242.726254" }, { "bytes": 197, "stream": 41, "flow_id": "flow-ae8d88fcc0a1435ae503ad6c", "packets": 2, "transport": "udp", "last_frame": 4184, "first_frame": 4182, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 50768, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1575413244.602338", "responder_bytes": 125, "first_seen_epoch": "1575413244.526729" }, { "bytes": 216, "stream": 42, "flow_id": "flow-7e0ebd094209a8f73fc0eef0", "packets": 2, "transport": "udp", "last_frame": 4187, "first_frame": 4183, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 60425, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1575413244.607312", "responder_bytes": 136, "first_seen_epoch": "1575413244.536843" }, { "bytes": 247915, "stream": 102, "flow_id": "flow-5c2d1a527155d8c3dad6e07d", "packets": 363, "transport": "tcp", "last_frame": 12425, "first_frame": 4185, "initiator_ip": "10.18.20.97", "responder_ip": "192.229.211.36", "initiator_port": 49282, "responder_port": 443, "initiator_bytes": 14665, "last_seen_epoch": "1575413302.700184", "responder_bytes": 233250, "first_seen_epoch": "1575413244.60309" }, { "bytes": 425664, "stream": 103, "flow_id": "flow-9a5b7931223f68d52222935f", "packets": 591, "transport": "tcp", "last_frame": 12423, "first_frame": 4186, "initiator_ip": "10.18.20.97", "responder_ip": "192.229.211.36", "initiator_port": 49283, "responder_port": 443, "initiator_bytes": 19849, "last_seen_epoch": "1575413302.700059", "responder_bytes": 405815, "first_seen_epoch": "1575413244.60325" }, { "bytes": 4948, "stream": 104, "flow_id": "flow-1d32cee5e716b7fc1f917dd8", "packets": 19, "transport": "tcp", "last_frame": 12409, "first_frame": 4188, "initiator_ip": "10.18.20.97", "responder_ip": "152.195.55.192", "initiator_port": 49284, "responder_port": 443, "initiator_bytes": 880, "last_seen_epoch": "1575413302.696303", "responder_bytes": 4068, "first_seen_epoch": "1575413244.608212" }, { "bytes": 15315, "stream": 105, "flow_id": "flow-edd7b6ca16b31b4e3137b947", "packets": 35, "transport": "tcp", "last_frame": 12393, "first_frame": 4189, "initiator_ip": "10.18.20.97", "responder_ip": "152.195.55.192", "initiator_port": 49285, "responder_port": 443, "initiator_bytes": 1685, "last_seen_epoch": "1575413302.693623", "responder_bytes": 13630, "first_seen_epoch": "1575413244.60828" }, { "bytes": 236, "stream": 43, "flow_id": "flow-fa843c79d7d90e0e10ea3803", "packets": 2, "transport": "udp", "last_frame": 4892, "first_frame": 4873, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 55293, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1575413246.304051", "responder_bytes": 159, "first_seen_epoch": "1575413246.231562" }, { "bytes": 112469, "stream": 106, "flow_id": "flow-e8ae22cc99f1bd840338ec55", "packets": 165, "transport": "tcp", "last_frame": 12398, "first_frame": 4878, "initiator_ip": "10.18.20.97", "responder_ip": "192.229.211.36", "initiator_port": 49286, "responder_port": 443, "initiator_bytes": 6382, "last_seen_epoch": "1575413302.693936", "responder_bytes": 106087, "first_seen_epoch": "1575413246.233083" }, { "bytes": 130311, "stream": 107, "flow_id": "flow-e836dc813d754dad02437841", "packets": 182, "transport": "tcp", "last_frame": 12428, "first_frame": 4879, "initiator_ip": "10.18.20.97", "responder_ip": "192.229.211.36", "initiator_port": 49287, "responder_port": 443, "initiator_bytes": 6399, "last_seen_epoch": "1575413302.703539", "responder_bytes": 123912, "first_seen_epoch": "1575413246.233243" }, { "bytes": 111553, "stream": 108, "flow_id": "flow-ea8ec5f5ec382a3262b96a09", "packets": 158, "transport": "tcp", "last_frame": 12416, "first_frame": 4882, "initiator_ip": "10.18.20.97", "responder_ip": "192.229.211.36", "initiator_port": 49288, "responder_port": 443, "initiator_bytes": 6134, "last_seen_epoch": "1575413302.69812", "responder_bytes": 105419, "first_seen_epoch": "1575413246.258124" }, { "bytes": 260, "stream": 44, "flow_id": "flow-563a1bffa99cccdbd776fb9b", "packets": 2, "transport": "udp", "last_frame": 4922, "first_frame": 4889, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 61554, "responder_port": 53, "initiator_bytes": 71, "last_seen_epoch": "1575413246.488601", "responder_bytes": 189, "first_seen_epoch": "1575413246.290389" }, { "bytes": 12724, "stream": 109, "flow_id": "flow-422210d9bdf031b99aa5d1a8", "packets": 34, "transport": "tcp", "last_frame": 12459, "first_frame": 4893, "initiator_ip": "10.18.20.97", "responder_ip": "3.218.16.73", "initiator_port": 49289, "responder_port": 443, "initiator_bytes": 5366, "last_seen_epoch": "1575413302.725172", "responder_bytes": 7358, "first_seen_epoch": "1575413246.305261" }, { "bytes": 5137, "stream": 110, "flow_id": "flow-0353aba8cef289bcb3c6130b", "packets": 19, "transport": "tcp", "last_frame": 12454, "first_frame": 4894, "initiator_ip": "10.18.20.97", "responder_ip": "3.218.16.73", "initiator_port": 49290, "responder_port": 443, "initiator_bytes": 877, "last_seen_epoch": "1575413302.724771", "responder_bytes": 4260, "first_seen_epoch": "1575413246.305868" }, { "bytes": 6279, "stream": 111, "flow_id": "flow-ea14bcfdaaf04b8f8a03ad45", "packets": 23, "transport": "tcp", "last_frame": 10352, "first_frame": 4923, "initiator_ip": "10.18.20.97", "responder_ip": "66.218.87.13", "initiator_port": 49291, "responder_port": 443, "initiator_bytes": 979, "last_seen_epoch": "1575413265.776835", "responder_bytes": 5300, "first_seen_epoch": "1575413246.489429" }, { "bytes": 51434, "stream": 112, "flow_id": "flow-dbb065228e1ce9c77929b7db", "packets": 91, "transport": "tcp", "last_frame": 7988, "first_frame": 4924, "initiator_ip": "10.18.20.97", "responder_ip": "66.218.87.13", "initiator_port": 49292, "responder_port": 443, "initiator_bytes": 9603, "last_seen_epoch": "1575413257.175477", "responder_bytes": 41831, "first_seen_epoch": "1575413246.489516" }, { "bytes": 268, "stream": 45, "flow_id": "flow-2e1114b7e17e6ced55493055", "packets": 2, "transport": "udp", "last_frame": 5073, "first_frame": 5058, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 63710, "responder_port": 53, "initiator_bytes": 84, "last_seen_epoch": "1575413247.091636", "responder_bytes": 184, "first_seen_epoch": "1575413247.024624" }, { "bytes": 12155, "stream": 113, "flow_id": "flow-4ad895a3794a48507a8cdce2", "packets": 37, "transport": "tcp", "last_frame": 12387, "first_frame": 5074, "initiator_ip": "10.18.20.97", "responder_ip": "184.86.155.127", "initiator_port": 49293, "responder_port": 443, "initiator_bytes": 4046, "last_seen_epoch": "1575413302.691347", "responder_bytes": 8109, "first_seen_epoch": "1575413247.092475" }, { "bytes": 6749, "stream": 114, "flow_id": "flow-29d0c55efb7ee025b2ce8f94", "packets": 20, "transport": "tcp", "last_frame": 12091, "first_frame": 5075, "initiator_ip": "10.18.20.97", "responder_ip": "184.86.155.127", "initiator_port": 49294, "responder_port": 443, "initiator_bytes": 868, "last_seen_epoch": "1575413302.518907", "responder_bytes": 5881, "first_seen_epoch": "1575413247.092567" }, { "bytes": 220, "stream": 46, "flow_id": "flow-dfc8f384e2e6a4aa760f197b", "packets": 2, "transport": "udp", "last_frame": 5225, "first_frame": 5160, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 52026, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1575413248.059796", "responder_bytes": 140, "first_seen_epoch": "1575413247.781242" }, { "bytes": 179338, "stream": 115, "flow_id": "flow-c92c7365541632584bc02bce", "packets": 245, "transport": "tcp", "last_frame": 12413, "first_frame": 5176, "initiator_ip": "10.18.20.97", "responder_ip": "192.229.211.36", "initiator_port": 49295, "responder_port": 443, "initiator_bytes": 7863, "last_seen_epoch": "1575413302.696667", "responder_bytes": 171475, "first_seen_epoch": "1575413247.784633" }, { "bytes": 39409, "stream": 116, "flow_id": "flow-c632aea9c89305ade133b420", "packets": 57, "transport": "tcp", "last_frame": 12386, "first_frame": 5227, "initiator_ip": "10.18.20.97", "responder_ip": "192.229.210.141", "initiator_port": 49296, "responder_port": 443, "initiator_bytes": 2552, "last_seen_epoch": "1575413302.691302", "responder_bytes": 36857, "first_seen_epoch": "1575413248.060648" }, { "bytes": 5018, "stream": 117, "flow_id": "flow-2dc7737ad7932929d163084d", "packets": 19, "transport": "tcp", "last_frame": 12383, "first_frame": 5229, "initiator_ip": "10.18.20.97", "responder_ip": "192.229.210.141", "initiator_port": 49297, "responder_port": 443, "initiator_bytes": 880, "last_seen_epoch": "1575413302.690495", "responder_bytes": 4138, "first_seen_epoch": "1575413248.060854" }, { "bytes": 197, "stream": 47, "flow_id": "flow-98d915b5c7ba9c5ba21f5c1d", "packets": 2, "transport": "udp", "last_frame": 5418, "first_frame": 5344, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 58401, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1575413248.467142", "responder_bytes": 125, "first_seen_epoch": "1575413248.190906" }, { "bytes": 146536, "stream": 118, "flow_id": "flow-60bd0c8c713f3dd31c50dbac", "packets": 211, "transport": "tcp", "last_frame": 12381, "first_frame": 5420, "initiator_ip": "10.18.20.97", "responder_ip": "192.229.211.36", "initiator_port": 49299, "responder_port": 443, "initiator_bytes": 8915, "last_seen_epoch": "1575413302.688381", "responder_bytes": 137621, "first_seen_epoch": "1575413248.468179" }, { "bytes": 78357, "stream": 119, "flow_id": "flow-e50a631794ee5175deb97e83", "packets": 120, "transport": "tcp", "last_frame": 6703, "first_frame": 5421, "initiator_ip": "10.18.20.97", "responder_ip": "192.229.211.36", "initiator_port": 49298, "responder_port": 443, "initiator_bytes": 5463, "last_seen_epoch": "1575413250.446633", "responder_bytes": 72894, "first_seen_epoch": "1575413248.468281" }, { "bytes": 267, "stream": 48, "flow_id": "flow-afeafd71bfabc6d73f1f97ef", "packets": 2, "transport": "udp", "last_frame": 5656, "first_frame": 5605, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 50240, "responder_port": 53, "initiator_bytes": 73, "last_seen_epoch": "1575413248.90356", "responder_bytes": 194, "first_seen_epoch": "1575413248.806325" }, { "bytes": 22396, "stream": 120, "flow_id": "flow-a252bfa6f98ae20e523b3573", "packets": 49, "transport": "tcp", "last_frame": 12376, "first_frame": 5657, "initiator_ip": "10.18.20.97", "responder_ip": "152.199.6.14", "initiator_port": 49300, "responder_port": 443, "initiator_bytes": 7371, "last_seen_epoch": "1575413302.687155", "responder_bytes": 15025, "first_seen_epoch": "1575413248.904238" }, { "bytes": 25104, "stream": 121, "flow_id": "flow-abb823c1b68f5313e7957ad7", "packets": 58, "transport": "tcp", "last_frame": 12375, "first_frame": 5658, "initiator_ip": "10.18.20.97", "responder_ip": "152.199.6.14", "initiator_port": 49301, "responder_port": 443, "initiator_bytes": 9645, "last_seen_epoch": "1575413302.687028", "responder_bytes": 15459, "first_seen_epoch": "1575413248.904311" }, { "bytes": 5105, "stream": 122, "flow_id": "flow-1407aa97cf03c20b48b396cf", "packets": 20, "transport": "tcp", "last_frame": 6700, "first_frame": 5809, "initiator_ip": "10.18.20.97", "responder_ip": "192.229.211.36", "initiator_port": 49302, "responder_port": 443, "initiator_bytes": 904, "last_seen_epoch": "1575413250.439397", "responder_bytes": 4201, "first_seen_epoch": "1575413249.139695" }, { "bytes": 5051, "stream": 123, "flow_id": "flow-beedaa788d2e794202786a12", "packets": 19, "transport": "tcp", "last_frame": 6800, "first_frame": 5822, "initiator_ip": "10.18.20.97", "responder_ip": "192.229.211.36", "initiator_port": 49303, "responder_port": 443, "initiator_bytes": 904, "last_seen_epoch": "1575413250.689354", "responder_bytes": 4147, "first_seen_epoch": "1575413249.142042" }, { "bytes": 5051, "stream": 124, "flow_id": "flow-60310826ef4869c7517d83d6", "packets": 19, "transport": "tcp", "last_frame": 6701, "first_frame": 5825, "initiator_ip": "10.18.20.97", "responder_ip": "192.229.211.36", "initiator_port": 49304, "responder_port": 443, "initiator_bytes": 904, "last_seen_epoch": "1575413250.439477", "responder_bytes": 4147, "first_seen_epoch": "1575413249.142524" }, { "bytes": 43331, "stream": 125, "flow_id": "flow-7812b326c46f49751d1d2491", "packets": 74, "transport": "tcp", "last_frame": 12380, "first_frame": 5832, "initiator_ip": "10.18.20.97", "responder_ip": "192.229.211.36", "initiator_port": 49305, "responder_port": 443, "initiator_bytes": 3039, "last_seen_epoch": "1575413302.688306", "responder_bytes": 40292, "first_seen_epoch": "1575413249.144139" }, { "bytes": 27705, "stream": 126, "flow_id": "flow-33e3733c910073d66e3d51f8", "packets": 50, "transport": "tcp", "last_frame": 12406, "first_frame": 6345, "initiator_ip": "10.18.20.97", "responder_ip": "192.229.211.36", "initiator_port": 49306, "responder_port": 443, "initiator_bytes": 2391, "last_seen_epoch": "1575413302.695614", "responder_bytes": 25314, "first_seen_epoch": "1575413249.715" }, { "bytes": 29743, "stream": 127, "flow_id": "flow-2245e52029acf4a09c708d80", "packets": 51, "transport": "tcp", "last_frame": 12405, "first_frame": 6346, "initiator_ip": "10.18.20.97", "responder_ip": "192.229.211.36", "initiator_port": 49307, "responder_port": 443, "initiator_bytes": 2321, "last_seen_epoch": "1575413302.695559", "responder_bytes": 27422, "first_seen_epoch": "1575413249.715254" }, { "bytes": 6847, "stream": 128, "flow_id": "flow-1471e8a610a506c5025f3d3a", "packets": 24, "transport": "tcp", "last_frame": 10411, "first_frame": 6378, "initiator_ip": "10.18.20.97", "responder_ip": "98.137.156.137", "initiator_port": 49308, "responder_port": 443, "initiator_bytes": 1067, "last_seen_epoch": "1575413265.782666", "responder_bytes": 5780, "first_seen_epoch": "1575413249.758154" }, { "bytes": 238, "stream": 49, "flow_id": "flow-598bc095f3f9c93ba35ba95b", "packets": 2, "transport": "udp", "last_frame": 6460, "first_frame": 6379, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 58498, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1575413250.068987", "responder_bytes": 161, "first_seen_epoch": "1575413249.766503" }, { "bytes": 29268, "stream": 129, "flow_id": "flow-8f068a1ef6cbaeb2f216f382", "packets": 69, "transport": "tcp", "last_frame": 12061, "first_frame": 6464, "initiator_ip": "10.18.20.97", "responder_ip": "98.136.96.149", "initiator_port": 49309, "responder_port": 443, "initiator_bytes": 7258, "last_seen_epoch": "1575413302.515822", "responder_bytes": 22010, "first_seen_epoch": "1575413250.07013" }, { "bytes": 4852, "stream": 130, "flow_id": "flow-62103bc17917038a5e593e55", "packets": 19, "transport": "tcp", "last_frame": 12444, "first_frame": 6465, "initiator_ip": "10.18.20.97", "responder_ip": "98.136.96.149", "initiator_port": 49310, "responder_port": 443, "initiator_bytes": 877, "last_seen_epoch": "1575413302.720034", "responder_bytes": 3975, "first_seen_epoch": "1575413250.070269" }, { "bytes": 38756, "stream": 131, "flow_id": "flow-ef6a65b415026d8e3f8bdd19", "packets": 70, "transport": "tcp", "last_frame": 12370, "first_frame": 6574, "initiator_ip": "10.18.20.97", "responder_ip": "192.229.211.36", "initiator_port": 49311, "responder_port": 443, "initiator_bytes": 3687, "last_seen_epoch": "1575413302.684386", "responder_bytes": 35069, "first_seen_epoch": "1575413250.245179" }, { "bytes": 34788, "stream": 132, "flow_id": "flow-938910cff65779ff4cf3b1ed", "packets": 59, "transport": "tcp", "last_frame": 12371, "first_frame": 6575, "initiator_ip": "10.18.20.97", "responder_ip": "192.229.211.36", "initiator_port": 49312, "responder_port": 443, "initiator_bytes": 2537, "last_seen_epoch": "1575413302.684543", "responder_bytes": 32251, "first_seen_epoch": "1575413250.245315" }, { "bytes": 307, "stream": 50, "flow_id": "flow-7cbb5bdc34ab2cc6db98452b", "packets": 2, "transport": "udp", "last_frame": 6899, "first_frame": 6833, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 64025, "responder_port": 53, "initiator_bytes": 91, "last_seen_epoch": "1575413251.062084", "responder_bytes": 216, "first_seen_epoch": "1575413250.760262" }, { "bytes": 9176, "stream": 133, "flow_id": "flow-26ad0ac11847a8d4a6d810d3", "packets": 28, "transport": "tcp", "last_frame": 12361, "first_frame": 6900, "initiator_ip": "10.18.20.97", "responder_ip": "152.199.6.24", "initiator_port": 49314, "responder_port": 443, "initiator_bytes": 2957, "last_seen_epoch": "1575413302.677843", "responder_bytes": 6219, "first_seen_epoch": "1575413251.062513" }, { "bytes": 9122, "stream": 134, "flow_id": "flow-96c9a30a99e068b21294435b", "packets": 27, "transport": "tcp", "last_frame": 12363, "first_frame": 6901, "initiator_ip": "10.18.20.97", "responder_ip": "152.199.6.24", "initiator_port": 49313, "responder_port": 443, "initiator_bytes": 2957, "last_seen_epoch": "1575413302.6807", "responder_bytes": 6165, "first_seen_epoch": "1575413251.062567" }, { "bytes": 5144, "stream": 135, "flow_id": "flow-bde265dd948406f8fec39287", "packets": 19, "transport": "tcp", "last_frame": 12367, "first_frame": 7063, "initiator_ip": "10.18.20.97", "responder_ip": "152.199.6.14", "initiator_port": 49315, "responder_port": 443, "initiator_bytes": 851, "last_seen_epoch": "1575413302.68419", "responder_bytes": 4293, "first_seen_epoch": "1575413252.168556" }, { "bytes": 233, "stream": 51, "flow_id": "flow-80001ef702a678cb973d0dbf", "packets": 2, "transport": "udp", "last_frame": 7139, "first_frame": 7120, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 65420, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1575413252.92667", "responder_bytes": 152, "first_seen_epoch": "1575413252.786071" }, { "bytes": 7215, "stream": 136, "flow_id": "flow-2e68d844c95c75c736b993b8", "packets": 22, "transport": "tcp", "last_frame": 9133, "first_frame": 7142, "initiator_ip": "10.18.20.97", "responder_ip": "74.6.138.72", "initiator_port": 49317, "responder_port": 443, "initiator_bytes": 1890, "last_seen_epoch": "1575413262.278006", "responder_bytes": 5325, "first_seen_epoch": "1575413252.927375" }, { "bytes": 7209, "stream": 137, "flow_id": "flow-b3e0a9ef916afd5839a9c17a", "packets": 21, "transport": "tcp", "last_frame": 7449, "first_frame": 7143, "initiator_ip": "10.18.20.97", "responder_ip": "74.6.138.72", "initiator_port": 49316, "responder_port": 443, "initiator_bytes": 1884, "last_seen_epoch": "1575413253.740463", "responder_bytes": 5325, "first_seen_epoch": "1575413252.927422" }, { "bytes": 461, "stream": 52, "flow_id": "flow-f1311def25e2cf40b011ead6", "packets": 2, "transport": "udp", "last_frame": 7233, "first_frame": 7180, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 55959, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1575413253.235151", "responder_bytes": 371, "first_seen_epoch": "1575413253.008581" }, { "bytes": 21247, "stream": 138, "flow_id": "flow-4b16d41c02c1774f6c7ebeb1", "packets": 41, "transport": "tcp", "last_frame": 12431, "first_frame": 7234, "initiator_ip": "10.18.20.97", "responder_ip": "34.231.235.125", "initiator_port": 49318, "responder_port": 443, "initiator_bytes": 3830, "last_seen_epoch": "1575413302.708183", "responder_bytes": 17417, "first_seen_epoch": "1575413253.235795" }, { "bytes": 6883, "stream": 139, "flow_id": "flow-eca4d9445fbb1d262952f4f2", "packets": 21, "transport": "tcp", "last_frame": 12434, "first_frame": 7235, "initiator_ip": "10.18.20.97", "responder_ip": "34.231.235.125", "initiator_port": 49319, "responder_port": 443, "initiator_bytes": 944, "last_seen_epoch": "1575413302.710687", "responder_bytes": 5939, "first_seen_epoch": "1575413253.235979" }, { "bytes": 215, "stream": 53, "flow_id": "flow-30c4e14dcdef72eac30347b5", "packets": 2, "transport": "udp", "last_frame": 7467, "first_frame": 7456, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 57045, "responder_port": 53, "initiator_bytes": 69, "last_seen_epoch": "1575413254.084287", "responder_bytes": 146, "first_seen_epoch": "1575413253.970345" }, { "bytes": 242, "stream": 54, "flow_id": "flow-77543bc2fab52b9083400f0a", "packets": 2, "transport": "udp", "last_frame": 7496, "first_frame": 7490, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 65041, "responder_port": 53, "initiator_bytes": 73, "last_seen_epoch": "1575413254.362555", "responder_bytes": 169, "first_seen_epoch": "1575413254.183995" }, { "bytes": 103897, "stream": 140, "flow_id": "flow-f94fff81ea1be6b6e0b7e2e4", "packets": 138, "transport": "tcp", "last_frame": 12356, "first_frame": 7497, "initiator_ip": "10.18.20.97", "responder_ip": "23.11.218.15", "initiator_port": 49320, "responder_port": 443, "initiator_bytes": 4008, "last_seen_epoch": "1575413302.674901", "responder_bytes": 99889, "first_seen_epoch": "1575413254.366478" }, { "bytes": 3840, "stream": 141, "flow_id": "flow-3542f6c6b41c6c727daee337", "packets": 18, "transport": "tcp", "last_frame": 12049, "first_frame": 7498, "initiator_ip": "10.18.20.97", "responder_ip": "23.11.218.15", "initiator_port": 49321, "responder_port": 443, "initiator_bytes": 833, "last_seen_epoch": "1575413302.514132", "responder_bytes": 3007, "first_seen_epoch": "1575413254.374179" }, { "bytes": 244, "stream": 55, "flow_id": "flow-187271eb00ae5827ab5c0814", "packets": 2, "transport": "udp", "last_frame": 7652, "first_frame": 7649, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 51376, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1575413255.067988", "responder_bytes": 170, "first_seen_epoch": "1575413255.007713" }, { "bytes": 394, "stream": 56, "flow_id": "flow-5a7b79177b3329f111284506", "packets": 2, "transport": "udp", "last_frame": 7655, "first_frame": 7650, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 62894, "responder_port": 53, "initiator_bytes": 96, "last_seen_epoch": "1575413255.099136", "responder_bytes": 298, "first_seen_epoch": "1575413255.026754" }, { "bytes": 226, "stream": 57, "flow_id": "flow-8f0f7df250f0a7c113f3d7de", "packets": 2, "transport": "udp", "last_frame": 7658, "first_frame": 7651, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 62267, "responder_port": 53, "initiator_bytes": 85, "last_seen_epoch": "1575413255.123657", "responder_bytes": 141, "first_seen_epoch": "1575413255.030588" }, { "bytes": 20042, "stream": 142, "flow_id": "flow-0e7ba1037e7d6a0f41471c7d", "packets": 50, "transport": "tcp", "last_frame": 12357, "first_frame": 7653, "initiator_ip": "10.18.20.97", "responder_ip": "23.11.218.15", "initiator_port": 49322, "responder_port": 443, "initiator_bytes": 13429, "last_seen_epoch": "1575413302.674945", "responder_bytes": 6613, "first_seen_epoch": "1575413255.070508" }, { "bytes": 3841, "stream": 143, "flow_id": "flow-992b9703bc1c80e081510295", "packets": 18, "transport": "tcp", "last_frame": 12043, "first_frame": 7654, "initiator_ip": "10.18.20.97", "responder_ip": "23.11.218.15", "initiator_port": 49323, "responder_port": 443, "initiator_bytes": 834, "last_seen_epoch": "1575413302.51345", "responder_bytes": 3007, "first_seen_epoch": "1575413255.070761" }, { "bytes": 6871, "stream": 144, "flow_id": "flow-05698e2b3cfac580a7c8ea3e", "packets": 21, "transport": "tcp", "last_frame": 12414, "first_frame": 7656, "initiator_ip": "10.18.20.97", "responder_ip": "35.171.168.180", "initiator_port": 49324, "responder_port": 443, "initiator_bytes": 950, "last_seen_epoch": "1575413302.696736", "responder_bytes": 5921, "first_seen_epoch": "1575413255.099769" }, { "bytes": 8425, "stream": 145, "flow_id": "flow-f316d9d630a9ecd7bee6f04d", "packets": 25, "transport": "tcp", "last_frame": 12426, "first_frame": 7657, "initiator_ip": "10.18.20.97", "responder_ip": "35.171.168.180", "initiator_port": 49325, "responder_port": 443, "initiator_bytes": 2071, "last_seen_epoch": "1575413302.700222", "responder_bytes": 6354, "first_seen_epoch": "1575413255.099942" }, { "bytes": 4027, "stream": 146, "flow_id": "flow-211b7b75966d2bb5043c0895", "packets": 16, "transport": "tcp", "last_frame": 12338, "first_frame": 7659, "initiator_ip": "10.18.20.97", "responder_ip": "172.217.1.130", "initiator_port": 49326, "responder_port": 443, "initiator_bytes": 737, "last_seen_epoch": "1575413302.671716", "responder_bytes": 3290, "first_seen_epoch": "1575413255.125628" }, { "bytes": 54029, "stream": 147, "flow_id": "flow-7a78f26b9cb7520b32c51e6a", "packets": 89, "transport": "tcp", "last_frame": 12337, "first_frame": 7660, "initiator_ip": "10.18.20.97", "responder_ip": "172.217.1.130", "initiator_port": 49327, "responder_port": 443, "initiator_bytes": 3925, "last_seen_epoch": "1575413302.671682", "responder_bytes": 50104, "first_seen_epoch": "1575413255.125793" }, { "bytes": 8353, "stream": 148, "flow_id": "flow-f712a327866c44f4fe9c938d", "packets": 29, "transport": "tcp", "last_frame": 8534, "first_frame": 7804, "initiator_ip": "10.18.20.97", "responder_ip": "172.217.12.38", "initiator_port": 49328, "responder_port": 443, "initiator_bytes": 2489, "last_seen_epoch": "1575413259.654568", "responder_bytes": 5864, "first_seen_epoch": "1575413255.811503" }, { "bytes": 61128, "stream": 149, "flow_id": "flow-7bb49022db75f942a92594fe", "packets": 99, "transport": "tcp", "last_frame": 8510, "first_frame": 7805, "initiator_ip": "10.18.20.97", "responder_ip": "172.217.12.38", "initiator_port": 49329, "responder_port": 443, "initiator_bytes": 5091, "last_seen_epoch": "1575413259.517946", "responder_bytes": 56037, "first_seen_epoch": "1575413255.811556" }, { "bytes": 229, "stream": 58, "flow_id": "flow-ed5f09ddc61923b9fa33e7ab", "packets": 2, "transport": "udp", "last_frame": 7823, "first_frame": 7806, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 65118, "responder_port": 53, "initiator_bytes": 85, "last_seen_epoch": "1575413255.913526", "responder_bytes": 144, "first_seen_epoch": "1575413255.813989" }, { "bytes": 33005, "stream": 150, "flow_id": "flow-53fe58b31005c1899605d35f", "packets": 55, "transport": "tcp", "last_frame": 12346, "first_frame": 7824, "initiator_ip": "10.18.20.97", "responder_ip": "172.217.12.65", "initiator_port": 49330, "responder_port": 443, "initiator_bytes": 2537, "last_seen_epoch": "1575413302.672996", "responder_bytes": 30468, "first_seen_epoch": "1575413255.916205" }, { "bytes": 4331, "stream": 151, "flow_id": "flow-be45d64ce8a2a218b001a6e4", "packets": 17, "transport": "tcp", "last_frame": 12347, "first_frame": 7825, "initiator_ip": "10.18.20.97", "responder_ip": "172.217.12.65", "initiator_port": 49331, "responder_port": 443, "initiator_bytes": 761, "last_seen_epoch": "1575413302.673038", "responder_bytes": 3570, "first_seen_epoch": "1575413255.916472" }, { "bytes": 234, "stream": 59, "flow_id": "flow-c6020981926bc3313e51ede4", "packets": 2, "transport": "udp", "last_frame": 7972, "first_frame": 7967, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 52531, "responder_port": 53, "initiator_bytes": 89, "last_seen_epoch": "1575413257.008584", "responder_bytes": 145, "first_seen_epoch": "1575413256.911444" }, { "bytes": 61112, "stream": 152, "flow_id": "flow-bba1c2719e57d6b3ef3d2add", "packets": 100, "transport": "tcp", "last_frame": 12351, "first_frame": 7973, "initiator_ip": "10.18.20.97", "responder_ip": "172.217.1.130", "initiator_port": 49332, "responder_port": 443, "initiator_bytes": 5091, "last_seen_epoch": "1575413302.67322", "responder_bytes": 56021, "first_seen_epoch": "1575413257.009246" }, { "bytes": 4140, "stream": 153, "flow_id": "flow-86de40a7d88aca9c96400088", "packets": 18, "transport": "tcp", "last_frame": 12341, "first_frame": 7974, "initiator_ip": "10.18.20.97", "responder_ip": "172.217.1.130", "initiator_port": 49333, "responder_port": 443, "initiator_bytes": 795, "last_seen_epoch": "1575413302.67279", "responder_bytes": 3345, "first_seen_epoch": "1575413257.009421" }, { "bytes": 278, "stream": 60, "flow_id": "flow-356fe2d3853c0f929d969d7d", "packets": 2, "transport": "udp", "last_frame": 8009, "first_frame": 8002, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 58202, "responder_port": 53, "initiator_bytes": 75, "last_seen_epoch": "1575413257.314055", "responder_bytes": 203, "first_seen_epoch": "1575413257.20692" }, { "bytes": 17141, "stream": 154, "flow_id": "flow-b4a48b4918cc42db96a3cc93", "packets": 37, "transport": "tcp", "last_frame": 12410, "first_frame": 8010, "initiator_ip": "10.18.20.97", "responder_ip": "34.204.232.247", "initiator_port": 49334, "responder_port": 443, "initiator_bytes": 3284, "last_seen_epoch": "1575413302.696359", "responder_bytes": 13857, "first_seen_epoch": "1575413257.316959" }, { "bytes": 9466, "stream": 155, "flow_id": "flow-b97f2ad5b1a621737807b644", "packets": 26, "transport": "tcp", "last_frame": 12400, "first_frame": 8011, "initiator_ip": "10.18.20.97", "responder_ip": "34.204.232.247", "initiator_port": 49335, "responder_port": 443, "initiator_bytes": 1666, "last_seen_epoch": "1575413302.694037", "responder_bytes": 7800, "first_seen_epoch": "1575413257.317236" }, { "bytes": 280, "stream": 61, "flow_id": "flow-0f43634f5f62a45cad842b63", "packets": 2, "transport": "udp", "last_frame": 8080, "first_frame": 8073, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 59814, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1575413257.956936", "responder_bytes": 204, "first_seen_epoch": "1575413257.790729" }, { "bytes": 241, "stream": 62, "flow_id": "flow-25363d25bb7d3798a280316f", "packets": 2, "transport": "udp", "last_frame": 8085, "first_frame": 8074, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 64590, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1575413257.988658", "responder_bytes": 167, "first_seen_epoch": "1575413257.791396" }, { "bytes": 11912, "stream": 156, "flow_id": "flow-2c647e138b9efab68a5919ab", "packets": 40, "transport": "tcp", "last_frame": 12401, "first_frame": 8081, "initiator_ip": "10.18.20.97", "responder_ip": "52.54.122.125", "initiator_port": 49336, "responder_port": 443, "initiator_bytes": 3627, "last_seen_epoch": "1575413302.694089", "responder_bytes": 8285, "first_seen_epoch": "1575413257.958736" }, { "bytes": 12254, "stream": 157, "flow_id": "flow-16de5af1be61aaae3e64d29f", "packets": 41, "transport": "tcp", "last_frame": 12391, "first_frame": 8082, "initiator_ip": "10.18.20.97", "responder_ip": "52.54.122.125", "initiator_port": 49337, "responder_port": 443, "initiator_bytes": 4039, "last_seen_epoch": "1575413302.692327", "responder_bytes": 8215, "first_seen_epoch": "1575413257.958946" }, { "bytes": 4947, "stream": 158, "flow_id": "flow-66cfb3384c20481726d19f9e", "packets": 21, "transport": "tcp", "last_frame": 12007, "first_frame": 8086, "initiator_ip": "10.18.20.97", "responder_ip": "23.67.118.68", "initiator_port": 49338, "responder_port": 443, "initiator_bytes": 912, "last_seen_epoch": "1575413302.507916", "responder_bytes": 4035, "first_seen_epoch": "1575413257.989125" }, { "bytes": 16145, "stream": 159, "flow_id": "flow-2486c55c345b992963b26ac0", "packets": 35, "transport": "tcp", "last_frame": 12349, "first_frame": 8087, "initiator_ip": "10.18.20.97", "responder_ip": "23.67.118.68", "initiator_port": 49339, "responder_port": 443, "initiator_bytes": 1657, "last_seen_epoch": "1575413302.673082", "responder_bytes": 14488, "first_seen_epoch": "1575413257.98929" }, { "bytes": 215, "stream": 63, "flow_id": "flow-baf74340f92f1fe65e2fb972", "packets": 2, "transport": "udp", "last_frame": 8199, "first_frame": 8116, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 57356, "responder_port": 53, "initiator_bytes": 88, "last_seen_epoch": "1575413258.370803", "responder_bytes": 127, "first_seen_epoch": "1575413258.171271" }, { "bytes": 266, "stream": 64, "flow_id": "flow-4d7f8bf22f5ad6cbf80ed478", "packets": 2, "transport": "udp", "last_frame": 8202, "first_frame": 8117, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 56755, "responder_port": 53, "initiator_bytes": 70, "last_seen_epoch": "1575413258.371041", "responder_bytes": 196, "first_seen_epoch": "1575413258.171519" }, { "bytes": 4086, "stream": 160, "flow_id": "flow-d2a97bea9c628b5da4961108", "packets": 17, "transport": "tcp", "last_frame": 12322, "first_frame": 8203, "initiator_ip": "10.18.20.97", "responder_ip": "216.58.193.130", "initiator_port": 49340, "responder_port": 443, "initiator_bytes": 794, "last_seen_epoch": "1575413302.651429", "responder_bytes": 3292, "first_seen_epoch": "1575413258.371356" }, { "bytes": 6052, "stream": 161, "flow_id": "flow-88492ced7fea27ab373e284c", "packets": 23, "transport": "tcp", "last_frame": 12304, "first_frame": 8204, "initiator_ip": "10.18.20.97", "responder_ip": "216.58.193.130", "initiator_port": 49341, "responder_port": 443, "initiator_bytes": 1644, "last_seen_epoch": "1575413302.644317", "responder_bytes": 4408, "first_seen_epoch": "1575413258.37159" }, { "bytes": 7420, "stream": 162, "flow_id": "flow-965d3ca61cbb556978b08b0a", "packets": 25, "transport": "tcp", "last_frame": 12320, "first_frame": 8205, "initiator_ip": "10.18.20.97", "responder_ip": "13.249.22.83", "initiator_port": 49342, "responder_port": 443, "initiator_bytes": 1629, "last_seen_epoch": "1575413302.650633", "responder_bytes": 5791, "first_seen_epoch": "1575413258.37194" }, { "bytes": 5845, "stream": 163, "flow_id": "flow-d1074baf73dc5c19fe5e5c0e", "packets": 22, "transport": "tcp", "last_frame": 11997, "first_frame": 8206, "initiator_ip": "10.18.20.97", "responder_ip": "13.249.22.83", "initiator_port": 49343, "responder_port": 443, "initiator_bytes": 978, "last_seen_epoch": "1575413302.50704", "responder_bytes": 4867, "first_seen_epoch": "1575413258.372343" }, { "bytes": 176, "stream": 65, "flow_id": "flow-ea5ec6c134aa0949696a846a", "packets": 2, "transport": "udp", "last_frame": 8315, "first_frame": 8238, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 61692, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1575413258.762246", "responder_bytes": 96, "first_seen_epoch": "1575413258.535495" }, { "bytes": 2923, "stream": 164, "flow_id": "flow-6b5e4b60572a137e3e8e2edd", "packets": 17, "transport": "tcp", "last_frame": 12446, "first_frame": 8243, "initiator_ip": "10.18.20.97", "responder_ip": "172.217.12.38", "initiator_port": 49344, "responder_port": 443, "initiator_bytes": 1227, "last_seen_epoch": "1575413302.720346", "responder_bytes": 1696, "first_seen_epoch": "1575413258.538445" }, { "bytes": 4108, "stream": 165, "flow_id": "flow-622c369e88847ab0cd7303cd", "packets": 19, "transport": "tcp", "last_frame": 12439, "first_frame": 8244, "initiator_ip": "10.18.20.97", "responder_ip": "172.217.12.38", "initiator_port": 49345, "responder_port": 443, "initiator_bytes": 1281, "last_seen_epoch": "1575413302.712117", "responder_bytes": 2827, "first_seen_epoch": "1575413258.538862" }, { "bytes": 2939, "stream": 166, "flow_id": "flow-5103395865b13da8bd3935e3", "packets": 17, "transport": "tcp", "last_frame": 12452, "first_frame": 8245, "initiator_ip": "10.18.20.97", "responder_ip": "172.217.12.38", "initiator_port": 49346, "responder_port": 443, "initiator_bytes": 1227, "last_seen_epoch": "1575413302.723316", "responder_bytes": 1712, "first_seen_epoch": "1575413258.539484" }, { "bytes": 21243, "stream": 167, "flow_id": "flow-5a7f3def941cb0f9d388f734", "packets": 40, "transport": "tcp", "last_frame": 12440, "first_frame": 8246, "initiator_ip": "10.18.20.97", "responder_ip": "172.217.12.38", "initiator_port": 49347, "responder_port": 443, "initiator_bytes": 2182, "last_seen_epoch": "1575413302.712198", "responder_bytes": 19061, "first_seen_epoch": "1575413258.539905" }, { "bytes": 4491, "stream": 168, "flow_id": "flow-ba55d1cc7efd99cd3dafaf4d", "packets": 25, "transport": "tcp", "last_frame": 12390, "first_frame": 8266, "initiator_ip": "10.18.20.97", "responder_ip": "52.54.122.125", "initiator_port": 49348, "responder_port": 443, "initiator_bytes": 2690, "last_seen_epoch": "1575413302.692285", "responder_bytes": 1801, "first_seen_epoch": "1575413258.604331" }, { "bytes": 2231, "stream": 169, "flow_id": "flow-b5ebe17411b6d451d0ae637c", "packets": 17, "transport": "tcp", "last_frame": 12424, "first_frame": 8267, "initiator_ip": "10.18.20.97", "responder_ip": "52.54.122.125", "initiator_port": 49349, "responder_port": 443, "initiator_bytes": 1232, "last_seen_epoch": "1575413302.700121", "responder_bytes": 999, "first_seen_epoch": "1575413258.60444" }, { "bytes": 3257, "stream": 170, "flow_id": "flow-b94c0721ad14da8ac7d248d6", "packets": 21, "transport": "tcp", "last_frame": 12402, "first_frame": 8268, "initiator_ip": "10.18.20.97", "responder_ip": "52.54.122.125", "initiator_port": 49350, "responder_port": 443, "initiator_bytes": 1793, "last_seen_epoch": "1575413302.694157", "responder_bytes": 1464, "first_seen_epoch": "1575413258.605552" }, { "bytes": 2231, "stream": 171, "flow_id": "flow-c955b229d71fe30a44e635a4", "packets": 17, "transport": "tcp", "last_frame": 12418, "first_frame": 8269, "initiator_ip": "10.18.20.97", "responder_ip": "52.54.122.125", "initiator_port": 49351, "responder_port": 443, "initiator_bytes": 1232, "last_seen_epoch": "1575413302.698946", "responder_bytes": 999, "first_seen_epoch": "1575413258.605854" }, { "bytes": 158, "stream": 66, "flow_id": "flow-2da7b9926fa7e25c6467083f", "packets": 2, "transport": "udp", "last_frame": 8331, "first_frame": 8270, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 64795, "responder_port": 53, "initiator_bytes": 71, "last_seen_epoch": "1575413258.871609", "responder_bytes": 87, "first_seen_epoch": "1575413258.607616" }, { "bytes": 5266, "stream": 172, "flow_id": "flow-26be7f6aba78523d2201f3e0", "packets": 19, "transport": "tcp", "last_frame": 12318, "first_frame": 8316, "initiator_ip": "10.18.20.97", "responder_ip": "216.58.194.106", "initiator_port": 49352, "responder_port": 443, "initiator_bytes": 840, "last_seen_epoch": "1575413302.650257", "responder_bytes": 4426, "first_seen_epoch": "1575413258.768228" }, { "bytes": 6994, "stream": 173, "flow_id": "flow-ab02f23a8d177319481374e5", "packets": 22, "transport": "tcp", "last_frame": 12308, "first_frame": 8317, "initiator_ip": "10.18.20.97", "responder_ip": "216.58.194.106", "initiator_port": 49353, "responder_port": 443, "initiator_bytes": 1308, "last_seen_epoch": "1575413302.644585", "responder_bytes": 5686, "first_seen_epoch": "1575413258.768372" }, { "bytes": 7974, "stream": 174, "flow_id": "flow-8773c93cfc7871032fc7a216", "packets": 24, "transport": "tcp", "last_frame": 12300, "first_frame": 8342, "initiator_ip": "10.18.20.97", "responder_ip": "35.190.72.161", "initiator_port": 49354, "responder_port": 443, "initiator_bytes": 1592, "last_seen_epoch": "1575413302.643919", "responder_bytes": 6382, "first_seen_epoch": "1575413258.874375" }, { "bytes": 4371, "stream": 175, "flow_id": "flow-6d8c43b23c80ca4185deb2a4", "packets": 18, "transport": "tcp", "last_frame": 12309, "first_frame": 8343, "initiator_ip": "10.18.20.97", "responder_ip": "35.190.72.161", "initiator_port": 49355, "responder_port": 443, "initiator_bytes": 801, "last_seen_epoch": "1575413302.644627", "responder_bytes": 3570, "first_seen_epoch": "1575413258.874421" }, { "bytes": 3035, "stream": 176, "flow_id": "flow-e1d654e6427c58da3371bd99", "packets": 17, "transport": "tcp", "last_frame": 12436, "first_frame": 8394, "initiator_ip": "10.18.20.97", "responder_ip": "172.217.12.38", "initiator_port": 49357, "responder_port": 443, "initiator_bytes": 1211, "last_seen_epoch": "1575413302.710996", "responder_bytes": 1824, "first_seen_epoch": "1575413259.104668" }, { "bytes": 3067, "stream": 177, "flow_id": "flow-d1793456325a78ade7b716b0", "packets": 17, "transport": "tcp", "last_frame": 12432, "first_frame": 8395, "initiator_ip": "10.18.20.97", "responder_ip": "172.217.12.38", "initiator_port": 49356, "responder_port": 443, "initiator_bytes": 1211, "last_seen_epoch": "1575413302.70823", "responder_bytes": 1856, "first_seen_epoch": "1575413259.104734" }, { "bytes": 206, "stream": 67, "flow_id": "flow-f0a2b31006fc755a96eb50a4", "packets": 2, "transport": "udp", "last_frame": 8615, "first_frame": 8582, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 58111, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1575413260.271166", "responder_bytes": 129, "first_seen_epoch": "1575413259.995926" }, { "bytes": 162, "stream": 68, "flow_id": "flow-cb78be8b1daf33c687a6b9a2", "packets": 2, "transport": "udp", "last_frame": 8643, "first_frame": 8601, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 54344, "responder_port": 53, "initiator_bytes": 73, "last_seen_epoch": "1575413260.379428", "responder_bytes": 89, "first_seen_epoch": "1575413260.16262" }, { "bytes": 261, "stream": 69, "flow_id": "flow-3b39116157a1e28e4d1cdd68", "packets": 2, "transport": "udp", "last_frame": 8646, "first_frame": 8604, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 57868, "responder_port": 53, "initiator_bytes": 73, "last_seen_epoch": "1575413260.432992", "responder_bytes": 188, "first_seen_epoch": "1575413260.166154" }, { "bytes": 69670, "stream": 178, "flow_id": "flow-5127355f13a0e6532c094894", "packets": 105, "transport": "tcp", "last_frame": 12296, "first_frame": 8616, "initiator_ip": "10.18.20.97", "responder_ip": "172.217.12.67", "initiator_port": 49358, "responder_port": 443, "initiator_bytes": 3468, "last_seen_epoch": "1575413302.640533", "responder_bytes": 66202, "first_seen_epoch": "1575413260.271627" }, { "bytes": 26126, "stream": 179, "flow_id": "flow-9c12197f54eeb73b06f405c7", "packets": 45, "transport": "tcp", "last_frame": 9034, "first_frame": 8617, "initiator_ip": "10.18.20.97", "responder_ip": "172.217.12.67", "initiator_port": 49359, "responder_port": 443, "initiator_bytes": 1952, "last_seen_epoch": "1575413261.175767", "responder_bytes": 24174, "first_seen_epoch": "1575413260.271831" }, { "bytes": 46815, "stream": 180, "flow_id": "flow-5218049320977816c8fca284", "packets": 73, "transport": "tcp", "last_frame": 9033, "first_frame": 8618, "initiator_ip": "10.18.20.97", "responder_ip": "172.217.12.67", "initiator_port": 49360, "responder_port": 443, "initiator_bytes": 2704, "last_seen_epoch": "1575413261.175657", "responder_bytes": 44111, "first_seen_epoch": "1575413260.271914" }, { "bytes": 11401, "stream": 181, "flow_id": "flow-59dad567036374eaae451d1f", "packets": 26, "transport": "tcp", "last_frame": 9032, "first_frame": 8619, "initiator_ip": "10.18.20.97", "responder_ip": "172.217.12.67", "initiator_port": 49361, "responder_port": 443, "initiator_bytes": 1466, "last_seen_epoch": "1575413261.175365", "responder_bytes": 9935, "first_seen_epoch": "1575413260.2721" }, { "bytes": 5488, "stream": 182, "flow_id": "flow-4a92ed01eaeae677ff7bfc71", "packets": 18, "transport": "tcp", "last_frame": 9035, "first_frame": 8620, "initiator_ip": "10.18.20.97", "responder_ip": "172.217.12.67", "initiator_port": 49362, "responder_port": 443, "initiator_bytes": 1250, "last_seen_epoch": "1575413261.175844", "responder_bytes": 4238, "first_seen_epoch": "1575413260.272343" }, { "bytes": 4373, "stream": 183, "flow_id": "flow-d3b4ce89065bf2cbe9dff26e", "packets": 18, "transport": "tcp", "last_frame": 12303, "first_frame": 8644, "initiator_ip": "10.18.20.97", "responder_ip": "35.190.36.172", "initiator_port": 49364, "responder_port": 443, "initiator_bytes": 803, "last_seen_epoch": "1575413302.64428", "responder_bytes": 3570, "first_seen_epoch": "1575413260.380433" }, { "bytes": 25348, "stream": 184, "flow_id": "flow-8538e4992de2490bca2d9e6a", "packets": 44, "transport": "tcp", "last_frame": 9031, "first_frame": 8645, "initiator_ip": "10.18.20.97", "responder_ip": "35.190.36.172", "initiator_port": 49363, "responder_port": 443, "initiator_bytes": 1926, "last_seen_epoch": "1575413261.171977", "responder_bytes": 23422, "first_seen_epoch": "1575413260.380613" }, { "bytes": 8684, "stream": 185, "flow_id": "flow-d90435d7d0dbf808e2a62a82", "packets": 22, "transport": "tcp", "last_frame": 9030, "first_frame": 8647, "initiator_ip": "10.18.20.97", "responder_ip": "76.13.32.137", "initiator_port": 49365, "responder_port": 443, "initiator_bytes": 1514, "last_seen_epoch": "1575413261.171641", "responder_bytes": 7170, "first_seen_epoch": "1575413260.433831" }, { "bytes": 14368, "stream": 186, "flow_id": "flow-22fcaa14428064781cd2dd7a", "packets": 40, "transport": "tcp", "last_frame": 11980, "first_frame": 8648, "initiator_ip": "10.18.20.97", "responder_ip": "76.13.32.137", "initiator_port": 49366, "responder_port": 443, "initiator_bytes": 3866, "last_seen_epoch": "1575413302.505565", "responder_bytes": 10502, "first_seen_epoch": "1575413260.434046" }, { "bytes": 4885, "stream": 187, "flow_id": "flow-b219a1893c0e6e33da56cec9", "packets": 18, "transport": "tcp", "last_frame": 12469, "first_frame": 8884, "initiator_ip": "10.18.20.97", "responder_ip": "152.199.24.48", "initiator_port": 49367, "responder_port": 443, "initiator_bytes": 862, "last_seen_epoch": "1575413302.727769", "responder_bytes": 4023, "first_seen_epoch": "1575413260.972705" }, { "bytes": 12227, "stream": 188, "flow_id": "flow-1075b3439676f8b0a5f8d689", "packets": 37, "transport": "tcp", "last_frame": 12450, "first_frame": 8885, "initiator_ip": "10.18.20.97", "responder_ip": "152.199.24.48", "initiator_port": 49368, "responder_port": 443, "initiator_bytes": 3422, "last_seen_epoch": "1575413302.721364", "responder_bytes": 8805, "first_seen_epoch": "1575413260.972757" }, { "bytes": 390, "stream": 70, "flow_id": "flow-9c8aae2e52dbe3e6ec0c2201", "packets": 2, "transport": "udp", "last_frame": 9126, "first_frame": 9117, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 53644, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1575413262.266157", "responder_bytes": 314, "first_seen_epoch": "1575413262.140958" }, { "bytes": 6521, "stream": 189, "flow_id": "flow-d9188615ebf9852476cf7f6d", "packets": 23, "transport": "tcp", "last_frame": 12352, "first_frame": 9127, "initiator_ip": "10.18.20.97", "responder_ip": "18.210.147.153", "initiator_port": 49369, "responder_port": 443, "initiator_bytes": 984, "last_seen_epoch": "1575413302.673254", "responder_bytes": 5537, "first_seen_epoch": "1575413262.267289" }, { "bytes": 9495, "stream": 190, "flow_id": "flow-253cead0a563eb0368a46af2", "packets": 30, "transport": "tcp", "last_frame": 12345, "first_frame": 9128, "initiator_ip": "10.18.20.97", "responder_ip": "18.210.147.153", "initiator_port": 49370, "responder_port": 443, "initiator_bytes": 2308, "last_seen_epoch": "1575413302.672868", "responder_bytes": 7187, "first_seen_epoch": "1575413262.267402" }, { "bytes": 4982, "stream": 191, "flow_id": "flow-7389bf0c0a09aa5b224754b4", "packets": 19, "transport": "tcp", "last_frame": 12460, "first_frame": 9143, "initiator_ip": "10.18.20.97", "responder_ip": "152.195.14.41", "initiator_port": 49371, "responder_port": 443, "initiator_bytes": 922, "last_seen_epoch": "1575413302.725232", "responder_bytes": 4060, "first_seen_epoch": "1575413262.32773" }, { "bytes": 6439, "stream": 192, "flow_id": "flow-3c57e60068ac1a7981fcaee8", "packets": 22, "transport": "tcp", "last_frame": 12445, "first_frame": 9144, "initiator_ip": "10.18.20.97", "responder_ip": "152.195.14.41", "initiator_port": 49372, "responder_port": 443, "initiator_bytes": 1557, "last_seen_epoch": "1575413302.720271", "responder_bytes": 4882, "first_seen_epoch": "1575413262.327831" }, { "bytes": 380, "stream": 71, "flow_id": "flow-42230b8b26fd32aae5fc097f", "packets": 2, "transport": "udp", "last_frame": 9152, "first_frame": 9151, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 60396, "responder_port": 53, "initiator_bytes": 89, "last_seen_epoch": "1575413262.342458", "responder_bytes": 291, "first_seen_epoch": "1575413262.342123" }, { "bytes": 6828, "stream": 193, "flow_id": "flow-d6261a00e3ca6d7f61e065d3", "packets": 20, "transport": "tcp", "last_frame": 12358, "first_frame": 9154, "initiator_ip": "10.18.20.97", "responder_ip": "34.204.4.212", "initiator_port": 49373, "responder_port": 443, "initiator_bytes": 889, "last_seen_epoch": "1575413302.674994", "responder_bytes": 5939, "first_seen_epoch": "1575413262.342969" }, { "bytes": 8692, "stream": 194, "flow_id": "flow-5ba0c581375ba1443445ecba", "packets": 25, "transport": "tcp", "last_frame": 12336, "first_frame": 9156, "initiator_ip": "10.18.20.97", "responder_ip": "34.204.4.212", "initiator_port": 49374, "responder_port": 443, "initiator_bytes": 2320, "last_seen_epoch": "1575413302.671633", "responder_bytes": 6372, "first_seen_epoch": "1575413262.343112" }, { "bytes": 199, "stream": 72, "flow_id": "flow-68a05bd3e71ee9afa23bc794", "packets": 2, "transport": "udp", "last_frame": 9322, "first_frame": 9281, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 57291, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1575413262.64318", "responder_bytes": 119, "first_seen_epoch": "1575413262.562854" }, { "bytes": 378, "stream": 73, "flow_id": "flow-fbd164862ba817048cd17750", "packets": 2, "transport": "udp", "last_frame": 9324, "first_frame": 9286, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 57752, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1575413262.643694", "responder_bytes": 297, "first_seen_epoch": "1575413262.570113" }, { "bytes": 215, "stream": 74, "flow_id": "flow-b147d930a820c7d5f7869251", "packets": 2, "transport": "udp", "last_frame": 9306, "first_frame": 9288, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 51627, "responder_port": 53, "initiator_bytes": 87, "last_seen_epoch": "1575413262.640954", "responder_bytes": 128, "first_seen_epoch": "1575413262.571454" }, { "bytes": 337, "stream": 75, "flow_id": "flow-27ac0b70f14bf4117e1c35c4", "packets": 2, "transport": "udp", "last_frame": 9334, "first_frame": 9289, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 52285, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1575413262.647446", "responder_bytes": 261, "first_seen_epoch": "1575413262.574246" }, { "bytes": 267, "stream": 76, "flow_id": "flow-60459ba4d3661ade341956f0", "packets": 2, "transport": "udp", "last_frame": 9336, "first_frame": 9290, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 50848, "responder_port": 53, "initiator_bytes": 84, "last_seen_epoch": "1575413262.649448", "responder_bytes": 183, "first_seen_epoch": "1575413262.576039" }, { "bytes": 243, "stream": 77, "flow_id": "flow-cd712492aa20cfaf94e215dd", "packets": 2, "transport": "udp", "last_frame": 9305, "first_frame": 9291, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 55758, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1575413262.640867", "responder_bytes": 167, "first_seen_epoch": "1575413262.579955" }, { "bytes": 194, "stream": 78, "flow_id": "flow-ee7e3e99398dcfc4f84f9d9e", "packets": 2, "transport": "udp", "last_frame": 9357, "first_frame": 9292, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 59139, "responder_port": 53, "initiator_bytes": 71, "last_seen_epoch": "1575413262.702392", "responder_bytes": 123, "first_seen_epoch": "1575413262.581216" }, { "bytes": 182, "stream": 79, "flow_id": "flow-30a4ff9bc3b3d90cfc15dd3e", "packets": 2, "transport": "udp", "last_frame": 9350, "first_frame": 9293, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 61186, "responder_port": 53, "initiator_bytes": 75, "last_seen_epoch": "1575413262.658303", "responder_bytes": 107, "first_seen_epoch": "1575413262.58492" }, { "bytes": 235, "stream": 80, "flow_id": "flow-c135a9521a9736a0c7c31696", "packets": 2, "transport": "udp", "last_frame": 9345, "first_frame": 9294, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 53252, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1575413262.654064", "responder_bytes": 159, "first_seen_epoch": "1575413262.587877" }, { "bytes": 321, "stream": 81, "flow_id": "flow-72441b9c1b1824d971f06710", "packets": 2, "transport": "udp", "last_frame": 9344, "first_frame": 9295, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 58656, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1575413262.653946", "responder_bytes": 249, "first_seen_epoch": "1575413262.589105" }, { "bytes": 376, "stream": 82, "flow_id": "flow-3c32a0002b1706b48ef4f14e", "packets": 2, "transport": "udp", "last_frame": 9360, "first_frame": 9296, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 65108, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1575413262.717743", "responder_bytes": 296, "first_seen_epoch": "1575413262.590656" }, { "bytes": 5916, "stream": 195, "flow_id": "flow-30994bf489019d39de29926d", "packets": 21, "transport": "tcp", "last_frame": 12251, "first_frame": 9307, "initiator_ip": "10.18.20.97", "responder_ip": "172.217.1.130", "initiator_port": 49375, "responder_port": 443, "initiator_bytes": 1785, "last_seen_epoch": "1575413302.614159", "responder_bytes": 4131, "first_seen_epoch": "1575413262.641832" }, { "bytes": 9045, "stream": 196, "flow_id": "flow-70264303c7eee6b9f40a1828", "packets": 29, "transport": "tcp", "last_frame": 12293, "first_frame": 9314, "initiator_ip": "10.18.20.97", "responder_ip": "216.200.232.221", "initiator_port": 49376, "responder_port": 443, "initiator_bytes": 3299, "last_seen_epoch": "1575413302.635443", "responder_bytes": 5746, "first_seen_epoch": "1575413262.642433" }, { "bytes": 4083, "stream": 197, "flow_id": "flow-2eeb2a61f8d4f1841f7a0a8c", "packets": 17, "transport": "tcp", "last_frame": 12276, "first_frame": 9317, "initiator_ip": "10.18.20.97", "responder_ip": "172.217.1.130", "initiator_port": 49377, "responder_port": 443, "initiator_bytes": 793, "last_seen_epoch": "1575413302.625256", "responder_bytes": 3290, "first_seen_epoch": "1575413262.64258" }, { "bytes": 5869, "stream": 198, "flow_id": "flow-4f4b3696c2da83379ae5afb4", "packets": 23, "transport": "tcp", "last_frame": 12274, "first_frame": 9319, "initiator_ip": "10.18.20.97", "responder_ip": "216.200.232.221", "initiator_port": 49378, "responder_port": 443, "initiator_bytes": 1677, "last_seen_epoch": "1575413302.623232", "responder_bytes": 4192, "first_seen_epoch": "1575413262.642742" }, { "bytes": 11126, "stream": 199, "flow_id": "flow-66bcaccba039e67aecf8a895", "packets": 33, "transport": "tcp", "last_frame": 12294, "first_frame": 9328, "initiator_ip": "10.18.20.97", "responder_ip": "216.58.193.130", "initiator_port": 49379, "responder_port": 443, "initiator_bytes": 3210, "last_seen_epoch": "1575413302.635485", "responder_bytes": 7916, "first_seen_epoch": "1575413262.646699" }, { "bytes": 7006, "stream": 200, "flow_id": "flow-0a46f27b29e4c48e58c3ac8f", "packets": 23, "transport": "tcp", "last_frame": 12290, "first_frame": 9329, "initiator_ip": "10.18.20.97", "responder_ip": "216.58.193.130", "initiator_port": 49381, "responder_port": 443, "initiator_bytes": 1922, "last_seen_epoch": "1575413302.635111", "responder_bytes": 5084, "first_seen_epoch": "1575413262.646852" }, { "bytes": 8976, "stream": 201, "flow_id": "flow-2b680e69eaa89dba0c8fe203", "packets": 27, "transport": "tcp", "last_frame": 12278, "first_frame": 9330, "initiator_ip": "10.18.20.97", "responder_ip": "216.58.193.130", "initiator_port": 49380, "responder_port": 443, "initiator_bytes": 2383, "last_seen_epoch": "1575413302.627755", "responder_bytes": 6593, "first_seen_epoch": "1575413262.6469" }, { "bytes": 6711, "stream": 202, "flow_id": "flow-922005f7d0656fe308970e3c", "packets": 23, "transport": "tcp", "last_frame": 12286, "first_frame": 9331, "initiator_ip": "10.18.20.97", "responder_ip": "216.58.193.130", "initiator_port": 49382, "responder_port": 443, "initiator_bytes": 1833, "last_seen_epoch": "1575413302.632167", "responder_bytes": 4878, "first_seen_epoch": "1575413262.647019" }, { "bytes": 11067, "stream": 203, "flow_id": "flow-6f0fe03c805dca3ea49245df", "packets": 31, "transport": "tcp", "last_frame": 12314, "first_frame": 9335, "initiator_ip": "10.18.20.97", "responder_ip": "54.84.47.220", "initiator_port": 49383, "responder_port": 443, "initiator_bytes": 3535, "last_seen_epoch": "1575413302.647734", "responder_bytes": 7532, "first_seen_epoch": "1575413262.649028" }, { "bytes": 4895, "stream": 204, "flow_id": "flow-b4f2dae6edab72153f993f61", "packets": 18, "transport": "tcp", "last_frame": 12310, "first_frame": 9337, "initiator_ip": "10.18.20.97", "responder_ip": "54.84.47.220", "initiator_port": 49384, "responder_port": 443, "initiator_bytes": 822, "last_seen_epoch": "1575413302.644661", "responder_bytes": 4073, "first_seen_epoch": "1575413262.649467" }, { "bytes": 12692, "stream": 205, "flow_id": "flow-93c5e7d4b8e748e8038ea863", "packets": 37, "transport": "tcp", "last_frame": 12327, "first_frame": 9338, "initiator_ip": "10.18.20.97", "responder_ip": "54.158.57.141", "initiator_port": 49385, "responder_port": 443, "initiator_bytes": 4731, "last_seen_epoch": "1575413302.654254", "responder_bytes": 7961, "first_seen_epoch": "1575413262.649578" }, { "bytes": 12558, "stream": 206, "flow_id": "flow-df4c8d4374f2df77be4537cc", "packets": 36, "transport": "tcp", "last_frame": 12332, "first_frame": 9339, "initiator_ip": "10.18.20.97", "responder_ip": "54.158.57.141", "initiator_port": 49386, "responder_port": 443, "initiator_bytes": 4645, "last_seen_epoch": "1575413302.655438", "responder_bytes": 7913, "first_seen_epoch": "1575413262.649629" }, { "bytes": 11392, "stream": 207, "flow_id": "flow-1c2a5f55ac8f4d8f5b328d28", "packets": 30, "transport": "tcp", "last_frame": 12258, "first_frame": 9340, "initiator_ip": "10.18.20.97", "responder_ip": "23.11.217.71", "initiator_port": 49387, "responder_port": 443, "initiator_bytes": 2924, "last_seen_epoch": "1575413302.615864", "responder_bytes": 8468, "first_seen_epoch": "1575413262.649913" }, { "bytes": 11162, "stream": 208, "flow_id": "flow-b26eaec9a3e7e610f0ef5faa", "packets": 29, "transport": "tcp", "last_frame": 12261, "first_frame": 9341, "initiator_ip": "10.18.20.97", "responder_ip": "23.11.217.71", "initiator_port": 49388, "responder_port": 443, "initiator_bytes": 2924, "last_seen_epoch": "1575413302.616013", "responder_bytes": 8238, "first_seen_epoch": "1575413262.650067" }, { "bytes": 32885, "stream": 209, "flow_id": "flow-b8aa84f9f6b8e66f62d28201", "packets": 60, "transport": "tcp", "last_frame": 12243, "first_frame": 9346, "initiator_ip": "10.18.20.97", "responder_ip": "23.11.217.11", "initiator_port": 49389, "responder_port": 443, "initiator_bytes": 4061, "last_seen_epoch": "1575413302.604281", "responder_bytes": 28824, "first_seen_epoch": "1575413262.654712" }, { "bytes": 4903, "stream": 210, "flow_id": "flow-ee5b252ab19ccb25baba38ca", "packets": 20, "transport": "tcp", "last_frame": 11926, "first_frame": 9349, "initiator_ip": "10.18.20.97", "responder_ip": "23.11.217.11", "initiator_port": 49390, "responder_port": 443, "initiator_bytes": 914, "last_seen_epoch": "1575413302.495539", "responder_bytes": 3989, "first_seen_epoch": "1575413262.657725" }, { "bytes": 9733, "stream": 211, "flow_id": "flow-6bc56d5435171de42bb3e16c", "packets": 30, "transport": "tcp", "last_frame": 11919, "first_frame": 9351, "initiator_ip": "10.18.20.97", "responder_ip": "104.254.149.101", "initiator_port": 49391, "responder_port": 443, "initiator_bytes": 3410, "last_seen_epoch": "1575413302.494694", "responder_bytes": 6323, "first_seen_epoch": "1575413262.659179" }, { "bytes": 3810, "stream": 212, "flow_id": "flow-e4eb0dda65eec0676c56e912", "packets": 17, "transport": "tcp", "last_frame": 12287, "first_frame": 9352, "initiator_ip": "10.18.20.97", "responder_ip": "104.254.149.101", "initiator_port": 49392, "responder_port": 443, "initiator_bytes": 778, "last_seen_epoch": "1575413302.632225", "responder_bytes": 3032, "first_seen_epoch": "1575413262.659242" }, { "bytes": 15702, "stream": 213, "flow_id": "flow-1009b5c55949e29bf3850985", "packets": 43, "transport": "tcp", "last_frame": 12288, "first_frame": 9353, "initiator_ip": "10.18.20.97", "responder_ip": "35.211.144.153", "initiator_port": 49393, "responder_port": 443, "initiator_bytes": 5196, "last_seen_epoch": "1575413302.632261", "responder_bytes": 10506, "first_seen_epoch": "1575413262.659456" }, { "bytes": 7724, "stream": 214, "flow_id": "flow-a2892e34ba91de3fab85bd6d", "packets": 23, "transport": "tcp", "last_frame": 12312, "first_frame": 9354, "initiator_ip": "10.18.20.97", "responder_ip": "35.211.144.153", "initiator_port": 49394, "responder_port": 443, "initiator_bytes": 983, "last_seen_epoch": "1575413302.646526", "responder_bytes": 6741, "first_seen_epoch": "1575413262.659505" }, { "bytes": 4792, "stream": 215, "flow_id": "flow-dfca5701114ae700a69381af", "packets": 21, "transport": "tcp", "last_frame": 10772, "first_frame": 9358, "initiator_ip": "10.18.20.97", "responder_ip": "50.116.194.21", "initiator_port": 49395, "responder_port": 443, "initiator_bytes": 1073, "last_seen_epoch": "1575413267.638219", "responder_bytes": 3719, "first_seen_epoch": "1575413262.703242" }, { "bytes": 7239, "stream": 216, "flow_id": "flow-e9185bb5a3d6d19c91dbef83", "packets": 27, "transport": "tcp", "last_frame": 11933, "first_frame": 9359, "initiator_ip": "10.18.20.97", "responder_ip": "50.116.194.21", "initiator_port": 49396, "responder_port": 443, "initiator_bytes": 2409, "last_seen_epoch": "1575413302.496526", "responder_bytes": 4830, "first_seen_epoch": "1575413262.703315" }, { "bytes": 9389, "stream": 217, "flow_id": "flow-74033e60cbdfe362a8ead81e", "packets": 30, "transport": "tcp", "last_frame": 12283, "first_frame": 9361, "initiator_ip": "10.18.20.97", "responder_ip": "192.184.69.225", "initiator_port": 49397, "responder_port": 443, "initiator_bytes": 3053, "last_seen_epoch": "1575413302.632126", "responder_bytes": 6336, "first_seen_epoch": "1575413262.71874" }, { "bytes": 4909, "stream": 218, "flow_id": "flow-e42e2413ea6343d08753bb5d", "packets": 19, "transport": "tcp", "last_frame": 12298, "first_frame": 9362, "initiator_ip": "10.18.20.97", "responder_ip": "192.184.69.225", "initiator_port": 49398, "responder_port": 443, "initiator_bytes": 880, "last_seen_epoch": "1575413302.640594", "responder_bytes": 4029, "first_seen_epoch": "1575413262.718966" }, { "bytes": 6371, "stream": 219, "flow_id": "flow-c351742abd5707e3f97d089d", "packets": 25, "transport": "tcp", "last_frame": 12330, "first_frame": 9739, "initiator_ip": "10.18.20.97", "responder_ip": "54.158.57.141", "initiator_port": 49399, "responder_port": 443, "initiator_bytes": 3751, "last_seen_epoch": "1575413302.655187", "responder_bytes": 2620, "first_seen_epoch": "1575413263.72681" }, { "bytes": 2943, "stream": 220, "flow_id": "flow-d69c274710fc88a951dbbc37", "packets": 17, "transport": "tcp", "last_frame": 12324, "first_frame": 9743, "initiator_ip": "10.18.20.97", "responder_ip": "54.158.57.141", "initiator_port": 49400, "responder_port": 443, "initiator_bytes": 1717, "last_seen_epoch": "1575413302.65394", "responder_bytes": 1226, "first_seen_epoch": "1575413263.741686" }, { "bytes": 218, "stream": 83, "flow_id": "flow-b3af02247b85786f7821131e", "packets": 2, "transport": "udp", "last_frame": 9810, "first_frame": 9748, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 61623, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1575413264.126151", "responder_bytes": 139, "first_seen_epoch": "1575413263.778707" }, { "bytes": 5923, "stream": 221, "flow_id": "flow-09a57e19b985acad4c144944", "packets": 25, "transport": "tcp", "last_frame": 12316, "first_frame": 9761, "initiator_ip": "10.18.20.97", "responder_ip": "54.158.57.141", "initiator_port": 49401, "responder_port": 443, "initiator_bytes": 3319, "last_seen_epoch": "1575413302.648021", "responder_bytes": 2604, "first_seen_epoch": "1575413263.928134" }, { "bytes": 349, "stream": 84, "flow_id": "flow-8439efd8c1e1eaeee9db07d6", "packets": 2, "transport": "udp", "last_frame": 9864, "first_frame": 9786, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 56809, "responder_port": 53, "initiator_bytes": 83, "last_seen_epoch": "1575413264.51811", "responder_bytes": 266, "first_seen_epoch": "1575413264.031399" }, { "bytes": 1181, "stream": 222, "flow_id": "flow-6f16f44e9d2580914ac22256", "packets": 13, "transport": "tcp", "last_frame": 12328, "first_frame": 9801, "initiator_ip": "10.18.20.97", "responder_ip": "54.158.57.141", "initiator_port": 49402, "responder_port": 443, "initiator_bytes": 676, "last_seen_epoch": "1575413302.654293", "responder_bytes": 505, "first_seen_epoch": "1575413264.113169" }, { "bytes": 8380, "stream": 223, "flow_id": "flow-a0d3299aefd3d94f68eb8841", "packets": 30, "transport": "tcp", "last_frame": 11909, "first_frame": 9811, "initiator_ip": "10.18.20.97", "responder_ip": "74.6.138.75", "initiator_port": 49403, "responder_port": 443, "initiator_bytes": 2701, "last_seen_epoch": "1575413302.49366", "responder_bytes": 5679, "first_seen_epoch": "1575413264.126791" }, { "bytes": 8459, "stream": 224, "flow_id": "flow-ab287cdb5219f5cb3949830d", "packets": 28, "transport": "tcp", "last_frame": 11912, "first_frame": 9812, "initiator_ip": "10.18.20.97", "responder_ip": "74.6.138.75", "initiator_port": 49404, "responder_port": 443, "initiator_bytes": 2967, "last_seen_epoch": "1575413302.493996", "responder_bytes": 5492, "first_seen_epoch": "1575413264.12692" }, { "bytes": 227, "stream": 85, "flow_id": "flow-80e1fe258e6c6865cc94c5f1", "packets": 2, "transport": "udp", "last_frame": 9934, "first_frame": 9852, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 54857, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1575413264.714628", "responder_bytes": 148, "first_seen_epoch": "1575413264.386247" }, { "bytes": 8769, "stream": 225, "flow_id": "flow-f4bb7f6cb37dc6be5668bf77", "packets": 27, "transport": "tcp", "last_frame": 12268, "first_frame": 9869, "initiator_ip": "10.18.20.97", "responder_ip": "34.193.46.35", "initiator_port": 49405, "responder_port": 443, "initiator_bytes": 2965, "last_seen_epoch": "1575413302.619704", "responder_bytes": 5804, "first_seen_epoch": "1575413264.519293" }, { "bytes": 15497, "stream": 226, "flow_id": "flow-fc50e20f101e5316faa11ab3", "packets": 43, "transport": "tcp", "last_frame": 12249, "first_frame": 9870, "initiator_ip": "10.18.20.97", "responder_ip": "34.193.46.35", "initiator_port": 49406, "responder_port": 443, "initiator_bytes": 6313, "last_seen_epoch": "1575413302.61149", "responder_bytes": 9184, "first_seen_epoch": "1575413264.519575" }, { "bytes": 8641, "stream": 227, "flow_id": "flow-cc66ede8fa0460c806c552f2", "packets": 27, "transport": "tcp", "last_frame": 12262, "first_frame": 9885, "initiator_ip": "10.18.20.97", "responder_ip": "34.193.46.35", "initiator_port": 49407, "responder_port": 443, "initiator_bytes": 2965, "last_seen_epoch": "1575413302.616056", "responder_bytes": 5676, "first_seen_epoch": "1575413264.526144" }, { "bytes": 12421, "stream": 228, "flow_id": "flow-aafdd8eec234c1f9307fb7b9", "packets": 35, "transport": "tcp", "last_frame": 12267, "first_frame": 9888, "initiator_ip": "10.18.20.97", "responder_ip": "34.193.46.35", "initiator_port": 49408, "responder_port": 443, "initiator_bytes": 4919, "last_seen_epoch": "1575413302.61966", "responder_bytes": 7502, "first_seen_epoch": "1575413264.529485" }, { "bytes": 237, "stream": 86, "flow_id": "flow-34c93e7893310d09ea69a873", "packets": 2, "transport": "udp", "last_frame": 9983, "first_frame": 9893, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 53963, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1575413264.913538", "responder_bytes": 165, "first_seen_epoch": "1575413264.532818" }, { "bytes": 336, "stream": 87, "flow_id": "flow-569ca42ba3fb3e0818ad7f74", "packets": 2, "transport": "udp", "last_frame": 9974, "first_frame": 9894, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 55677, "responder_port": 53, "initiator_bytes": 71, "last_seen_epoch": "1575413264.85995", "responder_bytes": 265, "first_seen_epoch": "1575413264.533633" }, { "bytes": 284, "stream": 88, "flow_id": "flow-485e9ecb4c793d737f1a6a9f", "packets": 2, "transport": "udp", "last_frame": 10032, "first_frame": 9897, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 50010, "responder_port": 53, "initiator_bytes": 83, "last_seen_epoch": "1575413265.132382", "responder_bytes": 201, "first_seen_epoch": "1575413264.536227" }, { "bytes": 168, "stream": 89, "flow_id": "flow-85d01ee6a4b05f8bee5cec40", "packets": 2, "transport": "udp", "last_frame": 9979, "first_frame": 9898, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 55899, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1575413264.894068", "responder_bytes": 92, "first_seen_epoch": "1575413264.537914" }, { "bytes": 270, "stream": 90, "flow_id": "flow-8baabe14e327909df05dc74e", "packets": 2, "transport": "udp", "last_frame": 9997, "first_frame": 9899, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 53293, "responder_port": 53, "initiator_bytes": 73, "last_seen_epoch": "1575413264.964593", "responder_bytes": 197, "first_seen_epoch": "1575413264.539023" }, { "bytes": 221, "stream": 91, "flow_id": "flow-80d71d686e767589300dc293", "packets": 2, "transport": "udp", "last_frame": 9990, "first_frame": 9900, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 50663, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1575413264.924248", "responder_bytes": 149, "first_seen_epoch": "1575413264.539552" }, { "bytes": 284, "stream": 92, "flow_id": "flow-813f672729847b0aae6ea6dc", "packets": 2, "transport": "udp", "last_frame": 9982, "first_frame": 9907, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 64653, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1575413264.913423", "responder_bytes": 206, "first_seen_epoch": "1575413264.560359" }, { "bytes": 5316, "stream": 229, "flow_id": "flow-e8377a6645d9f5850c00c88c", "packets": 19, "transport": "tcp", "last_frame": 12280, "first_frame": 9935, "initiator_ip": "10.18.20.97", "responder_ip": "104.36.113.23", "initiator_port": 49409, "responder_port": 443, "initiator_bytes": 863, "last_seen_epoch": "1575413302.62919", "responder_bytes": 4453, "first_seen_epoch": "1575413264.716577" }, { "bytes": 13333, "stream": 230, "flow_id": "flow-43a0b24118eb3406eee74b27", "packets": 30, "transport": "tcp", "last_frame": 12272, "first_frame": 9936, "initiator_ip": "10.18.20.97", "responder_ip": "104.36.113.23", "initiator_port": 49410, "responder_port": 443, "initiator_bytes": 1596, "last_seen_epoch": "1575413302.62316", "responder_bytes": 11737, "first_seen_epoch": "1575413264.716659" }, { "bytes": 6703, "stream": 231, "flow_id": "flow-9a1575c13953620ecd7f990b", "packets": 23, "transport": "tcp", "last_frame": 12253, "first_frame": 9955, "initiator_ip": "10.18.20.97", "responder_ip": "34.193.46.35", "initiator_port": 49411, "responder_port": 443, "initiator_bytes": 1924, "last_seen_epoch": "1575413302.615263", "responder_bytes": 4779, "first_seen_epoch": "1575413264.777721" }, { "bytes": 6665, "stream": 232, "flow_id": "flow-bdc73299a0aa97758c468f1d", "packets": 22, "transport": "tcp", "last_frame": 12273, "first_frame": 9966, "initiator_ip": "10.18.20.97", "responder_ip": "34.193.46.35", "initiator_port": 49412, "responder_port": 443, "initiator_bytes": 1886, "last_seen_epoch": "1575413302.6232", "responder_bytes": 4779, "first_seen_epoch": "1575413264.809114" }, { "bytes": 267, "stream": 93, "flow_id": "flow-4131f954e3bcb9878f87c543", "packets": 2, "transport": "udp", "last_frame": 10059, "first_frame": 9973, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 60137, "responder_port": 53, "initiator_bytes": 84, "last_seen_epoch": "1575413265.173234", "responder_bytes": 183, "first_seen_epoch": "1575413264.829744" }, { "bytes": 10075, "stream": 233, "flow_id": "flow-41e1f36c1183f27b35705afd", "packets": 31, "transport": "tcp", "last_frame": 12256, "first_frame": 9975, "initiator_ip": "10.18.20.97", "responder_ip": "52.7.147.140", "initiator_port": 49413, "responder_port": 443, "initiator_bytes": 2357, "last_seen_epoch": "1575413302.615609", "responder_bytes": 7718, "first_seen_epoch": "1575413264.860852" }, { "bytes": 6999, "stream": 234, "flow_id": "flow-07a5e3480f97dba39f005f5a", "packets": 23, "transport": "tcp", "last_frame": 12264, "first_frame": 9976, "initiator_ip": "10.18.20.97", "responder_ip": "52.7.147.140", "initiator_port": 49414, "responder_port": 443, "initiator_bytes": 979, "last_seen_epoch": "1575413302.619312", "responder_bytes": 6020, "first_seen_epoch": "1575413264.861079" }, { "bytes": 8871, "stream": 235, "flow_id": "flow-f41951f6705053c40983de55", "packets": 26, "transport": "tcp", "last_frame": 12198, "first_frame": 9980, "initiator_ip": "10.18.20.97", "responder_ip": "35.186.239.238", "initiator_port": 49415, "responder_port": 443, "initiator_bytes": 1603, "last_seen_epoch": "1575413302.57855", "responder_bytes": 7268, "first_seen_epoch": "1575413264.894692" }, { "bytes": 7135, "stream": 236, "flow_id": "flow-e3d57e96bce69d715a9afa8f", "packets": 21, "transport": "tcp", "last_frame": 12212, "first_frame": 9981, "initiator_ip": "10.18.20.97", "responder_ip": "35.186.239.238", "initiator_port": 49416, "responder_port": 443, "initiator_bytes": 860, "last_seen_epoch": "1575413302.579897", "responder_bytes": 6275, "first_seen_epoch": "1575413264.894759" }, { "bytes": 5882, "stream": 237, "flow_id": "flow-6f5894da90a574d004589e46", "packets": 21, "transport": "tcp", "last_frame": 11720, "first_frame": 9984, "initiator_ip": "10.18.20.97", "responder_ip": "198.8.70.128", "initiator_port": 49418, "responder_port": 443, "initiator_bytes": 1549, "last_seen_epoch": "1575413275.280382", "responder_bytes": 4333, "first_seen_epoch": "1575413264.914116" }, { "bytes": 4354, "stream": 238, "flow_id": "flow-b3f8cac7df555500c461803c", "packets": 16, "transport": "tcp", "last_frame": 11719, "first_frame": 9985, "initiator_ip": "10.18.20.97", "responder_ip": "198.8.70.128", "initiator_port": 49419, "responder_port": 443, "initiator_bytes": 956, "last_seen_epoch": "1575413275.275344", "responder_bytes": 3398, "first_seen_epoch": "1575413264.914171" }, { "bytes": 12085, "stream": 239, "flow_id": "flow-6c19c53f126d7ea0ddb1f592", "packets": 41, "transport": "tcp", "last_frame": 11870, "first_frame": 9986, "initiator_ip": "10.18.20.97", "responder_ip": "35.169.207.73", "initiator_port": 49417, "responder_port": 443, "initiator_bytes": 3956, "last_seen_epoch": "1575413302.488919", "responder_bytes": 8129, "first_seen_epoch": "1575413264.914259" }, { "bytes": 7095, "stream": 240, "flow_id": "flow-40efbf22053b1374f595cda6", "packets": 24, "transport": "tcp", "last_frame": 11872, "first_frame": 9987, "initiator_ip": "10.18.20.97", "responder_ip": "35.169.207.73", "initiator_port": 49420, "responder_port": 443, "initiator_bytes": 1040, "last_seen_epoch": "1575413302.489174", "responder_bytes": 6055, "first_seen_epoch": "1575413264.914306" }, { "bytes": 9888, "stream": 241, "flow_id": "flow-9c984cb58dd7f936b2c51cd1", "packets": 29, "transport": "tcp", "last_frame": 11875, "first_frame": 9991, "initiator_ip": "10.18.20.97", "responder_ip": "173.231.184.20", "initiator_port": 49421, "responder_port": 443, "initiator_bytes": 2384, "last_seen_epoch": "1575413302.489429", "responder_bytes": 7504, "first_seen_epoch": "1575413264.924775" }, { "bytes": 10204, "stream": 242, "flow_id": "flow-0e3a07e86de1f0acda1f80ac", "packets": 31, "transport": "tcp", "last_frame": 11878, "first_frame": 9992, "initiator_ip": "10.18.20.97", "responder_ip": "173.231.184.20", "initiator_port": 49422, "responder_port": 443, "initiator_bytes": 2438, "last_seen_epoch": "1575413302.489764", "responder_bytes": 7766, "first_seen_epoch": "1575413264.924832" }, { "bytes": 8670, "stream": 243, "flow_id": "flow-3b97097f30d84cb775f6e2c0", "packets": 28, "transport": "tcp", "last_frame": 12245, "first_frame": 9998, "initiator_ip": "10.18.20.97", "responder_ip": "185.167.164.42", "initiator_port": 49423, "responder_port": 443, "initiator_bytes": 2235, "last_seen_epoch": "1575413302.608395", "responder_bytes": 6435, "first_seen_epoch": "1575413264.96535" }, { "bytes": 10514, "stream": 244, "flow_id": "flow-fe7aa0bf8502aae3bf52da7f", "packets": 36, "transport": "tcp", "last_frame": 12247, "first_frame": 9999, "initiator_ip": "10.18.20.97", "responder_ip": "185.167.164.42", "initiator_port": 49424, "responder_port": 443, "initiator_bytes": 3133, "last_seen_epoch": "1575413302.61019", "responder_bytes": 7381, "first_seen_epoch": "1575413264.965424" }, { "bytes": 6052, "stream": 245, "flow_id": "flow-7d9a5c568e159234b7ea23e1", "packets": 24, "transport": "tcp", "last_frame": 10905, "first_frame": 10033, "initiator_ip": "10.18.20.97", "responder_ip": "205.180.86.172", "initiator_port": 49425, "responder_port": 443, "initiator_bytes": 1546, "last_seen_epoch": "1575413268.186692", "responder_bytes": 4506, "first_seen_epoch": "1575413265.133174" }, { "bytes": 6020, "stream": 246, "flow_id": "flow-49fca86ff1d93e63d8d5118a", "packets": 24, "transport": "tcp", "last_frame": 11020, "first_frame": 10034, "initiator_ip": "10.18.20.97", "responder_ip": "205.180.86.172", "initiator_port": 49426, "responder_port": 443, "initiator_bytes": 1610, "last_seen_epoch": "1575413268.445115", "responder_bytes": 4410, "first_seen_epoch": "1575413265.133246" }, { "bytes": 9438, "stream": 247, "flow_id": "flow-a99519137e975b91fdef5276", "packets": 27, "transport": "tcp", "last_frame": 12200, "first_frame": 10061, "initiator_ip": "10.18.20.97", "responder_ip": "23.11.217.71", "initiator_port": 49427, "responder_port": 443, "initiator_bytes": 2582, "last_seen_epoch": "1575413302.578869", "responder_bytes": 6856, "first_seen_epoch": "1575413265.174065" }, { "bytes": 9502, "stream": 248, "flow_id": "flow-eb3057b67dca888d60c2bd64", "packets": 27, "transport": "tcp", "last_frame": 12197, "first_frame": 10062, "initiator_ip": "10.18.20.97", "responder_ip": "23.11.217.71", "initiator_port": 49428, "responder_port": 443, "initiator_bytes": 2630, "last_seen_epoch": "1575413302.578472", "responder_bytes": 6872, "first_seen_epoch": "1575413265.174144" }, { "bytes": 9588, "stream": 249, "flow_id": "flow-55326ec6a19f7ab1f9708576", "packets": 28, "transport": "tcp", "last_frame": 12192, "first_frame": 10065, "initiator_ip": "10.18.20.97", "responder_ip": "23.11.217.71", "initiator_port": 49429, "responder_port": 443, "initiator_bytes": 2662, "last_seen_epoch": "1575413302.563668", "responder_bytes": 6926, "first_seen_epoch": "1575413265.174365" }, { "bytes": 4840, "stream": 250, "flow_id": "flow-883612197ea0e774d2bb5ba3", "packets": 18, "transport": "tcp", "last_frame": 12457, "first_frame": 10231, "initiator_ip": "10.18.20.97", "responder_ip": "74.6.138.72", "initiator_port": 49430, "responder_port": 443, "initiator_bytes": 859, "last_seen_epoch": "1575413302.725104", "responder_bytes": 3981, "first_seen_epoch": "1575413265.675867" }, { "bytes": 7139, "stream": 251, "flow_id": "flow-275468b26b03037036b24233", "packets": 20, "transport": "tcp", "last_frame": 10731, "first_frame": 10232, "initiator_ip": "10.18.20.97", "responder_ip": "74.6.138.72", "initiator_port": 49431, "responder_port": 443, "initiator_bytes": 1814, "last_seen_epoch": "1575413267.515051", "responder_bytes": 5325, "first_seen_epoch": "1575413265.675954" }, { "bytes": 170, "stream": 94, "flow_id": "flow-99bf1683de43414746855799", "packets": 2, "transport": "udp", "last_frame": 10537, "first_frame": 10413, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 57603, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1575413266.379122", "responder_bytes": 93, "first_seen_epoch": "1575413265.792188" }, { "bytes": 181, "stream": 95, "flow_id": "flow-7c8efb2d6af0ad1fc1771474", "packets": 2, "transport": "udp", "last_frame": 10536, "first_frame": 10468, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 60198, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1575413266.379001", "responder_bytes": 104, "first_seen_epoch": "1575413265.946223" }, { "bytes": 5450, "stream": 252, "flow_id": "flow-170d32646b0592e2eb7c06cf", "packets": 19, "transport": "tcp", "last_frame": 11863, "first_frame": 10512, "initiator_ip": "10.18.20.97", "responder_ip": "23.11.217.71", "initiator_port": 49432, "responder_port": 443, "initiator_bytes": 900, "last_seen_epoch": "1575413302.488368", "responder_bytes": 4550, "first_seen_epoch": "1575413266.203269" }, { "bytes": 2591, "stream": 253, "flow_id": "flow-fdd7ddedfd46f21279b3dfa2", "packets": 12, "transport": "tcp", "last_frame": 11681, "first_frame": 10538, "initiator_ip": "10.18.20.97", "responder_ip": "91.199.212.52", "initiator_port": 49433, "responder_port": 80, "initiator_bytes": 479, "last_seen_epoch": "1575413273.212838", "responder_bytes": 2112, "first_seen_epoch": "1575413266.380633" }, { "bytes": 2591, "stream": 254, "flow_id": "flow-5360f61abbcc842b283ef65d", "packets": 12, "transport": "tcp", "last_frame": 11691, "first_frame": 10539, "initiator_ip": "10.18.20.97", "responder_ip": "91.199.212.52", "initiator_port": 49434, "responder_port": 80, "initiator_bytes": 479, "last_seen_epoch": "1575413273.541468", "responder_bytes": 2112, "first_seen_epoch": "1575413266.382949" }, { "bytes": 340, "stream": 96, "flow_id": "flow-b26b8d5b730c00cfbe82cab9", "packets": 2, "transport": "udp", "last_frame": 10618, "first_frame": 10540, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 57793, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1575413266.894952", "responder_bytes": 250, "first_seen_epoch": "1575413266.407974" }, { "bytes": 351, "stream": 97, "flow_id": "flow-d45582a63f2cf5f19827f2b3", "packets": 2, "transport": "udp", "last_frame": 10617, "first_frame": 10559, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 60508, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1575413266.894861", "responder_bytes": 261, "first_seen_epoch": "1575413266.470287" }, { "bytes": 5504, "stream": 255, "flow_id": "flow-580bf35b80b7ca578f93c084", "packets": 20, "transport": "tcp", "last_frame": 11866, "first_frame": 10588, "initiator_ip": "10.18.20.97", "responder_ip": "23.11.217.71", "initiator_port": 49435, "responder_port": 443, "initiator_bytes": 954, "last_seen_epoch": "1575413302.488646", "responder_bytes": 4550, "first_seen_epoch": "1575413266.670547" }, { "bytes": 4734, "stream": 256, "flow_id": "flow-f368b15fac4f4f6a6aefc790", "packets": 12, "transport": "tcp", "last_frame": 14790, "first_frame": 10621, "initiator_ip": "10.18.20.97", "responder_ip": "198.70.69.154", "initiator_port": 49436, "responder_port": 80, "initiator_bytes": 764, "last_seen_epoch": "1575413327.736757", "responder_bytes": 3970, "first_seen_epoch": "1575413266.896164" }, { "bytes": 4734, "stream": 257, "flow_id": "flow-2af223602e753e6cd3e09739", "packets": 12, "transport": "tcp", "last_frame": 14791, "first_frame": 10622, "initiator_ip": "10.18.20.97", "responder_ip": "198.70.69.154", "initiator_port": 49437, "responder_port": 80, "initiator_bytes": 764, "last_seen_epoch": "1575413327.736849", "responder_bytes": 3970, "first_seen_epoch": "1575413266.896817" }, { "bytes": 388, "stream": 98, "flow_id": "flow-e0925f99764e415759109d2b", "packets": 2, "transport": "udp", "last_frame": 10815, "first_frame": 10765, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 62108, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1575413267.789823", "responder_bytes": 311, "first_seen_epoch": "1575413267.63509" }, { "bytes": 320, "stream": 99, "flow_id": "flow-59a2d715443303bb781deb1f", "packets": 2, "transport": "udp", "last_frame": 10840, "first_frame": 10777, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 62405, "responder_port": 53, "initiator_bytes": 83, "last_seen_epoch": "1575413267.869627", "responder_bytes": 237, "first_seen_epoch": "1575413267.639995" }, { "bytes": 164, "stream": 100, "flow_id": "flow-de1db3d2aacadfd8cb7dd612", "packets": 2, "transport": "udp", "last_frame": 10847, "first_frame": 10786, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 56729, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1575413267.948443", "responder_bytes": 90, "first_seen_epoch": "1575413267.654094" }, { "bytes": 206, "stream": 101, "flow_id": "flow-2fe54e9a960b4e2d49698e5e", "packets": 2, "transport": "udp", "last_frame": 10850, "first_frame": 10787, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 55032, "responder_port": 53, "initiator_bytes": 84, "last_seen_epoch": "1575413267.965591", "responder_bytes": 122, "first_seen_epoch": "1575413267.655554" }, { "bytes": 288, "stream": 102, "flow_id": "flow-8fc503a80cbf8efc0e2ed30a", "packets": 2, "transport": "udp", "last_frame": 10873, "first_frame": 10790, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 50348, "responder_port": 53, "initiator_bytes": 85, "last_seen_epoch": "1575413268.023538", "responder_bytes": 203, "first_seen_epoch": "1575413267.656198" }, { "bytes": 192, "stream": 103, "flow_id": "flow-d5626ed4c15cad601b5eee48", "packets": 2, "transport": "udp", "last_frame": 10851, "first_frame": 10791, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 64370, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1575413267.965671", "responder_bytes": 120, "first_seen_epoch": "1575413267.658014" }, { "bytes": 166, "stream": 104, "flow_id": "flow-c5672d0906a995d6614200b9", "packets": 2, "transport": "udp", "last_frame": 10858, "first_frame": 10794, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 54449, "responder_port": 53, "initiator_bytes": 75, "last_seen_epoch": "1575413267.969283", "responder_bytes": 91, "first_seen_epoch": "1575413267.660148" }, { "bytes": 288, "stream": 105, "flow_id": "flow-b5ea7af2209c13b5b6fa4312", "packets": 2, "transport": "udp", "last_frame": 10876, "first_frame": 10799, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 65467, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1575413268.026147", "responder_bytes": 208, "first_seen_epoch": "1575413267.663441" }, { "bytes": 277, "stream": 106, "flow_id": "flow-dd2abc6bfa59f4f15d57fbba", "packets": 2, "transport": "udp", "last_frame": 10888, "first_frame": 10802, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 62076, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1575413268.087189", "responder_bytes": 201, "first_seen_epoch": "1575413267.665708" }, { "bytes": 10741, "stream": 258, "flow_id": "flow-5d5a97927080b43c4d0f7c9c", "packets": 34, "transport": "tcp", "last_frame": 12233, "first_frame": 10816, "initiator_ip": "10.18.20.97", "responder_ip": "52.72.249.172", "initiator_port": 49438, "responder_port": 443, "initiator_bytes": 3462, "last_seen_epoch": "1575413302.589387", "responder_bytes": 7279, "first_seen_epoch": "1575413267.790494" }, { "bytes": 5999, "stream": 259, "flow_id": "flow-6697e0ff586f49268cf4ba0a", "packets": 22, "transport": "tcp", "last_frame": 12240, "first_frame": 10817, "initiator_ip": "10.18.20.97", "responder_ip": "52.72.249.172", "initiator_port": 49439, "responder_port": 443, "initiator_bytes": 931, "last_seen_epoch": "1575413302.595564", "responder_bytes": 5068, "first_seen_epoch": "1575413267.790552" }, { "bytes": 227, "stream": 107, "flow_id": "flow-bb833655c64ef7be72adbb2a", "packets": 2, "transport": "udp", "last_frame": 10924, "first_frame": 10824, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 64400, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1575413268.273846", "responder_bytes": 148, "first_seen_epoch": "1575413267.805499" }, { "bytes": 225, "stream": 108, "flow_id": "flow-847a1faf7cc2efbecfddfb0a", "packets": 2, "transport": "udp", "last_frame": 10910, "first_frame": 10829, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 56777, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1575413268.262916", "responder_bytes": 146, "first_seen_epoch": "1575413267.830137" }, { "bytes": 227, "stream": 109, "flow_id": "flow-769eeb613e5ffe242c928a1b", "packets": 2, "transport": "udp", "last_frame": 10931, "first_frame": 10839, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 61050, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1575413268.278653", "responder_bytes": 147, "first_seen_epoch": "1575413267.846641" }, { "bytes": 6449, "stream": 260, "flow_id": "flow-1d26e902e266ae0fb6f3d7d8", "packets": 21, "transport": "tcp", "last_frame": 12185, "first_frame": 10841, "initiator_ip": "10.18.20.97", "responder_ip": "151.101.2.49", "initiator_port": 49440, "responder_port": 443, "initiator_bytes": 937, "last_seen_epoch": "1575413302.559385", "responder_bytes": 5512, "first_seen_epoch": "1575413267.870297" }, { "bytes": 9464, "stream": 261, "flow_id": "flow-a2015c97a2c2cd10c8ee8ab7", "packets": 26, "transport": "tcp", "last_frame": 11469, "first_frame": 10842, "initiator_ip": "10.18.20.97", "responder_ip": "151.101.2.49", "initiator_port": 49441, "responder_port": 443, "initiator_bytes": 2287, "last_seen_epoch": "1575413269.255804", "responder_bytes": 7177, "first_seen_epoch": "1575413267.870366" }, { "bytes": 3883, "stream": 262, "flow_id": "flow-40085a970bae069d10acc6d0", "packets": 20, "transport": "tcp", "last_frame": 11848, "first_frame": 10848, "initiator_ip": "10.18.20.97", "responder_ip": "74.119.118.138", "initiator_port": 49442, "responder_port": 443, "initiator_bytes": 888, "last_seen_epoch": "1575413302.486334", "responder_bytes": 2995, "first_seen_epoch": "1575413267.948962" }, { "bytes": 4953, "stream": 263, "flow_id": "flow-18b0b5540c65d31520f48250", "packets": 23, "transport": "tcp", "last_frame": 11845, "first_frame": 10849, "initiator_ip": "10.18.20.97", "responder_ip": "74.119.118.138", "initiator_port": 49443, "responder_port": 443, "initiator_bytes": 1474, "last_seen_epoch": "1575413302.486006", "responder_bytes": 3479, "first_seen_epoch": "1575413267.949034" }, { "bytes": 4949, "stream": 264, "flow_id": "flow-9bff763e9cd32b52100c9243", "packets": 19, "transport": "tcp", "last_frame": 11842, "first_frame": 10854, "initiator_ip": "10.18.20.97", "responder_ip": "209.15.36.35", "initiator_port": 49444, "responder_port": 443, "initiator_bytes": 884, "last_seen_epoch": "1575413302.485579", "responder_bytes": 4065, "first_seen_epoch": "1575413267.966393" }, { "bytes": 6804, "stream": 265, "flow_id": "flow-922652472168ac8992ab8bad", "packets": 27, "transport": "tcp", "last_frame": 11839, "first_frame": 10855, "initiator_ip": "10.18.20.97", "responder_ip": "209.15.36.35", "initiator_port": 49445, "responder_port": 443, "initiator_bytes": 1942, "last_seen_epoch": "1575413302.485046", "responder_bytes": 4862, "first_seen_epoch": "1575413267.96651" }, { "bytes": 6111, "stream": 266, "flow_id": "flow-79f33d6e2689e5e3417f1631", "packets": 22, "transport": "tcp", "last_frame": 12181, "first_frame": 10856, "initiator_ip": "10.18.20.97", "responder_ip": "169.62.192.207", "initiator_port": 49446, "responder_port": 443, "initiator_bytes": 1443, "last_seen_epoch": "1575413302.557244", "responder_bytes": 4668, "first_seen_epoch": "1575413267.96656" }, { "bytes": 4381, "stream": 267, "flow_id": "flow-1067eb13a96b48914dcf4db2", "packets": 18, "transport": "tcp", "last_frame": 12183, "first_frame": 10857, "initiator_ip": "10.18.20.97", "responder_ip": "169.62.192.207", "initiator_port": 49447, "responder_port": 443, "initiator_bytes": 834, "last_seen_epoch": "1575413302.558969", "responder_bytes": 3547, "first_seen_epoch": "1575413267.966693" }, { "bytes": 9508, "stream": 268, "flow_id": "flow-91a8ee0f3726ba67019569aa", "packets": 29, "transport": "tcp", "last_frame": 12187, "first_frame": 10859, "initiator_ip": "10.18.20.97", "responder_ip": "38.67.14.233", "initiator_port": 49448, "responder_port": 443, "initiator_bytes": 1987, "last_seen_epoch": "1575413302.561212", "responder_bytes": 7521, "first_seen_epoch": "1575413267.969812" }, { "bytes": 6880, "stream": 269, "flow_id": "flow-6d256488fac0d8c9cec107bf", "packets": 21, "transport": "tcp", "last_frame": 12189, "first_frame": 10860, "initiator_ip": "10.18.20.97", "responder_ip": "38.67.14.233", "initiator_port": 49449, "responder_port": 443, "initiator_bytes": 913, "last_seen_epoch": "1575413302.561332", "responder_bytes": 5967, "first_seen_epoch": "1575413267.969865" }, { "bytes": 5924, "stream": 270, "flow_id": "flow-86de04a6d9e69729ce80571f", "packets": 21, "transport": "tcp", "last_frame": 11483, "first_frame": 10874, "initiator_ip": "10.18.20.97", "responder_ip": "205.180.86.172", "initiator_port": 49450, "responder_port": 443, "initiator_bytes": 1408, "last_seen_epoch": "1575413269.274139", "responder_bytes": 4516, "first_seen_epoch": "1575413268.024204" }, { "bytes": 5940, "stream": 271, "flow_id": "flow-694c8062d837bafb4eb37a7f", "packets": 21, "transport": "tcp", "last_frame": 11550, "first_frame": 10875, "initiator_ip": "10.18.20.97", "responder_ip": "205.180.86.172", "initiator_port": 49451, "responder_port": 443, "initiator_bytes": 1472, "last_seen_epoch": "1575413269.661554", "responder_bytes": 4468, "first_seen_epoch": "1575413268.024271" }, { "bytes": 8530, "stream": 272, "flow_id": "flow-0122bcb68d4501a0231d8c96", "packets": 30, "transport": "tcp", "last_frame": 11825, "first_frame": 10877, "initiator_ip": "10.18.20.97", "responder_ip": "34.235.45.38", "initiator_port": 49452, "responder_port": 443, "initiator_bytes": 1769, "last_seen_epoch": "1575413302.482925", "responder_bytes": 6761, "first_seen_epoch": "1575413268.026982" }, { "bytes": 7022, "stream": 273, "flow_id": "flow-36fbd1e2530c2184ff15a0c2", "packets": 23, "transport": "tcp", "last_frame": 11829, "first_frame": 10878, "initiator_ip": "10.18.20.97", "responder_ip": "34.235.45.38", "initiator_port": 49453, "responder_port": 443, "initiator_bytes": 988, "last_seen_epoch": "1575413302.483211", "responder_bytes": 6034, "first_seen_epoch": "1575413268.027064" }, { "bytes": 294, "stream": 110, "flow_id": "flow-b1031d7be7c675a783a23101", "packets": 2, "transport": "udp", "last_frame": 10993, "first_frame": 10887, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 64227, "responder_port": 53, "initiator_bytes": 83, "last_seen_epoch": "1575413268.359202", "responder_bytes": 211, "first_seen_epoch": "1575413268.077678" }, { "bytes": 7037, "stream": 274, "flow_id": "flow-27102812152e66d5eed03829", "packets": 21, "transport": "tcp", "last_frame": 12222, "first_frame": 10889, "initiator_ip": "10.18.20.97", "responder_ip": "54.85.102.186", "initiator_port": 49454, "responder_port": 443, "initiator_bytes": 930, "last_seen_epoch": "1575413302.58108", "responder_bytes": 6107, "first_seen_epoch": "1575413268.087721" }, { "bytes": 8431, "stream": 275, "flow_id": "flow-bf4394b699cee4b3702c7dc0", "packets": 25, "transport": "tcp", "last_frame": 12209, "first_frame": 10890, "initiator_ip": "10.18.20.97", "responder_ip": "54.85.102.186", "initiator_port": 49455, "responder_port": 443, "initiator_bytes": 1459, "last_seen_epoch": "1575413302.579805", "responder_bytes": 6972, "first_seen_epoch": "1575413268.087776" }, { "bytes": 8984, "stream": 276, "flow_id": "flow-a1ecb1e14c656c6dabbdf479", "packets": 27, "transport": "tcp", "last_frame": 12215, "first_frame": 10916, "initiator_ip": "10.18.20.97", "responder_ip": "104.36.113.17", "initiator_port": 49456, "responder_port": 443, "initiator_bytes": 2609, "last_seen_epoch": "1575413302.580016", "responder_bytes": 6375, "first_seen_epoch": "1575413268.263543" }, { "bytes": 9608, "stream": 277, "flow_id": "flow-8cd37c8ab93ec69af9eefd02", "packets": 27, "transport": "tcp", "last_frame": 12213, "first_frame": 10918, "initiator_ip": "10.18.20.97", "responder_ip": "104.36.113.17", "initiator_port": 49457, "responder_port": 443, "initiator_bytes": 2785, "last_seen_epoch": "1575413302.579944", "responder_bytes": 6823, "first_seen_epoch": "1575413268.263665" }, { "bytes": 7378, "stream": 278, "flow_id": "flow-a9b917e9fba9c078a9f5d784", "packets": 25, "transport": "tcp", "last_frame": 12214, "first_frame": 10919, "initiator_ip": "10.18.20.97", "responder_ip": "104.36.113.17", "initiator_port": 49458, "responder_port": 443, "initiator_bytes": 1814, "last_seen_epoch": "1575413302.57998", "responder_bytes": 5564, "first_seen_epoch": "1575413268.263746" }, { "bytes": 6886, "stream": 279, "flow_id": "flow-28f4f302e2b38f9b0d7775e8", "packets": 23, "transport": "tcp", "last_frame": 12228, "first_frame": 10927, "initiator_ip": "10.18.20.97", "responder_ip": "104.36.113.24", "initiator_port": 49459, "responder_port": 443, "initiator_bytes": 1712, "last_seen_epoch": "1575413302.584923", "responder_bytes": 5174, "first_seen_epoch": "1575413268.274693" }, { "bytes": 6746, "stream": 280, "flow_id": "flow-63bec5c69a664e90038aafd9", "packets": 21, "transport": "tcp", "last_frame": 12237, "first_frame": 10928, "initiator_ip": "10.18.20.97", "responder_ip": "104.36.113.24", "initiator_port": 49460, "responder_port": 443, "initiator_bytes": 1572, "last_seen_epoch": "1575413302.589639", "responder_bytes": 5174, "first_seen_epoch": "1575413268.274767" }, { "bytes": 11323, "stream": 281, "flow_id": "flow-242e414342f8849e0542bb83", "packets": 31, "transport": "tcp", "last_frame": 12216, "first_frame": 10932, "initiator_ip": "10.18.20.97", "responder_ip": "104.36.113.17", "initiator_port": 49461, "responder_port": 443, "initiator_bytes": 4035, "last_seen_epoch": "1575413302.580078", "responder_bytes": 7288, "first_seen_epoch": "1575413268.279291" }, { "bytes": 11131, "stream": 282, "flow_id": "flow-0b188a5703a782bdc80d4b21", "packets": 31, "transport": "tcp", "last_frame": 12202, "first_frame": 10933, "initiator_ip": "10.18.20.97", "responder_ip": "104.36.113.17", "initiator_port": 49462, "responder_port": 443, "initiator_bytes": 3555, "last_seen_epoch": "1575413302.579263", "responder_bytes": 7576, "first_seen_epoch": "1575413268.279364" }, { "bytes": 8453, "stream": 283, "flow_id": "flow-2bfa88c5a33f6a50caf4fce1", "packets": 21, "transport": "tcp", "last_frame": 11545, "first_frame": 10934, "initiator_ip": "10.18.20.97", "responder_ip": "104.36.113.17", "initiator_port": 49463, "responder_port": 443, "initiator_bytes": 1723, "last_seen_epoch": "1575413269.632299", "responder_bytes": 6730, "first_seen_epoch": "1575413268.279517" }, { "bytes": 10241, "stream": 284, "flow_id": "flow-15c1436a28f9af9449e60b6a", "packets": 24, "transport": "tcp", "last_frame": 11605, "first_frame": 10935, "initiator_ip": "10.18.20.97", "responder_ip": "104.36.113.17", "initiator_port": 49464, "responder_port": 443, "initiator_bytes": 2550, "last_seen_epoch": "1575413269.874136", "responder_bytes": 7691, "first_seen_epoch": "1575413268.279581" }, { "bytes": 6870, "stream": 285, "flow_id": "flow-9ed1f10278a8e0ce4008ac96", "packets": 23, "transport": "tcp", "last_frame": 12221, "first_frame": 10991, "initiator_ip": "10.18.20.97", "responder_ip": "104.36.113.17", "initiator_port": 49465, "responder_port": 443, "initiator_bytes": 1696, "last_seen_epoch": "1575413302.581032", "responder_bytes": 5174, "first_seen_epoch": "1575413268.347514" }, { "bytes": 8439, "stream": 286, "flow_id": "flow-9858e85a65ceb5cc10399db8", "packets": 28, "transport": "tcp", "last_frame": 11793, "first_frame": 10994, "initiator_ip": "10.18.20.97", "responder_ip": "54.175.88.188", "initiator_port": 49466, "responder_port": 443, "initiator_bytes": 1558, "last_seen_epoch": "1575413302.479541", "responder_bytes": 6881, "first_seen_epoch": "1575413268.360108" }, { "bytes": 6977, "stream": 287, "flow_id": "flow-b33dff88af8c8a9d72a174e0", "packets": 26, "transport": "tcp", "last_frame": 11797, "first_frame": 10995, "initiator_ip": "10.18.20.97", "responder_ip": "54.175.88.188", "initiator_port": 49467, "responder_port": 443, "initiator_bytes": 1099, "last_seen_epoch": "1575413302.48007", "responder_bytes": 5878, "first_seen_epoch": "1575413268.360191" }, { "bytes": 255, "stream": 111, "flow_id": "flow-0321160b8c473558bd6f2de2", "packets": 2, "transport": "udp", "last_frame": 11250, "first_frame": 11021, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 63356, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1575413268.813668", "responder_bytes": 175, "first_seen_epoch": "1575413268.446252" }, { "bytes": 5468, "stream": 288, "flow_id": "flow-e010d21e54c940de714fe9d8", "packets": 20, "transport": "tcp", "last_frame": 11789, "first_frame": 11251, "initiator_ip": "10.18.20.97", "responder_ip": "23.11.217.71", "initiator_port": 49468, "responder_port": 443, "initiator_bytes": 918, "last_seen_epoch": "1575413302.478829", "responder_bytes": 4550, "first_seen_epoch": "1575413268.814309" }, { "bytes": 8030, "stream": 289, "flow_id": "flow-11bedac7cf4ef9dc23f79014", "packets": 24, "transport": "tcp", "last_frame": 12177, "first_frame": 11252, "initiator_ip": "10.18.20.97", "responder_ip": "23.11.217.71", "initiator_port": 49469, "responder_port": 443, "initiator_bytes": 1937, "last_seen_epoch": "1575413302.544039", "responder_bytes": 6093, "first_seen_epoch": "1575413268.814381" }, { "bytes": 4108, "stream": 290, "flow_id": "flow-e969309240093ce37e5e361b", "packets": 21, "transport": "tcp", "last_frame": 12230, "first_frame": 11420, "initiator_ip": "10.18.20.97", "responder_ip": "104.36.113.17", "initiator_port": 49470, "responder_port": 443, "initiator_bytes": 2480, "last_seen_epoch": "1575413302.585052", "responder_bytes": 1628, "first_seen_epoch": "1575413269.167197" }, { "bytes": 1153, "stream": 291, "flow_id": "flow-a24444bbc33abefdbf12744a", "packets": 13, "transport": "tcp", "last_frame": 12218, "first_frame": 11427, "initiator_ip": "10.18.20.97", "responder_ip": "104.36.113.17", "initiator_port": 49471, "responder_port": 443, "initiator_bytes": 658, "last_seen_epoch": "1575413302.580625", "responder_bytes": 495, "first_seen_epoch": "1575413269.170619" }, { "bytes": 3968, "stream": 292, "flow_id": "flow-37f3b4890addaa9f2a769c9e", "packets": 19, "transport": "tcp", "last_frame": 12210, "first_frame": 11438, "initiator_ip": "10.18.20.97", "responder_ip": "104.36.113.17", "initiator_port": 49472, "responder_port": 443, "initiator_bytes": 2458, "last_seen_epoch": "1575413302.579859", "responder_bytes": 1510, "first_seen_epoch": "1575413269.212463" }, { "bytes": 1153, "stream": 293, "flow_id": "flow-b7a2416548ce21149c6a54bf", "packets": 13, "transport": "tcp", "last_frame": 12229, "first_frame": 11490, "initiator_ip": "10.18.20.97", "responder_ip": "104.36.113.17", "initiator_port": 49473, "responder_port": 443, "initiator_bytes": 658, "last_seen_epoch": "1575413302.584983", "responder_bytes": 495, "first_seen_epoch": "1575413269.319611" }, { "bytes": 1154, "stream": 294, "flow_id": "flow-05e369a699ad4487caba3cdb", "packets": 13, "transport": "tcp", "last_frame": 12235, "first_frame": 11546, "initiator_ip": "10.18.20.97", "responder_ip": "104.36.113.17", "initiator_port": 49474, "responder_port": 443, "initiator_bytes": 659, "last_seen_epoch": "1575413302.589442", "responder_bytes": 495, "first_seen_epoch": "1575413269.632846" }, { "bytes": 229, "stream": 112, "flow_id": "flow-925378db68f492bfdddf7264", "packets": 2, "transport": "udp", "last_frame": 11592, "first_frame": 11551, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 52119, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1575413269.831186", "responder_bytes": 149, "first_seen_epoch": "1575413269.662704" }, { "bytes": 7736, "stream": 295, "flow_id": "flow-576c9dabda99d713a699f01c", "packets": 25, "transport": "tcp", "last_frame": 12194, "first_frame": 11594, "initiator_ip": "10.18.20.97", "responder_ip": "104.36.113.24", "initiator_port": 49475, "responder_port": 443, "initiator_bytes": 2455, "last_seen_epoch": "1575413302.564912", "responder_bytes": 5281, "first_seen_epoch": "1575413269.831819" }, { "bytes": 5317, "stream": 296, "flow_id": "flow-3b65b8fe48f8a947cdfc462e", "packets": 19, "transport": "tcp", "last_frame": 12226, "first_frame": 11595, "initiator_ip": "10.18.20.97", "responder_ip": "104.36.113.24", "initiator_port": 49476, "responder_port": 443, "initiator_bytes": 864, "last_seen_epoch": "1575413302.584824", "responder_bytes": 4453, "first_seen_epoch": "1575413269.831887" }, { "bytes": 15713, "stream": 297, "flow_id": "flow-b11e17eb891a256dc66b6c6f", "packets": 37, "transport": "tcp", "last_frame": 15268, "first_frame": 12178, "initiator_ip": "10.18.20.97", "responder_ip": "152.199.6.14", "initiator_port": 49477, "responder_port": 443, "initiator_bytes": 4910, "last_seen_epoch": "1575413386.62139", "responder_bytes": 10803, "first_seen_epoch": "1575413302.548013" }, { "bytes": 6863, "stream": 298, "flow_id": "flow-5ea6edd65df2b6e6931428f2", "packets": 23, "transport": "tcp", "last_frame": 15269, "first_frame": 12179, "initiator_ip": "10.18.20.97", "responder_ip": "152.199.6.14", "initiator_port": 49478, "responder_port": 443, "initiator_bytes": 2170, "last_seen_epoch": "1575413386.621459", "responder_bytes": 4693, "first_seen_epoch": "1575413302.548029" }, { "bytes": 1421, "stream": 299, "flow_id": "flow-809c1896904a6f7fa8deca4f", "packets": 16, "transport": "tcp", "last_frame": 15164, "first_frame": 12539, "initiator_ip": "10.18.20.97", "responder_ip": "34.231.235.125", "initiator_port": 49479, "responder_port": 443, "initiator_bytes": 793, "last_seen_epoch": "1575413385.805223", "responder_bytes": 628, "first_seen_epoch": "1575413304.009571" }, { "bytes": 5947, "stream": 300, "flow_id": "flow-3115498baa151723c74b349b", "packets": 22, "transport": "tcp", "last_frame": 15161, "first_frame": 12540, "initiator_ip": "10.18.20.97", "responder_ip": "34.231.235.125", "initiator_port": 49480, "responder_port": 443, "initiator_bytes": 2352, "last_seen_epoch": "1575413385.804987", "responder_bytes": 3595, "first_seen_epoch": "1575413304.009712" }, { "bytes": 1312, "stream": 301, "flow_id": "flow-e5d70673d5d110a6391ea2c0", "packets": 14, "transport": "tcp", "last_frame": 15147, "first_frame": 12566, "initiator_ip": "10.18.20.97", "responder_ip": "34.204.4.212", "initiator_port": 49481, "responder_port": 443, "initiator_bytes": 738, "last_seen_epoch": "1575413385.802973", "responder_bytes": 574, "first_seen_epoch": "1575413304.556879" }, { "bytes": 3170, "stream": 302, "flow_id": "flow-d47b5ca04dbd79af3f3c0b57", "packets": 18, "transport": "tcp", "last_frame": 15144, "first_frame": 12567, "initiator_ip": "10.18.20.97", "responder_ip": "34.204.4.212", "initiator_port": 49482, "responder_port": 443, "initiator_bytes": 2163, "last_seen_epoch": "1575413385.802756", "responder_bytes": 1007, "first_seen_epoch": "1575413304.556939" }, { "bytes": 13022, "stream": 303, "flow_id": "flow-3fe63f80b20ff3a262b17c98", "packets": 36, "transport": "tcp", "last_frame": 15150, "first_frame": 12568, "initiator_ip": "10.18.20.97", "responder_ip": "76.13.32.137", "initiator_port": 49483, "responder_port": 443, "initiator_bytes": 3369, "last_seen_epoch": "1575413385.803208", "responder_bytes": 9653, "first_seen_epoch": "1575413304.559528" }, { "bytes": 8237, "stream": 304, "flow_id": "flow-6e4663ed5fc41476f0a2dd6c", "packets": 23, "transport": "tcp", "last_frame": 15265, "first_frame": 12569, "initiator_ip": "10.18.20.97", "responder_ip": "76.13.32.137", "initiator_port": 49484, "responder_port": 443, "initiator_bytes": 1013, "last_seen_epoch": "1575413386.537648", "responder_bytes": 7224, "first_seen_epoch": "1575413304.559672" }, { "bytes": 3743, "stream": 305, "flow_id": "flow-9adf3b31a4a1686225d1bf0c", "packets": 18, "transport": "tcp", "last_frame": 15262, "first_frame": 12632, "initiator_ip": "10.18.20.97", "responder_ip": "216.58.193.130", "initiator_port": 49485, "responder_port": 443, "initiator_bytes": 1647, "last_seen_epoch": "1575413386.500872", "responder_bytes": 2096, "first_seen_epoch": "1575413305.160945" }, { "bytes": 3981, "stream": 306, "flow_id": "flow-871e7aa75131fd006b478603", "packets": 18, "transport": "tcp", "last_frame": 15263, "first_frame": 12633, "initiator_ip": "10.18.20.97", "responder_ip": "216.58.193.130", "initiator_port": 49486, "responder_port": 443, "initiator_bytes": 1717, "last_seen_epoch": "1575413386.500929", "responder_bytes": 2264, "first_seen_epoch": "1575413305.161046" }, { "bytes": 7872, "stream": 307, "flow_id": "flow-006dce9530adb42dfea27dae", "packets": 30, "transport": "tcp", "last_frame": 15127, "first_frame": 12634, "initiator_ip": "10.18.20.97", "responder_ip": "54.158.57.141", "initiator_port": 49487, "responder_port": 443, "initiator_bytes": 4446, "last_seen_epoch": "1575413385.801538", "responder_bytes": 3426, "first_seen_epoch": "1575413305.162038" }, { "bytes": 6494, "stream": 308, "flow_id": "flow-2ce39234a3c5139f00d1882b", "packets": 26, "transport": "tcp", "last_frame": 15133, "first_frame": 12635, "initiator_ip": "10.18.20.97", "responder_ip": "54.158.57.141", "initiator_port": 49488, "responder_port": 443, "initiator_bytes": 3805, "last_seen_epoch": "1575413385.801913", "responder_bytes": 2689, "first_seen_epoch": "1575413305.16212" }, { "bytes": 2945, "stream": 309, "flow_id": "flow-85ecbf0657b6c799239574bd", "packets": 17, "transport": "tcp", "last_frame": 15253, "first_frame": 12636, "initiator_ip": "10.18.20.97", "responder_ip": "172.217.1.130", "initiator_port": 49489, "responder_port": 443, "initiator_bytes": 1634, "last_seen_epoch": "1575413386.416557", "responder_bytes": 1311, "first_seen_epoch": "1575413305.162431" }, { "bytes": 1113, "stream": 310, "flow_id": "flow-a58ace300b0a186d051ebf48", "packets": 13, "transport": "tcp", "last_frame": 15255, "first_frame": 12637, "initiator_ip": "10.18.20.97", "responder_ip": "172.217.1.130", "initiator_port": 49490, "responder_port": 443, "initiator_bytes": 642, "last_seen_epoch": "1575413386.421601", "responder_bytes": 471, "first_seen_epoch": "1575413305.162571" }, { "bytes": 3649, "stream": 311, "flow_id": "flow-21c1f7c91d748af9ce0e5d6c", "packets": 17, "transport": "tcp", "last_frame": 15261, "first_frame": 12638, "initiator_ip": "10.18.20.97", "responder_ip": "216.58.193.130", "initiator_port": 49491, "responder_port": 443, "initiator_bytes": 1653, "last_seen_epoch": "1575413386.500813", "responder_bytes": 1996, "first_seen_epoch": "1575413305.162992" }, { "bytes": 3632, "stream": 312, "flow_id": "flow-fc97809811274d5da713c20d", "packets": 17, "transport": "tcp", "last_frame": 15260, "first_frame": 12639, "initiator_ip": "10.18.20.97", "responder_ip": "216.58.193.130", "initiator_port": 49492, "responder_port": 443, "initiator_bytes": 1628, "last_seen_epoch": "1575413386.500731", "responder_bytes": 2004, "first_seen_epoch": "1575413305.16413" }, { "bytes": 3163, "stream": 313, "flow_id": "flow-1b1bfb88bb783b5e9bb0dccc", "packets": 19, "transport": "tcp", "last_frame": 15110, "first_frame": 12640, "initiator_ip": "10.18.20.97", "responder_ip": "54.84.47.220", "initiator_port": 49493, "responder_port": 443, "initiator_bytes": 1446, "last_seen_epoch": "1575413385.800067", "responder_bytes": 1717, "first_seen_epoch": "1575413305.165911" }, { "bytes": 3691, "stream": 314, "flow_id": "flow-badacdefdee68e914ad864cb", "packets": 19, "transport": "tcp", "last_frame": 15112, "first_frame": 12641, "initiator_ip": "10.18.20.97", "responder_ip": "54.84.47.220", "initiator_port": 49494, "responder_port": 443, "initiator_bytes": 1846, "last_seen_epoch": "1575413385.800283", "responder_bytes": 1845, "first_seen_epoch": "1575413305.166151" }, { "bytes": 9454, "stream": 315, "flow_id": "flow-911cec1474cbe8106cdde1ff", "packets": 26, "transport": "tcp", "last_frame": 15251, "first_frame": 12642, "initiator_ip": "10.18.20.97", "responder_ip": "23.11.217.71", "initiator_port": 49495, "responder_port": 443, "initiator_bytes": 2411, "last_seen_epoch": "1575413386.373846", "responder_bytes": 7043, "first_seen_epoch": "1575413305.168229" }, { "bytes": 9192, "stream": 316, "flow_id": "flow-ad250f87fd00532c3c5f1eec", "packets": 25, "transport": "tcp", "last_frame": 15248, "first_frame": 12643, "initiator_ip": "10.18.20.97", "responder_ip": "23.11.217.71", "initiator_port": 49496, "responder_port": 443, "initiator_bytes": 2411, "last_seen_epoch": "1575413386.370063", "responder_bytes": 6781, "first_seen_epoch": "1575413305.168399" }, { "bytes": 4410, "stream": 317, "flow_id": "flow-7aa1f6765ffb185fefeda7c6", "packets": 18, "transport": "tcp", "last_frame": 15104, "first_frame": 12644, "initiator_ip": "10.18.20.97", "responder_ip": "216.200.232.221", "initiator_port": 49497, "responder_port": 443, "initiator_bytes": 838, "last_seen_epoch": "1575413385.799543", "responder_bytes": 3572, "first_seen_epoch": "1575413305.17072" }, { "bytes": 6215, "stream": 318, "flow_id": "flow-1b7c005ce912942a1d2c2a25", "packets": 22, "transport": "tcp", "last_frame": 15246, "first_frame": 12645, "initiator_ip": "10.18.20.97", "responder_ip": "216.200.232.221", "initiator_port": 49498, "responder_port": 443, "initiator_bytes": 2055, "last_seen_epoch": "1575413386.355459", "responder_bytes": 4160, "first_seen_epoch": "1575413305.170898" }, { "bytes": 4716, "stream": 319, "flow_id": "flow-08cdd20d4dc9fac131592d04", "packets": 19, "transport": "tcp", "last_frame": 15100, "first_frame": 12646, "initiator_ip": "10.18.20.97", "responder_ip": "50.116.194.21", "initiator_port": 49499, "responder_port": 443, "initiator_bytes": 1051, "last_seen_epoch": "1575413385.799191", "responder_bytes": 3665, "first_seen_epoch": "1575413305.171121" }, { "bytes": 6165, "stream": 320, "flow_id": "flow-29db66f6903d237ffaae4f27", "packets": 25, "transport": "tcp", "last_frame": 15097, "first_frame": 12647, "initiator_ip": "10.18.20.97", "responder_ip": "50.116.194.21", "initiator_port": 49500, "responder_port": 443, "initiator_bytes": 2015, "last_seen_epoch": "1575413385.798949", "responder_bytes": 4150, "first_seen_epoch": "1575413305.171275" }, { "bytes": 11339, "stream": 321, "flow_id": "flow-7fd77da1311fa435569404f2", "packets": 32, "transport": "tcp", "last_frame": 15092, "first_frame": 12648, "initiator_ip": "10.18.20.97", "responder_ip": "35.211.144.153", "initiator_port": 49501, "responder_port": 443, "initiator_bytes": 3151, "last_seen_epoch": "1575413385.798484", "responder_bytes": 8188, "first_seen_epoch": "1575413305.171484" }, { "bytes": 7987, "stream": 322, "flow_id": "flow-28a6562b5b7ae937a5a28b28", "packets": 26, "transport": "tcp", "last_frame": 15095, "first_frame": 12649, "initiator_ip": "10.18.20.97", "responder_ip": "35.211.144.153", "initiator_port": 49502, "responder_port": 443, "initiator_bytes": 1123, "last_seen_epoch": "1575413385.798707", "responder_bytes": 6864, "first_seen_epoch": "1575413305.171623" }, { "bytes": 1177, "stream": 323, "flow_id": "flow-82c91f07ce3cca0b4e9b9e2e", "packets": 14, "transport": "tcp", "last_frame": 15089, "first_frame": 12650, "initiator_ip": "10.18.20.97", "responder_ip": "104.254.149.101", "initiator_port": 49503, "responder_port": 443, "initiator_bytes": 681, "last_seen_epoch": "1575413385.798239", "responder_bytes": 496, "first_seen_epoch": "1575413305.176335" }, { "bytes": 3304, "stream": 324, "flow_id": "flow-f51db8ddf0a96e15c4fce8f0", "packets": 20, "transport": "tcp", "last_frame": 15086, "first_frame": 12651, "initiator_ip": "10.18.20.97", "responder_ip": "104.254.149.101", "initiator_port": 49504, "responder_port": 443, "initiator_bytes": 1712, "last_seen_epoch": "1575413385.798007", "responder_bytes": 1592, "first_seen_epoch": "1575413305.176462" }, { "bytes": 5103, "stream": 325, "flow_id": "flow-b2f3abfeafffdd34c4a906b7", "packets": 22, "transport": "tcp", "last_frame": 15083, "first_frame": 12652, "initiator_ip": "10.18.20.97", "responder_ip": "192.184.69.225", "initiator_port": 49505, "responder_port": 443, "initiator_bytes": 1020, "last_seen_epoch": "1575413385.797708", "responder_bytes": 4083, "first_seen_epoch": "1575413305.177829" }, { "bytes": 6641, "stream": 326, "flow_id": "flow-379914b43dda628d6c2d6cfe", "packets": 26, "transport": "tcp", "last_frame": 15080, "first_frame": 12653, "initiator_ip": "10.18.20.97", "responder_ip": "192.184.69.225", "initiator_port": 49506, "responder_port": 443, "initiator_bytes": 2029, "last_seen_epoch": "1575413385.797438", "responder_bytes": 4612, "first_seen_epoch": "1575413305.177964" }, { "bytes": 9844, "stream": 327, "flow_id": "flow-3c198afdedb2f6baa565276b", "packets": 27, "transport": "tcp", "last_frame": 15242, "first_frame": 12654, "initiator_ip": "10.18.20.97", "responder_ip": "104.36.113.23", "initiator_port": 49507, "responder_port": 443, "initiator_bytes": 3089, "last_seen_epoch": "1575413386.279924", "responder_bytes": 6755, "first_seen_epoch": "1575413305.210933" }, { "bytes": 1153, "stream": 328, "flow_id": "flow-08075eafcd666f9fab7c1689", "packets": 13, "transport": "tcp", "last_frame": 15244, "first_frame": 12655, "initiator_ip": "10.18.20.97", "responder_ip": "104.36.113.23", "initiator_port": 49508, "responder_port": 443, "initiator_bytes": 658, "last_seen_epoch": "1575413386.289835", "responder_bytes": 495, "first_seen_epoch": "1575413305.211163" }, { "bytes": 265, "stream": 113, "flow_id": "flow-e5d65887aecdf3edd3fe81d6", "packets": 2, "transport": "udp", "last_frame": 12768, "first_frame": 12656, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 50223, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1575413305.326272", "responder_bytes": 193, "first_seen_epoch": "1575413305.238225" }, { "bytes": 276, "stream": 114, "flow_id": "flow-795bba44979752f4d30a529c", "packets": 2, "transport": "udp", "last_frame": 12765, "first_frame": 12657, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 58606, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1575413305.326078", "responder_bytes": 204, "first_seen_epoch": "1575413305.239167" }, { "bytes": 276, "stream": 115, "flow_id": "flow-ac03f1a862dd116af6dbae90", "packets": 2, "transport": "udp", "last_frame": 12766, "first_frame": 12662, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 50161, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1575413305.32616", "responder_bytes": 204, "first_seen_epoch": "1575413305.242542" }, { "bytes": 276, "stream": 116, "flow_id": "flow-cd869adf6ce67ce18b1e8890", "packets": 2, "transport": "udp", "last_frame": 12767, "first_frame": 12663, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 60490, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1575413305.326217", "responder_bytes": 204, "first_seen_epoch": "1575413305.243188" }, { "bytes": 247, "stream": 117, "flow_id": "flow-9f7d13aed36586457caca4fe", "packets": 2, "transport": "udp", "last_frame": 12826, "first_frame": 12700, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 64166, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1575413305.449366", "responder_bytes": 171, "first_seen_epoch": "1575413305.285884" }, { "bytes": 1426, "stream": 329, "flow_id": "flow-424ed65cd75303bf97941837", "packets": 11, "transport": "tcp", "last_frame": 15278, "first_frame": 12833, "initiator_ip": "10.18.20.97", "responder_ip": "104.69.23.209", "initiator_port": 49509, "responder_port": 80, "initiator_bytes": 716, "last_seen_epoch": "1575413390.745972", "responder_bytes": 710, "first_seen_epoch": "1575413305.452503" }, { "bytes": 340, "stream": 330, "flow_id": "flow-147690d12fec59d37b952288", "packets": 6, "transport": "tcp", "last_frame": 15279, "first_frame": 12838, "initiator_ip": "10.18.20.97", "responder_ip": "104.69.23.209", "initiator_port": 49510, "responder_port": 80, "initiator_bytes": 174, "last_seen_epoch": "1575413390.74934", "responder_bytes": 166, "first_seen_epoch": "1575413305.459607" }, { "bytes": 3018, "stream": 331, "flow_id": "flow-323c1eff425f669dc1762557", "packets": 18, "transport": "tcp", "last_frame": 15130, "first_frame": 12942, "initiator_ip": "10.18.20.97", "responder_ip": "54.158.57.141", "initiator_port": 49511, "responder_port": 443, "initiator_bytes": 1755, "last_seen_epoch": "1575413385.801755", "responder_bytes": 1263, "first_seen_epoch": "1575413305.657061" }, { "bytes": 8561, "stream": 332, "flow_id": "flow-0cacc68643c0b0bcdfa67cd3", "packets": 29, "transport": "tcp", "last_frame": 15077, "first_frame": 12963, "initiator_ip": "10.18.20.97", "responder_ip": "74.6.138.75", "initiator_port": 49512, "responder_port": 443, "initiator_bytes": 3031, "last_seen_epoch": "1575413385.797195", "responder_bytes": 5530, "first_seen_epoch": "1575413305.718148" }, { "bytes": 6933, "stream": 333, "flow_id": "flow-2266cbc9c1e8bcc96e83aa4a", "packets": 26, "transport": "tcp", "last_frame": 15075, "first_frame": 12964, "initiator_ip": "10.18.20.97", "responder_ip": "74.6.138.75", "initiator_port": 49513, "responder_port": 443, "initiator_bytes": 2076, "last_seen_epoch": "1575413385.796955", "responder_bytes": 4857, "first_seen_epoch": "1575413305.718217" }, { "bytes": 2970, "stream": 334, "flow_id": "flow-c946389b91f8c66312e31f6b", "packets": 18, "transport": "tcp", "last_frame": 15124, "first_frame": 12972, "initiator_ip": "10.18.20.97", "responder_ip": "54.158.57.141", "initiator_port": 49514, "responder_port": 443, "initiator_bytes": 1723, "last_seen_epoch": "1575413385.801323", "responder_bytes": 1247, "first_seen_epoch": "1575413305.764191" }, { "bytes": 6494, "stream": 335, "flow_id": "flow-cbe0de083a1618d0b56d0d8a", "packets": 26, "transport": "tcp", "last_frame": 15118, "first_frame": 12991, "initiator_ip": "10.18.20.97", "responder_ip": "54.158.57.141", "initiator_port": 49515, "responder_port": 443, "initiator_bytes": 3751, "last_seen_epoch": "1575413385.800844", "responder_bytes": 2743, "first_seen_epoch": "1575413305.853806" }, { "bytes": 4482, "stream": 336, "flow_id": "flow-95eb1848f38391b54343a161", "packets": 23, "transport": "tcp", "last_frame": 15121, "first_frame": 12994, "initiator_ip": "10.18.20.97", "responder_ip": "54.158.57.141", "initiator_port": 49516, "responder_port": 443, "initiator_bytes": 2460, "last_seen_epoch": "1575413385.801101", "responder_bytes": 2022, "first_seen_epoch": "1575413305.896205" }, { "bytes": 8856, "stream": 337, "flow_id": "flow-1035f330a92404faba4ec2ef", "packets": 22, "transport": "tcp", "last_frame": 14905, "first_frame": 12997, "initiator_ip": "10.18.20.97", "responder_ip": "204.79.197.200", "initiator_port": 49517, "responder_port": 443, "initiator_bytes": 1347, "last_seen_epoch": "1575413371.55069", "responder_bytes": 7509, "first_seen_epoch": "1575413305.911535" }, { "bytes": 6989, "stream": 338, "flow_id": "flow-b8efa67f4788fd513a78dc17", "packets": 20, "transport": "tcp", "last_frame": 15276, "first_frame": 12998, "initiator_ip": "10.18.20.97", "responder_ip": "204.79.197.200", "initiator_port": 49518, "responder_port": 443, "initiator_bytes": 872, "last_seen_epoch": "1575413390.736396", "responder_bytes": 6117, "first_seen_epoch": "1575413305.9116" }, { "bytes": 9336, "stream": 339, "flow_id": "flow-66249f7ab359597ccb64d6e5", "packets": 31, "transport": "tcp", "last_frame": 15065, "first_frame": 13003, "initiator_ip": "10.18.20.97", "responder_ip": "34.193.46.35", "initiator_port": 49519, "responder_port": 443, "initiator_bytes": 4928, "last_seen_epoch": "1575413385.795979", "responder_bytes": 4408, "first_seen_epoch": "1575413305.916919" }, { "bytes": 11572, "stream": 340, "flow_id": "flow-bbfc2ae69735ea1561fec8de", "packets": 34, "transport": "tcp", "last_frame": 15060, "first_frame": 13004, "initiator_ip": "10.18.20.97", "responder_ip": "34.193.46.35", "initiator_port": 49520, "responder_port": 443, "initiator_bytes": 6411, "last_seen_epoch": "1575413385.795513", "responder_bytes": 5161, "first_seen_epoch": "1575413305.916974" }, { "bytes": 3076, "stream": 341, "flow_id": "flow-038595a6d7be5a423418745c", "packets": 20, "transport": "tcp", "last_frame": 15052, "first_frame": 13019, "initiator_ip": "10.18.20.97", "responder_ip": "52.7.147.140", "initiator_port": 49521, "responder_port": 443, "initiator_bytes": 1511, "last_seen_epoch": "1575413385.794666", "responder_bytes": 1565, "first_seen_epoch": "1575413305.962359" }, { "bytes": 1356, "stream": 342, "flow_id": "flow-25e9a119a79c6b07ef64fca5", "packets": 15, "transport": "tcp", "last_frame": 15054, "first_frame": 13020, "initiator_ip": "10.18.20.97", "responder_ip": "52.7.147.140", "initiator_port": 49522, "responder_port": 443, "initiator_bytes": 720, "last_seen_epoch": "1575413385.794913", "responder_bytes": 636, "first_seen_epoch": "1575413305.962492" }, { "bytes": 235, "stream": 118, "flow_id": "flow-d959f75704450298b9cea705", "packets": 2, "transport": "udp", "last_frame": 13081, "first_frame": 13021, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 51267, "responder_port": 53, "initiator_bytes": 84, "last_seen_epoch": "1575413306.074332", "responder_bytes": 151, "first_seen_epoch": "1575413305.963396" }, { "bytes": 2327, "stream": 343, "flow_id": "flow-4e10e05ffb3385c2883f42a7", "packets": 17, "transport": "tcp", "last_frame": 15240, "first_frame": 13022, "initiator_ip": "10.18.20.97", "responder_ip": "185.167.164.42", "initiator_port": 49523, "responder_port": 443, "initiator_bytes": 1245, "last_seen_epoch": "1575413386.269891", "responder_bytes": 1082, "first_seen_epoch": "1575413305.963898" }, { "bytes": 244, "stream": 119, "flow_id": "flow-be68f6f5f87acde6bda92515", "packets": 2, "transport": "udp", "last_frame": 13113, "first_frame": 13023, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 59061, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1575413306.103126", "responder_bytes": 172, "first_seen_epoch": "1575413305.964081" }, { "bytes": 2231, "stream": 344, "flow_id": "flow-87a920072e87ba0392246c33", "packets": 17, "transport": "tcp", "last_frame": 15236, "first_frame": 13024, "initiator_ip": "10.18.20.97", "responder_ip": "185.167.164.42", "initiator_port": 49524, "responder_port": 443, "initiator_bytes": 1245, "last_seen_epoch": "1575413386.245104", "responder_bytes": 986, "first_seen_epoch": "1575413305.96414" }, { "bytes": 8804, "stream": 345, "flow_id": "flow-e923629d33c6e40002b49d4c", "packets": 26, "transport": "tcp", "last_frame": 15038, "first_frame": 13025, "initiator_ip": "10.18.20.97", "responder_ip": "173.231.184.20", "initiator_port": 49525, "responder_port": 443, "initiator_bytes": 1813, "last_seen_epoch": "1575413385.7934", "responder_bytes": 6991, "first_seen_epoch": "1575413305.964821" }, { "bytes": 8752, "stream": 346, "flow_id": "flow-4310069b7814dc9c8f2355bd", "packets": 28, "transport": "tcp", "last_frame": 15041, "first_frame": 13026, "initiator_ip": "10.18.20.97", "responder_ip": "173.231.184.20", "initiator_port": 49526, "responder_port": 443, "initiator_bytes": 1947, "last_seen_epoch": "1575413385.793671", "responder_bytes": 6805, "first_seen_epoch": "1575413305.964935" }, { "bytes": 230, "stream": 120, "flow_id": "flow-5ca80f740035ee2fd8caf80e", "packets": 2, "transport": "udp", "last_frame": 13146, "first_frame": 13057, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 62681, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1575413306.126479", "responder_bytes": 154, "first_seen_epoch": "1575413306.033399" }, { "bytes": 4932, "stream": 347, "flow_id": "flow-a0e2c59bd0cbfa08d860d3e6", "packets": 23, "transport": "tcp", "last_frame": 15070, "first_frame": 13080, "initiator_ip": "10.18.20.97", "responder_ip": "34.193.46.35", "initiator_port": 49527, "responder_port": 443, "initiator_bytes": 2718, "last_seen_epoch": "1575413385.796484", "responder_bytes": 2214, "first_seen_epoch": "1575413306.071894" }, { "bytes": 6622, "stream": 348, "flow_id": "flow-3d9327873f36d1274d4f4592", "packets": 18, "transport": "tcp", "last_frame": 14772, "first_frame": 13082, "initiator_ip": "10.18.20.97", "responder_ip": "104.193.80.60", "initiator_port": 49528, "responder_port": 443, "initiator_bytes": 830, "last_seen_epoch": "1575413316.176788", "responder_bytes": 5792, "first_seen_epoch": "1575413306.075164" }, { "bytes": 7632, "stream": 349, "flow_id": "flow-0c68da340c3d3ce218444d25", "packets": 22, "transport": "tcp", "last_frame": 14773, "first_frame": 13083, "initiator_ip": "10.18.20.97", "responder_ip": "104.193.80.60", "initiator_port": 49529, "responder_port": 443, "initiator_bytes": 1423, "last_seen_epoch": "1575413316.185149", "responder_bytes": 6209, "first_seen_epoch": "1575413306.07523" }, { "bytes": 7360, "stream": 350, "flow_id": "flow-39111708de7a48f0d8cb669c", "packets": 26, "transport": "tcp", "last_frame": 15068, "first_frame": 13098, "initiator_ip": "10.18.20.97", "responder_ip": "34.193.46.35", "initiator_port": 49530, "responder_port": 443, "initiator_bytes": 4223, "last_seen_epoch": "1575413385.796247", "responder_bytes": 3137, "first_seen_epoch": "1575413306.086904" }, { "bytes": 8125, "stream": 351, "flow_id": "flow-29cdad72eb75c9dda96f2b13", "packets": 27, "transport": "tcp", "last_frame": 15004, "first_frame": 13114, "initiator_ip": "10.18.20.97", "responder_ip": "54.82.194.252", "initiator_port": 49531, "responder_port": 443, "initiator_bytes": 1573, "last_seen_epoch": "1575413385.78978", "responder_bytes": 6552, "first_seen_epoch": "1575413306.10387" }, { "bytes": 7013, "stream": 352, "flow_id": "flow-7fe07e6dff92b2f7318f298a", "packets": 22, "transport": "tcp", "last_frame": 15007, "first_frame": 13115, "initiator_ip": "10.18.20.97", "responder_ip": "54.82.194.252", "initiator_port": 49532, "responder_port": 443, "initiator_bytes": 980, "last_seen_epoch": "1575413385.790057", "responder_bytes": 6033, "first_seen_epoch": "1575413306.103936" }, { "bytes": 12306, "stream": 353, "flow_id": "flow-1b97221ff78a99a5f354e907", "packets": 31, "transport": "tcp", "last_frame": 15202, "first_frame": 13149, "initiator_ip": "10.18.20.97", "responder_ip": "35.207.24.140", "initiator_port": 49533, "responder_port": 443, "initiator_bytes": 2986, "last_seen_epoch": "1575413386.111724", "responder_bytes": 9320, "first_seen_epoch": "1575413306.126971" }, { "bytes": 8542, "stream": 354, "flow_id": "flow-eeda5a441fc8106b47630f55", "packets": 23, "transport": "tcp", "last_frame": 15204, "first_frame": 13164, "initiator_ip": "10.18.20.97", "responder_ip": "35.207.24.140", "initiator_port": 49534, "responder_port": 443, "initiator_bytes": 968, "last_seen_epoch": "1575413386.139295", "responder_bytes": 7574, "first_seen_epoch": "1575413306.128987" }, { "bytes": 241, "stream": 121, "flow_id": "flow-df83f27048a1353a8e8c7599", "packets": 2, "transport": "udp", "last_frame": 13263, "first_frame": 13170, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 60211, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1575413306.258315", "responder_bytes": 167, "first_seen_epoch": "1575413306.13597" }, { "bytes": 158, "stream": 122, "flow_id": "flow-26d23100ff84300a659f5e77", "packets": 2, "transport": "udp", "last_frame": 13288, "first_frame": 13182, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 58735, "responder_port": 53, "initiator_bytes": 71, "last_seen_epoch": "1575413306.271668", "responder_bytes": 87, "first_seen_epoch": "1575413306.139497" }, { "bytes": 253, "stream": 123, "flow_id": "flow-f511874f2ded4c24959dfe8b", "packets": 2, "transport": "udp", "last_frame": 13306, "first_frame": 13183, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 50747, "responder_port": 53, "initiator_bytes": 75, "last_seen_epoch": "1575413306.28879", "responder_bytes": 178, "first_seen_epoch": "1575413306.141232" }, { "bytes": 296, "stream": 124, "flow_id": "flow-837dea380710aa2f9cb77083", "packets": 2, "transport": "udp", "last_frame": 13357, "first_frame": 13184, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 52515, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1575413306.307779", "responder_bytes": 218, "first_seen_epoch": "1575413306.142255" }, { "bytes": 8631, "stream": 355, "flow_id": "flow-104e2b9aead8d4392bf64ca4", "packets": 26, "transport": "tcp", "last_frame": 15234, "first_frame": 13187, "initiator_ip": "10.18.20.97", "responder_ip": "35.186.239.238", "initiator_port": 49535, "responder_port": 443, "initiator_bytes": 1475, "last_seen_epoch": "1575413386.231581", "responder_bytes": 7156, "first_seen_epoch": "1575413306.14455" }, { "bytes": 7221, "stream": 356, "flow_id": "flow-19d440356b009ad2599aecfa", "packets": 22, "transport": "tcp", "last_frame": 15238, "first_frame": 13188, "initiator_ip": "10.18.20.97", "responder_ip": "35.186.239.238", "initiator_port": 49536, "responder_port": 443, "initiator_bytes": 946, "last_seen_epoch": "1575413386.246934", "responder_bytes": 6275, "first_seen_epoch": "1575413306.144686" }, { "bytes": 245, "stream": 125, "flow_id": "flow-14e9b0ad0222ef1807430391", "packets": 2, "transport": "udp", "last_frame": 13293, "first_frame": 13190, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 51450, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1575413306.272141", "responder_bytes": 165, "first_seen_epoch": "1575413306.147638" }, { "bytes": 2361, "stream": 357, "flow_id": "flow-6773fc2c12fb6aec69a3d023", "packets": 20, "transport": "tcp", "last_frame": 15155, "first_frame": 13191, "initiator_ip": "10.18.20.97", "responder_ip": "52.54.122.125", "initiator_port": 49537, "responder_port": 443, "initiator_bytes": 1308, "last_seen_epoch": "1575413385.803692", "responder_bytes": 1053, "first_seen_epoch": "1575413306.148704" }, { "bytes": 2425, "stream": 358, "flow_id": "flow-449afa2bbba6013c967bbf6f", "packets": 20, "transport": "tcp", "last_frame": 15158, "first_frame": 13192, "initiator_ip": "10.18.20.97", "responder_ip": "52.54.122.125", "initiator_port": 49538, "responder_port": 443, "initiator_bytes": 1292, "last_seen_epoch": "1575413385.803951", "responder_bytes": 1133, "first_seen_epoch": "1575413306.148829" }, { "bytes": 269, "stream": 126, "flow_id": "flow-7b58754d3c3f65c81a159e70", "packets": 2, "transport": "udp", "last_frame": 13408, "first_frame": 13193, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 56959, "responder_port": 53, "initiator_bytes": 73, "last_seen_epoch": "1575413306.386965", "responder_bytes": 196, "first_seen_epoch": "1575413306.150408" }, { "bytes": 229, "stream": 127, "flow_id": "flow-3819346686af4faa01168d23", "packets": 2, "transport": "udp", "last_frame": 13285, "first_frame": 13194, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 53999, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1575413306.270237", "responder_bytes": 151, "first_seen_epoch": "1575413306.15221" }, { "bytes": 166, "stream": 128, "flow_id": "flow-641ef68a9f0c358db3cec89d", "packets": 2, "transport": "udp", "last_frame": 13344, "first_frame": 13195, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 50366, "responder_port": 53, "initiator_bytes": 75, "last_seen_epoch": "1575413306.297988", "responder_bytes": 91, "first_seen_epoch": "1575413306.154087" }, { "bytes": 10796, "stream": 359, "flow_id": "flow-6b234f4f4ced67d83824d5e0", "packets": 31, "transport": "tcp", "last_frame": 15218, "first_frame": 13196, "initiator_ip": "10.18.20.97", "responder_ip": "104.36.113.17", "initiator_port": 49539, "responder_port": 443, "initiator_bytes": 7512, "last_seen_epoch": "1575413386.197996", "responder_bytes": 3284, "first_seen_epoch": "1575413306.154938" }, { "bytes": 12585, "stream": 360, "flow_id": "flow-f83aa92f505fa0292ab29c1e", "packets": 35, "transport": "tcp", "last_frame": 15212, "first_frame": 13197, "initiator_ip": "10.18.20.97", "responder_ip": "104.36.113.17", "initiator_port": 49540, "responder_port": 443, "initiator_bytes": 7844, "last_seen_epoch": "1575413386.185754", "responder_bytes": 4741, "first_seen_epoch": "1575413306.155077" }, { "bytes": 2968, "stream": 361, "flow_id": "flow-d0a2fd6b4ea5114950bcad1a", "packets": 17, "transport": "tcp", "last_frame": 15223, "first_frame": 13198, "initiator_ip": "10.18.20.97", "responder_ip": "52.72.249.172", "initiator_port": 49541, "responder_port": 443, "initiator_bytes": 1649, "last_seen_epoch": "1575413386.20065", "responder_bytes": 1319, "first_seen_epoch": "1575413306.156656" }, { "bytes": 2392, "stream": 362, "flow_id": "flow-c332086bf1082ef98a59c61c", "packets": 17, "transport": "tcp", "last_frame": 15228, "first_frame": 13199, "initiator_ip": "10.18.20.97", "responder_ip": "52.72.249.172", "initiator_port": 49542, "responder_port": 443, "initiator_bytes": 1297, "last_seen_epoch": "1575413386.205888", "responder_bytes": 1095, "first_seen_epoch": "1575413306.156786" }, { "bytes": 245, "stream": 129, "flow_id": "flow-a0a8c58d852c8bcd4d5375c1", "packets": 2, "transport": "udp", "last_frame": 13307, "first_frame": 13200, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 52870, "responder_port": 53, "initiator_bytes": 89, "last_seen_epoch": "1575413306.288918", "responder_bytes": 156, "first_seen_epoch": "1575413306.15822" }, { "bytes": 164, "stream": 130, "flow_id": "flow-ebff4591e46ed260720b2a4f", "packets": 2, "transport": "udp", "last_frame": 13311, "first_frame": 13201, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 51349, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1575413306.289844", "responder_bytes": 90, "first_seen_epoch": "1575413306.159653" }, { "bytes": 5204, "stream": 363, "flow_id": "flow-cdecde368eeecf0cfb4872a2", "packets": 23, "transport": "tcp", "last_frame": 15062, "first_frame": 13214, "initiator_ip": "10.18.20.97", "responder_ip": "34.193.46.35", "initiator_port": 49543, "responder_port": 443, "initiator_bytes": 2734, "last_seen_epoch": "1575413385.79575", "responder_bytes": 2470, "first_seen_epoch": "1575413306.180951" }, { "bytes": 3458, "stream": 364, "flow_id": "flow-35e5e47dac7a4dc3793044f8", "packets": 19, "transport": "tcp", "last_frame": 15072, "first_frame": 13237, "initiator_ip": "10.18.20.97", "responder_ip": "34.193.46.35", "initiator_port": 49544, "responder_port": 443, "initiator_bytes": 1901, "last_seen_epoch": "1575413385.796712", "responder_bytes": 1557, "first_seen_epoch": "1575413306.222798" }, { "bytes": 6430, "stream": 365, "flow_id": "flow-5de3963e742898b64c29a3e8", "packets": 24, "transport": "tcp", "last_frame": 15200, "first_frame": 13267, "initiator_ip": "10.18.20.97", "responder_ip": "23.67.120.135", "initiator_port": 49545, "responder_port": 443, "initiator_bytes": 1435, "last_seen_epoch": "1575413386.090759", "responder_bytes": 4995, "first_seen_epoch": "1575413306.259265" }, { "bytes": 6190, "stream": 366, "flow_id": "flow-50f9a505315d84502e9dc7aa", "packets": 24, "transport": "tcp", "last_frame": 15197, "first_frame": 13268, "initiator_ip": "10.18.20.97", "responder_ip": "23.67.120.135", "initiator_port": 49546, "responder_port": 443, "initiator_bytes": 1563, "last_seen_epoch": "1575413386.075183", "responder_bytes": 4627, "first_seen_epoch": "1575413306.259481" }, { "bytes": 6349, "stream": 367, "flow_id": "flow-32f5838add040cd9172179d5", "packets": 24, "transport": "tcp", "last_frame": 14967, "first_frame": 13286, "initiator_ip": "10.18.20.97", "responder_ip": "70.42.32.63", "initiator_port": 49547, "responder_port": 443, "initiator_bytes": 1509, "last_seen_epoch": "1575413385.785968", "responder_bytes": 4840, "first_seen_epoch": "1575413306.270835" }, { "bytes": 4907, "stream": 368, "flow_id": "flow-8db580b83fce2374c10dc046", "packets": 20, "transport": "tcp", "last_frame": 14970, "first_frame": 13287, "initiator_ip": "10.18.20.97", "responder_ip": "70.42.32.63", "initiator_port": 49548, "responder_port": 443, "initiator_bytes": 916, "last_seen_epoch": "1575413385.78617", "responder_bytes": 3991, "first_seen_epoch": "1575413306.270889" }, { "bytes": 7762, "stream": 369, "flow_id": "flow-a287c93fc5a4e0b6515c18fc", "packets": 21, "transport": "tcp", "last_frame": 14767, "first_frame": 13292, "initiator_ip": "10.18.20.97", "responder_ip": "8.41.222.150", "initiator_port": 49549, "responder_port": 443, "initiator_bytes": 1596, "last_seen_epoch": "1575413314.720431", "responder_bytes": 6166, "first_seen_epoch": "1575413306.272129" }, { "bytes": 7656, "stream": 370, "flow_id": "flow-012d70a3317c3b13784f804a", "packets": 22, "transport": "tcp", "last_frame": 14764, "first_frame": 13295, "initiator_ip": "10.18.20.97", "responder_ip": "8.41.222.150", "initiator_port": 49550, "responder_port": 443, "initiator_bytes": 1522, "last_seen_epoch": "1575413313.794619", "responder_bytes": 6134, "first_seen_epoch": "1575413306.27232" }, { "bytes": 5832, "stream": 371, "flow_id": "flow-d93bb13aab2221d7bad38821", "packets": 22, "transport": "tcp", "last_frame": 14981, "first_frame": 13297, "initiator_ip": "10.18.20.97", "responder_ip": "104.17.119.107", "initiator_port": 49551, "responder_port": 443, "initiator_bytes": 972, "last_seen_epoch": "1575413385.78699", "responder_bytes": 4860, "first_seen_epoch": "1575413306.272575" }, { "bytes": 7071, "stream": 372, "flow_id": "flow-01ed24c5b68473a3badd3a60", "packets": 25, "transport": "tcp", "last_frame": 15187, "first_frame": 13299, "initiator_ip": "10.18.20.97", "responder_ip": "104.17.119.107", "initiator_port": 49552, "responder_port": 443, "initiator_bytes": 1511, "last_seen_epoch": "1575413386.05483", "responder_bytes": 5560, "first_seen_epoch": "1575413306.272707" }, { "bytes": 6627, "stream": 373, "flow_id": "flow-32816a9a54cf436c6feb168c", "packets": 18, "transport": "tcp", "last_frame": 14774, "first_frame": 13308, "initiator_ip": "10.18.20.97", "responder_ip": "104.193.80.60", "initiator_port": 49554, "responder_port": 443, "initiator_bytes": 835, "last_seen_epoch": "1575413316.562038", "responder_bytes": 5792, "first_seen_epoch": "1575413306.289604" }, { "bytes": 6782, "stream": 374, "flow_id": "flow-2d1d34f0e92f7063ef17b16a", "packets": 21, "transport": "tcp", "last_frame": 15193, "first_frame": 13309, "initiator_ip": "10.18.20.97", "responder_ip": "151.101.2.2", "initiator_port": 49553, "responder_port": 443, "initiator_bytes": 929, "last_seen_epoch": "1575413386.06128", "responder_bytes": 5853, "first_seen_epoch": "1575413306.289689" }, { "bytes": 7557, "stream": 375, "flow_id": "flow-c71c2fae717c968593087240", "packets": 22, "transport": "tcp", "last_frame": 14781, "first_frame": 13310, "initiator_ip": "10.18.20.97", "responder_ip": "104.193.80.60", "initiator_port": 49555, "responder_port": 443, "initiator_bytes": 1348, "last_seen_epoch": "1575413317.591633", "responder_bytes": 6209, "first_seen_epoch": "1575413306.289794" }, { "bytes": 8352, "stream": 376, "flow_id": "flow-0598ae5779a23b7dac48150c", "packets": 25, "transport": "tcp", "last_frame": 15185, "first_frame": 13312, "initiator_ip": "10.18.20.97", "responder_ip": "151.101.2.2", "initiator_port": 49556, "responder_port": 443, "initiator_bytes": 1570, "last_seen_epoch": "1575413386.054614", "responder_bytes": 6782, "first_seen_epoch": "1575413306.289896" }, { "bytes": 120, "stream": 377, "flow_id": "flow-2797da5ca0ec35ebd08f95e7", "packets": 2, "transport": "tcp", "last_frame": 13526, "first_frame": 13319, "initiator_ip": "10.18.20.97", "responder_ip": "72.5.64.63", "initiator_port": 49557, "responder_port": 443, "initiator_bytes": 66, "last_seen_epoch": "1575413306.470966", "responder_bytes": 54, "first_seen_epoch": "1575413306.290616" }, { "bytes": 120, "stream": 378, "flow_id": "flow-fa8cb5ea1aaccabd3eb3c4f9", "packets": 2, "transport": "tcp", "last_frame": 13540, "first_frame": 13320, "initiator_ip": "10.18.20.97", "responder_ip": "72.5.64.63", "initiator_port": 49558, "responder_port": 443, "initiator_bytes": 66, "last_seen_epoch": "1575413306.475757", "responder_bytes": 54, "first_seen_epoch": "1575413306.290769" }, { "bytes": 5040, "stream": 379, "flow_id": "flow-02daea7c51fd4d203b786bfd", "packets": 19, "transport": "tcp", "last_frame": 15192, "first_frame": 13338, "initiator_ip": "10.18.20.97", "responder_ip": "151.101.0.166", "initiator_port": 49559, "responder_port": 443, "initiator_bytes": 877, "last_seen_epoch": "1575413386.061204", "responder_bytes": 4163, "first_seen_epoch": "1575413306.295359" }, { "bytes": 6834, "stream": 380, "flow_id": "flow-ec8421bcae10b977901aba44", "packets": 23, "transport": "tcp", "last_frame": 15186, "first_frame": 13339, "initiator_ip": "10.18.20.97", "responder_ip": "151.101.0.166", "initiator_port": 49560, "responder_port": 443, "initiator_bytes": 1518, "last_seen_epoch": "1575413386.054735", "responder_bytes": 5316, "first_seen_epoch": "1575413306.295494" }, { "bytes": 5452, "stream": 381, "flow_id": "flow-771f8e5cfe67db4014ae79ed", "packets": 24, "transport": "tcp", "last_frame": 14961, "first_frame": 13345, "initiator_ip": "10.18.20.97", "responder_ip": "134.209.129.254", "initiator_port": 49561, "responder_port": 443, "initiator_bytes": 1554, "last_seen_epoch": "1575413385.785565", "responder_bytes": 3898, "first_seen_epoch": "1575413306.298351" }, { "bytes": 4538, "stream": 382, "flow_id": "flow-6ef7099e7469dec4cfdacaf8", "packets": 20, "transport": "tcp", "last_frame": 14964, "first_frame": 13346, "initiator_ip": "10.18.20.97", "responder_ip": "134.209.129.254", "initiator_port": 49562, "responder_port": 443, "initiator_bytes": 913, "last_seen_epoch": "1575413385.785799", "responder_bytes": 3625, "first_seen_epoch": "1575413306.298402" }, { "bytes": 6371, "stream": 383, "flow_id": "flow-5d7a779beed773e8139a6d91", "packets": 21, "transport": "tcp", "last_frame": 15188, "first_frame": 13358, "initiator_ip": "10.18.20.97", "responder_ip": "23.7.93.115", "initiator_port": 49563, "responder_port": 443, "initiator_bytes": 1491, "last_seen_epoch": "1575413386.054918", "responder_bytes": 4880, "first_seen_epoch": "1575413306.308392" }, { "bytes": 6415, "stream": 384, "flow_id": "flow-da8e82f3eee83bd171e422ab", "packets": 23, "transport": "tcp", "last_frame": 15194, "first_frame": 13359, "initiator_ip": "10.18.20.97", "responder_ip": "23.7.93.115", "initiator_port": 49564, "responder_port": 443, "initiator_bytes": 1535, "last_seen_epoch": "1575413386.061338", "responder_bytes": 4880, "first_seen_epoch": "1575413306.308446" }, { "bytes": 8171, "stream": 385, "flow_id": "flow-fb22d3ee4c62d402c137eb06", "packets": 28, "transport": "tcp", "last_frame": 14976, "first_frame": 13409, "initiator_ip": "10.18.20.97", "responder_ip": "204.74.252.20", "initiator_port": 49565, "responder_port": 443, "initiator_bytes": 1548, "last_seen_epoch": "1575413385.786534", "responder_bytes": 6623, "first_seen_epoch": "1575413306.387988" }, { "bytes": 8213, "stream": 386, "flow_id": "flow-15c6484cece6547164bd3cc3", "packets": 27, "transport": "tcp", "last_frame": 14973, "first_frame": 13410, "initiator_ip": "10.18.20.97", "responder_ip": "204.74.252.20", "initiator_port": 49566, "responder_port": 443, "initiator_bytes": 1542, "last_seen_epoch": "1575413385.786351", "responder_bytes": 6671, "first_seen_epoch": "1575413306.388135" }, { "bytes": 8124, "stream": 387, "flow_id": "flow-a47eb796f9ef9294fce586ee", "packets": 23, "transport": "tcp", "last_frame": 15222, "first_frame": 13707, "initiator_ip": "10.18.20.97", "responder_ip": "23.11.217.71", "initiator_port": 49567, "responder_port": 443, "initiator_bytes": 2053, "last_seen_epoch": "1575413386.20057", "responder_bytes": 6071, "first_seen_epoch": "1575413306.708966" }, { "bytes": 8006, "stream": 388, "flow_id": "flow-3ab87adad608ec1215191792", "packets": 22, "transport": "tcp", "last_frame": 15214, "first_frame": 13708, "initiator_ip": "10.18.20.97", "responder_ip": "23.11.217.71", "initiator_port": 49568, "responder_port": 443, "initiator_bytes": 2015, "last_seen_epoch": "1575413386.190615", "responder_bytes": 5991, "first_seen_epoch": "1575413306.709035" }, { "bytes": 4959, "stream": 389, "flow_id": "flow-7b4d839c5bf412d1ed78c758", "packets": 19, "transport": "tcp", "last_frame": 15230, "first_frame": 13870, "initiator_ip": "10.18.20.97", "responder_ip": "104.36.113.17", "initiator_port": 49569, "responder_port": 443, "initiator_bytes": 3049, "last_seen_epoch": "1575413386.206203", "responder_bytes": 1910, "first_seen_epoch": "1575413306.925427" }, { "bytes": 8125, "stream": 390, "flow_id": "flow-16e089c1d4a3a852a3e6916e", "packets": 25, "transport": "tcp", "last_frame": 15232, "first_frame": 13871, "initiator_ip": "10.18.20.97", "responder_ip": "104.36.113.17", "initiator_port": 49570, "responder_port": 443, "initiator_bytes": 5568, "last_seen_epoch": "1575413386.220019", "responder_bytes": 2557, "first_seen_epoch": "1575413306.925592" }, { "bytes": 120, "stream": 391, "flow_id": "flow-3f93f8ea90f817b385c7c39a", "packets": 2, "transport": "tcp", "last_frame": 14014, "first_frame": 13884, "initiator_ip": "10.18.20.97", "responder_ip": "72.5.64.63", "initiator_port": 49557, "responder_port": 443, "initiator_bytes": 66, "last_seen_epoch": "1575413307.221406", "responder_bytes": 54, "first_seen_epoch": "1575413306.972163" }, { "bytes": 120, "stream": 392, "flow_id": "flow-46a250adcb2464f85590d1a9", "packets": 2, "transport": "tcp", "last_frame": 14013, "first_frame": 13885, "initiator_ip": "10.18.20.97", "responder_ip": "72.5.64.63", "initiator_port": 49558, "responder_port": 443, "initiator_bytes": 66, "last_seen_epoch": "1575413307.216007", "responder_bytes": 54, "first_seen_epoch": "1575413306.972231" }, { "bytes": 329, "stream": 131, "flow_id": "flow-08e132b56b253dc55c00449d", "packets": 2, "transport": "udp", "last_frame": 14067, "first_frame": 13968, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 58455, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1575413307.383718", "responder_bytes": 253, "first_seen_epoch": "1575413307.128376" }, { "bytes": 166, "stream": 132, "flow_id": "flow-4deba27c489659e3b11da4c5", "packets": 2, "transport": "udp", "last_frame": 14090, "first_frame": 13991, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 53615, "responder_port": 53, "initiator_bytes": 75, "last_seen_epoch": "1575413307.406763", "responder_bytes": 91, "first_seen_epoch": "1575413307.175029" }, { "bytes": 258, "stream": 133, "flow_id": "flow-5142b0dd217ac7924dcbf728", "packets": 2, "transport": "udp", "last_frame": 14095, "first_frame": 14021, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 59482, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1575413307.419283", "responder_bytes": 181, "first_seen_epoch": "1575413307.237564" }, { "bytes": 4064, "stream": 393, "flow_id": "flow-3d03f746bb34609bad0971ce", "packets": 19, "transport": "tcp", "last_frame": 15226, "first_frame": 14048, "initiator_ip": "10.18.20.97", "responder_ip": "104.36.113.17", "initiator_port": 49571, "responder_port": 443, "initiator_bytes": 2890, "last_seen_epoch": "1575413386.201395", "responder_bytes": 1174, "first_seen_epoch": "1575413307.312427" }, { "bytes": 4508, "stream": 394, "flow_id": "flow-a27393d4900625eaacb0b862", "packets": 21, "transport": "tcp", "last_frame": 15224, "first_frame": 14057, "initiator_ip": "10.18.20.97", "responder_ip": "104.36.113.17", "initiator_port": 49572, "responder_port": 443, "initiator_bytes": 2960, "last_seen_epoch": "1575413386.200716", "responder_bytes": 1548, "first_seen_epoch": "1575413307.342631" }, { "bytes": 4480, "stream": 395, "flow_id": "flow-f16c6fd3e2a70fe08253a93b", "packets": 19, "transport": "tcp", "last_frame": 15216, "first_frame": 14066, "initiator_ip": "10.18.20.97", "responder_ip": "104.36.113.17", "initiator_port": 49573, "responder_port": 443, "initiator_bytes": 2986, "last_seen_epoch": "1575413386.195062", "responder_bytes": 1494, "first_seen_epoch": "1575413307.360758" }, { "bytes": 3898, "stream": 396, "flow_id": "flow-4c4efc56b10adf6b71b8ce2a", "packets": 18, "transport": "tcp", "last_frame": 14958, "first_frame": 14068, "initiator_ip": "10.18.20.97", "responder_ip": "104.254.148.196", "initiator_port": 49574, "responder_port": 443, "initiator_bytes": 836, "last_seen_epoch": "1575413385.785246", "responder_bytes": 3062, "first_seen_epoch": "1575413307.384663" }, { "bytes": 5526, "stream": 397, "flow_id": "flow-acd935ca09a84abd8180cd9f", "packets": 21, "transport": "tcp", "last_frame": 14955, "first_frame": 14069, "initiator_ip": "10.18.20.97", "responder_ip": "104.254.148.196", "initiator_port": 49575, "responder_port": 443, "initiator_bytes": 1378, "last_seen_epoch": "1575413385.78506", "responder_bytes": 4148, "first_seen_epoch": "1575413307.384734" }, { "bytes": 5925, "stream": 398, "flow_id": "flow-2a337d6505d535cb21a9f268", "packets": 23, "transport": "tcp", "last_frame": 15174, "first_frame": 14091, "initiator_ip": "10.18.20.97", "responder_ip": "107.178.246.49", "initiator_port": 49576, "responder_port": 443, "initiator_bytes": 1372, "last_seen_epoch": "1575413386.036658", "responder_bytes": 4553, "first_seen_epoch": "1575413307.407271" }, { "bytes": 5637, "stream": 399, "flow_id": "flow-aa7654589488c2f435f546ab", "packets": 23, "transport": "tcp", "last_frame": 15172, "first_frame": 14092, "initiator_ip": "10.18.20.97", "responder_ip": "107.178.246.49", "initiator_port": 49577, "responder_port": 443, "initiator_bytes": 1452, "last_seen_epoch": "1575413386.034982", "responder_bytes": 4185, "first_seen_epoch": "1575413307.407332" }, { "bytes": 7847, "stream": 400, "flow_id": "flow-4313d5ce1a8da96644d09b3b", "packets": 24, "transport": "tcp", "last_frame": 15178, "first_frame": 14096, "initiator_ip": "10.18.20.97", "responder_ip": "151.101.2.49", "initiator_port": 49578, "responder_port": 443, "initiator_bytes": 1614, "last_seen_epoch": "1575413386.037919", "responder_bytes": 6233, "first_seen_epoch": "1575413307.419724" }, { "bytes": 6389, "stream": 401, "flow_id": "flow-9ea76ba63b133f923c770c29", "packets": 20, "transport": "tcp", "last_frame": 15177, "first_frame": 14097, "initiator_ip": "10.18.20.97", "responder_ip": "151.101.2.49", "initiator_port": 49579, "responder_port": 443, "initiator_bytes": 877, "last_seen_epoch": "1575413386.037837", "responder_bytes": 5512, "first_seen_epoch": "1575413307.41978" }, { "bytes": 4672, "stream": 402, "flow_id": "flow-4f04b56ec31d03b277a38c2b", "packets": 19, "transport": "tcp", "last_frame": 15210, "first_frame": 14114, "initiator_ip": "10.18.20.97", "responder_ip": "104.36.113.17", "initiator_port": 49580, "responder_port": 443, "initiator_bytes": 3098, "last_seen_epoch": "1575413386.185554", "responder_bytes": 1574, "first_seen_epoch": "1575413307.463251" }, { "bytes": 116, "stream": 403, "flow_id": "flow-dc0a923c40ace985718f7b6b", "packets": 2, "transport": "tcp", "last_frame": 14274, "first_frame": 14195, "initiator_ip": "10.18.20.97", "responder_ip": "72.5.64.63", "initiator_port": 49558, "responder_port": 443, "initiator_bytes": 62, "last_seen_epoch": "1575413307.867525", "responder_bytes": 54, "first_seen_epoch": "1575413307.721008" }, { "bytes": 116, "stream": 404, "flow_id": "flow-fc65b1b58b0809a479010724", "packets": 2, "transport": "tcp", "last_frame": 14297, "first_frame": 14237, "initiator_ip": "10.18.20.97", "responder_ip": "72.5.64.63", "initiator_port": 49557, "responder_port": 443, "initiator_bytes": 62, "last_seen_epoch": "1575413307.921628", "responder_bytes": 54, "first_seen_epoch": "1575413307.736559" }, { "bytes": 120, "stream": 405, "flow_id": "flow-dde7d7db2fd5101cb0f20135", "packets": 2, "transport": "tcp", "last_frame": 14303, "first_frame": 14277, "initiator_ip": "10.18.20.97", "responder_ip": "72.5.64.63", "initiator_port": 49581, "responder_port": 443, "initiator_bytes": 66, "last_seen_epoch": "1575413308.024119", "responder_bytes": 54, "first_seen_epoch": "1575413307.869452" }, { "bytes": 120, "stream": 406, "flow_id": "flow-40c7f2e00432a85814764487", "packets": 2, "transport": "tcp", "last_frame": 14320, "first_frame": 14299, "initiator_ip": "10.18.20.97", "responder_ip": "72.5.64.63", "initiator_port": 49582, "responder_port": 443, "initiator_bytes": 66, "last_seen_epoch": "1575413308.109337", "responder_bytes": 54, "first_seen_epoch": "1575413307.923135" }, { "bytes": 258, "stream": 134, "flow_id": "flow-2d002bf38f68e2a395db668b", "packets": 2, "transport": "udp", "last_frame": 14321, "first_frame": 14309, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 63975, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1575413308.123917", "responder_bytes": 181, "first_seen_epoch": "1575413308.047524" }, { "bytes": 8109, "stream": 407, "flow_id": "flow-5cb5fd5e6ce57846d086d9e9", "packets": 25, "transport": "tcp", "last_frame": 15170, "first_frame": 14322, "initiator_ip": "10.18.20.97", "responder_ip": "151.101.66.49", "initiator_port": 49583, "responder_port": 443, "initiator_bytes": 1668, "last_seen_epoch": "1575413385.999696", "responder_bytes": 6441, "first_seen_epoch": "1575413308.124608" }, { "bytes": 6443, "stream": 408, "flow_id": "flow-0b901e8a754e6747776db9c4", "packets": 21, "transport": "tcp", "last_frame": 15180, "first_frame": 14323, "initiator_ip": "10.18.20.97", "responder_ip": "151.101.66.49", "initiator_port": 49584, "responder_port": 443, "initiator_bytes": 931, "last_seen_epoch": "1575413386.043455", "responder_bytes": 5512, "first_seen_epoch": "1575413308.12476" }, { "bytes": 1262, "stream": 409, "flow_id": "flow-923aee31d285ca9271b92e37", "packets": 15, "transport": "tcp", "last_frame": 15211, "first_frame": 14330, "initiator_ip": "10.18.20.97", "responder_ip": "104.36.113.24", "initiator_port": 49585, "responder_port": 443, "initiator_bytes": 713, "last_seen_epoch": "1575413386.185668", "responder_bytes": 549, "first_seen_epoch": "1575413308.164562" }, { "bytes": 4384, "stream": 410, "flow_id": "flow-66c10bdcaf9038e64c957429", "packets": 19, "transport": "tcp", "last_frame": 15206, "first_frame": 14331, "initiator_ip": "10.18.20.97", "responder_ip": "104.36.113.24", "initiator_port": 49586, "responder_port": 443, "initiator_bytes": 3114, "last_seen_epoch": "1575413386.181366", "responder_bytes": 1270, "first_seen_epoch": "1575413308.164775" }, { "bytes": 120, "stream": 411, "flow_id": "flow-4718da58c8c2997f5ba05d3b", "packets": 2, "transport": "tcp", "last_frame": 14400, "first_frame": 14398, "initiator_ip": "10.18.20.97", "responder_ip": "72.5.64.63", "initiator_port": 49581, "responder_port": 443, "initiator_bytes": 66, "last_seen_epoch": "1575413308.635287", "responder_bytes": 54, "first_seen_epoch": "1575413308.532415" }, { "bytes": 120, "stream": 412, "flow_id": "flow-fa90ae74f362fe963940dbe1", "packets": 2, "transport": "tcp", "last_frame": 14405, "first_frame": 14399, "initiator_ip": "10.18.20.97", "responder_ip": "72.5.64.63", "initiator_port": 49582, "responder_port": 443, "initiator_bytes": 66, "last_seen_epoch": "1575413308.74762", "responder_bytes": 54, "first_seen_epoch": "1575413308.610721" }, { "bytes": 116, "stream": 413, "flow_id": "flow-d16d786fe0d0488579d7bd44", "packets": 2, "transport": "tcp", "last_frame": 14410, "first_frame": 14408, "initiator_ip": "10.18.20.97", "responder_ip": "72.5.64.63", "initiator_port": 49581, "responder_port": 443, "initiator_bytes": 62, "last_seen_epoch": "1575413309.252389", "responder_bytes": 54, "first_seen_epoch": "1575413309.14097" }, { "bytes": 116, "stream": 414, "flow_id": "flow-27d66caa4fadc8816384239d", "packets": 2, "transport": "tcp", "last_frame": 14411, "first_frame": 14409, "initiator_ip": "10.18.20.97", "responder_ip": "72.5.64.63", "initiator_port": 49582, "responder_port": 443, "initiator_bytes": 62, "last_seen_epoch": "1575413309.349564", "responder_bytes": 54, "first_seen_epoch": "1575413309.250364" }, { "bytes": 196, "stream": 135, "flow_id": "flow-557803d57dcdc09f591635ed", "packets": 2, "transport": "udp", "last_frame": 14419, "first_frame": 14418, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 56350, "responder_port": 53, "initiator_bytes": 75, "last_seen_epoch": "1575413311.311989", "responder_bytes": 121, "first_seen_epoch": "1575413311.212281" }, { "bytes": 5297, "stream": 415, "flow_id": "flow-beb6ad1bc6260c93859f03d1", "packets": 20, "transport": "tcp", "last_frame": 14940, "first_frame": 14420, "initiator_ip": "10.18.20.97", "responder_ip": "162.125.8.1", "initiator_port": 49587, "responder_port": 443, "initiator_bytes": 913, "last_seen_epoch": "1575413385.782409", "responder_bytes": 4384, "first_seen_epoch": "1575413311.312691" }, { "bytes": 9585, "stream": 416, "flow_id": "flow-67c4581ff0a1b1a297570fe7", "packets": 30, "transport": "tcp", "last_frame": 14937, "first_frame": 14421, "initiator_ip": "10.18.20.97", "responder_ip": "162.125.8.1", "initiator_port": 49588, "responder_port": 443, "initiator_bytes": 2009, "last_seen_epoch": "1575413385.782072", "responder_bytes": 7576, "first_seen_epoch": "1575413311.313007" }, { "bytes": 299, "stream": 136, "flow_id": "flow-7fdb0874884ee44e4e6c35a8", "packets": 2, "transport": "udp", "last_frame": 14467, "first_frame": 14462, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 62422, "responder_port": 53, "initiator_bytes": 114, "last_seen_epoch": "1575413312.488886", "responder_bytes": 185, "first_seen_epoch": "1575413312.368596" }, { "bytes": 195060, "stream": 417, "flow_id": "flow-4a131f3dc0d300afba043b73", "packets": 280, "transport": "tcp", "last_frame": 14931, "first_frame": 14468, "initiator_ip": "10.18.20.97", "responder_ip": "162.125.8.6", "initiator_port": 49589, "responder_port": 443, "initiator_bytes": 8457, "last_seen_epoch": "1575413385.781142", "responder_bytes": 186603, "first_seen_epoch": "1575413312.489709" }, { "bytes": 4806, "stream": 418, "flow_id": "flow-7d810885b2a6283b2068ee83", "packets": 21, "transport": "tcp", "last_frame": 14934, "first_frame": 14469, "initiator_ip": "10.18.20.97", "responder_ip": "162.125.8.6", "initiator_port": 49590, "responder_port": 443, "initiator_bytes": 952, "last_seen_epoch": "1575413385.781746", "responder_bytes": 3854, "first_seen_epoch": "1575413312.489785" }, { "bytes": 10141, "stream": 419, "flow_id": "flow-fb953968024ed0d70cae5d69", "packets": 34, "transport": "tcp", "last_frame": 16223, "first_frame": 14817, "initiator_ip": "10.18.20.97", "responder_ip": "69.147.64.34", "initiator_port": 49591, "responder_port": 443, "initiator_bytes": 4943, "last_seen_epoch": "1575413485.948382", "responder_bytes": 5198, "first_seen_epoch": "1575413365.939146" }, { "bytes": 264, "stream": 137, "flow_id": "flow-294efdb9fd0a5bf579642f71", "packets": 2, "transport": "udp", "last_frame": 15281, "first_frame": 15280, "initiator_ip": "10.18.20.97", "responder_ip": "193.183.98.66", "initiator_port": 59730, "responder_port": 53, "initiator_bytes": 71, "last_seen_epoch": "1575413425.403718", "responder_bytes": 193, "first_seen_epoch": "1575413425.196289" }, { "bytes": 213885, "stream": 420, "flow_id": "flow-24c0115e3aa643ec48f9d70d", "packets": 282, "transport": "tcp", "last_frame": 15568, "first_frame": 15284, "initiator_ip": "10.18.20.97", "responder_ip": "8.208.24.139", "initiator_port": 49593, "responder_port": 80, "initiator_bytes": 7816, "last_seen_epoch": "1575413427.756517", "responder_bytes": 206069, "first_seen_epoch": "1575413425.780261" }, { "bytes": 914, "stream": 421, "flow_id": "flow-d0489e9b1e9c82e77e1ba36c", "packets": 9, "transport": "tcp", "last_frame": 15574, "first_frame": 15285, "initiator_ip": "10.18.20.97", "responder_ip": "8.208.24.139", "initiator_port": 49592, "responder_port": 80, "initiator_bytes": 482, "last_seen_epoch": "1575413427.952899", "responder_bytes": 432, "first_seen_epoch": "1575413425.780348" }, { "bytes": 264, "stream": 138, "flow_id": "flow-be618f8c6e3c04bb47f49d28", "packets": 2, "transport": "udp", "last_frame": 15576, "first_frame": 15575, "initiator_ip": "10.18.20.97", "responder_ip": "193.183.98.66", "initiator_port": 52218, "responder_port": 53, "initiator_bytes": 71, "last_seen_epoch": "1575413428.584602", "responder_bytes": 193, "first_seen_epoch": "1575413428.383528" }, { "bytes": 267826, "stream": 422, "flow_id": "flow-ce12c2a25a921f1d246d1c40", "packets": 352, "transport": "tcp", "last_frame": 15943, "first_frame": 15577, "initiator_ip": "10.18.20.97", "responder_ip": "8.208.24.139", "initiator_port": 49595, "responder_port": 80, "initiator_bytes": 9598, "last_seen_epoch": "1575413432.83409", "responder_bytes": 258228, "first_seen_epoch": "1575413428.686756" }, { "bytes": 914, "stream": 423, "flow_id": "flow-e66b288761634beb62335764", "packets": 9, "transport": "tcp", "last_frame": 15949, "first_frame": 15578, "initiator_ip": "10.18.20.97", "responder_ip": "8.208.24.139", "initiator_port": 49594, "responder_port": 80, "initiator_bytes": 482, "last_seen_epoch": "1575413433.028043", "responder_bytes": 432, "first_seen_epoch": "1575413428.686822" }, { "bytes": 220, "stream": 139, "flow_id": "flow-14e435be6b2aa30489a2942e", "packets": 2, "transport": "udp", "last_frame": 15925, "first_frame": 15894, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 60500, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1575413432.761612", "responder_bytes": 148, "first_seen_epoch": "1575413432.609808" }, { "bytes": 231, "stream": 140, "flow_id": "flow-d3858481b6ee2f7c54f74018", "packets": 2, "transport": "udp", "last_frame": 15924, "first_frame": 15895, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 53654, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1575413432.761525", "responder_bytes": 159, "first_seen_epoch": "1575413432.610255" }, { "bytes": 265, "stream": 141, "flow_id": "flow-b29bc60e7285b6966969368c", "packets": 2, "transport": "udp", "last_frame": 15933, "first_frame": 15896, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 64023, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1575413432.778338", "responder_bytes": 193, "first_seen_epoch": "1575413432.610799" }, { "bytes": 276, "stream": 142, "flow_id": "flow-8a9dd77f9086f0cf0e806cd0", "packets": 2, "transport": "udp", "last_frame": 15930, "first_frame": 15897, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 52845, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1575413432.778153", "responder_bytes": 204, "first_seen_epoch": "1575413432.611022" }, { "bytes": 276, "stream": 143, "flow_id": "flow-79b9e14648937840a020ba0f", "packets": 2, "transport": "udp", "last_frame": 15931, "first_frame": 15900, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 52852, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1575413432.778226", "responder_bytes": 204, "first_seen_epoch": "1575413432.612065" }, { "bytes": 276, "stream": 144, "flow_id": "flow-7a7b1421099e8841c26e770b", "packets": 2, "transport": "udp", "last_frame": 15932, "first_frame": 15901, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 54788, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1575413432.778283", "responder_bytes": 204, "first_seen_epoch": "1575413432.612721" }, { "bytes": 264, "stream": 145, "flow_id": "flow-a785f8dd25bfc7c3e189f72f", "packets": 2, "transport": "udp", "last_frame": 15951, "first_frame": 15950, "initiator_ip": "10.18.20.97", "responder_ip": "193.183.98.66", "initiator_port": 57803, "responder_port": 53, "initiator_bytes": 71, "last_seen_epoch": "1575413434.109141", "responder_bytes": 193, "first_seen_epoch": "1575413433.872759" }, { "bytes": 3362, "stream": 424, "flow_id": "flow-4e2b66003da22802a73264ac", "packets": 11, "transport": "tcp", "last_frame": 15965, "first_frame": 15952, "initiator_ip": "10.18.20.97", "responder_ip": "8.208.24.139", "initiator_port": 49596, "responder_port": 80, "initiator_bytes": 908, "last_seen_epoch": "1575413435.076081", "responder_bytes": 2454, "first_seen_epoch": "1575413434.280109" }, { "bytes": 660, "stream": 425, "flow_id": "flow-1c92fd1782926415c719c34c", "packets": 8, "transport": "tcp", "last_frame": 16253, "first_frame": 15953, "initiator_ip": "10.18.20.97", "responder_ip": "8.208.24.139", "initiator_port": 49597, "responder_port": 80, "initiator_bytes": 282, "last_seen_epoch": "1575413496.697315", "responder_bytes": 378, "first_seen_epoch": "1575413434.280176" }, { "bytes": 268, "stream": 146, "flow_id": "flow-ad165c8aad1db6bc245f27d5", "packets": 2, "transport": "udp", "last_frame": 15967, "first_frame": 15966, "initiator_ip": "10.18.20.97", "responder_ip": "193.183.98.66", "initiator_port": 54524, "responder_port": 53, "initiator_bytes": 73, "last_seen_epoch": "1575413440.498835", "responder_bytes": 195, "first_seen_epoch": "1575413440.200051" }, { "bytes": 147847, "stream": 426, "flow_id": "flow-1a62dc77707f7a9423a4f0e4", "packets": 160, "transport": "tcp", "last_frame": 16127, "first_frame": 15968, "initiator_ip": "10.18.20.97", "responder_ip": "8.208.24.139", "initiator_port": 49598, "responder_port": 80, "initiator_bytes": 3107, "last_seen_epoch": "1575413441.877359", "responder_bytes": 144740, "first_seen_epoch": "1575413440.501311" }, { "bytes": 178, "stream": 147, "flow_id": "flow-da1da74f7038d0ea1a40a4d8", "packets": 2, "transport": "udp", "last_frame": 16131, "first_frame": 16128, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 53622, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1575413450.595932", "responder_bytes": 97, "first_seen_epoch": "1575413450.199517" }, { "bytes": 189, "stream": 148, "flow_id": "flow-e5198abe39f16425742090e8", "packets": 2, "transport": "udp", "last_frame": 16130, "first_frame": 16129, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 50078, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1575413450.595849", "responder_bytes": 108, "first_seen_epoch": "1575413450.209086" }, { "bytes": 209, "stream": 149, "flow_id": "flow-d81c61fbdef9adabd4bc8a0c", "packets": 2, "transport": "udp", "last_frame": 16134, "first_frame": 16132, "initiator_ip": "10.18.20.97", "responder_ip": "208.67.222.222", "initiator_port": 50079, "responder_port": 53, "initiator_bytes": 87, "last_seen_epoch": "1575413450.99132", "responder_bytes": 122, "first_seen_epoch": "1575413450.598824" }, { "bytes": 209, "stream": 150, "flow_id": "flow-e7a4c9078bb3931be99d285c", "packets": 2, "transport": "udp", "last_frame": 16136, "first_frame": 16133, "initiator_ip": "10.18.20.97", "responder_ip": "208.67.222.222", "initiator_port": 50080, "responder_port": 53, "initiator_bytes": 87, "last_seen_epoch": "1575413450.995136", "responder_bytes": 122, "first_seen_epoch": "1575413450.598925" }, { "bytes": 180, "stream": 151, "flow_id": "flow-50083d8dbd5474873a6d3ea8", "packets": 2, "transport": "udp", "last_frame": 16169, "first_frame": 16135, "initiator_ip": "10.18.20.97", "responder_ip": "208.67.222.222", "initiator_port": 50081, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1575413457.100534", "responder_bytes": 90, "first_seen_epoch": "1575413450.992534" }, { "bytes": 180, "stream": 152, "flow_id": "flow-fe9bcbb041ce35976d4c110b", "packets": 2, "transport": "udp", "last_frame": 16168, "first_frame": 16137, "initiator_ip": "10.18.20.97", "responder_ip": "208.67.222.222", "initiator_port": 50082, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1575413457.097506", "responder_bytes": 90, "first_seen_epoch": "1575413450.995863" }, { "bytes": 180, "stream": 153, "flow_id": "flow-04e6f9e37b80e550e61c4ee8", "packets": 2, "transport": "udp", "last_frame": 16191, "first_frame": 16138, "initiator_ip": "10.18.20.97", "responder_ip": "208.67.222.222", "initiator_port": 50083, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1575413459.043562", "responder_bytes": 90, "first_seen_epoch": "1575413452.999333" }, { "bytes": 180, "stream": 154, "flow_id": "flow-0bbc28cdeb1ca353430c1e8e", "packets": 2, "transport": "udp", "last_frame": 16192, "first_frame": 16139, "initiator_ip": "10.18.20.97", "responder_ip": "208.67.222.222", "initiator_port": 50084, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1575413459.051947", "responder_bytes": 90, "first_seen_epoch": "1575413452.999457" }, { "bytes": 168, "stream": 155, "flow_id": "flow-92e4f16ad645feb85a50cc5d", "packets": 2, "transport": "udp", "last_frame": 16142, "first_frame": 16140, "initiator_ip": "10.18.20.97", "responder_ip": "208.67.222.222", "initiator_port": 50085, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1575413455.067315", "responder_bytes": 92, "first_seen_epoch": "1575413455.012126" }, { "bytes": 168, "stream": 156, "flow_id": "flow-f29796af4f3c95c20995ddd3", "packets": 2, "transport": "udp", "last_frame": 16144, "first_frame": 16141, "initiator_ip": "10.18.20.97", "responder_ip": "208.67.222.222", "initiator_port": 50086, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1575413455.07568", "responder_bytes": 92, "first_seen_epoch": "1575413455.012294" }, { "bytes": 198, "stream": 157, "flow_id": "flow-5277d324274b4e20ac7deb1e", "packets": 2, "transport": "udp", "last_frame": 16146, "first_frame": 16143, "initiator_ip": "10.18.20.97", "responder_ip": "208.67.222.222", "initiator_port": 50087, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1575413455.131069", "responder_bytes": 122, "first_seen_epoch": "1575413455.070317" }, { "bytes": 198, "stream": 158, "flow_id": "flow-028d53377dd244a189f81345", "packets": 2, "transport": "udp", "last_frame": 16147, "first_frame": 16145, "initiator_ip": "10.18.20.97", "responder_ip": "208.67.222.222", "initiator_port": 50088, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1575413455.14051", "responder_bytes": 122, "first_seen_epoch": "1575413455.078339" }, { "bytes": 264, "stream": 159, "flow_id": "flow-6de6b658ff4c4053bf56dfbc", "packets": 2, "transport": "udp", "last_frame": 16149, "first_frame": 16148, "initiator_ip": "10.18.20.97", "responder_ip": "193.183.98.66", "initiator_port": 50599, "responder_port": 53, "initiator_bytes": 71, "last_seen_epoch": "1575413455.35774", "responder_bytes": 193, "first_seen_epoch": "1575413455.165434" }, { "bytes": 1333, "stream": 427, "flow_id": "flow-d0d1cded5a7b0e3134837f3d", "packets": 9, "transport": "tcp", "last_frame": 16158, "first_frame": 16150, "initiator_ip": "10.18.20.97", "responder_ip": "8.208.24.139", "initiator_port": 49599, "responder_port": 80, "initiator_bytes": 830, "last_seen_epoch": "1575413456.139769", "responder_bytes": 503, "first_seen_epoch": "1575413455.359586" }, { "bytes": 264, "stream": 160, "flow_id": "flow-f44084565a01f0ab4bfcc7d2", "packets": 2, "transport": "udp", "last_frame": 16160, "first_frame": 16159, "initiator_ip": "10.18.20.97", "responder_ip": "193.183.98.66", "initiator_port": 62396, "responder_port": 53, "initiator_bytes": 71, "last_seen_epoch": "1575413456.425216", "responder_bytes": 193, "first_seen_epoch": "1575413456.141997" }, { "bytes": 1531, "stream": 428, "flow_id": "flow-f97375ccb3354ed19b30c09c", "packets": 11, "transport": "tcp", "last_frame": 16177, "first_frame": 16161, "initiator_ip": "10.18.20.97", "responder_ip": "8.208.24.139", "initiator_port": 49600, "responder_port": 80, "initiator_bytes": 935, "last_seen_epoch": "1575413457.347075", "responder_bytes": 596, "first_seen_epoch": "1575413456.426127" }, { "bytes": 264, "stream": 161, "flow_id": "flow-a9ee8c1c692e96cc57fcaf23", "packets": 2, "transport": "udp", "last_frame": 16179, "first_frame": 16178, "initiator_ip": "10.18.20.97", "responder_ip": "193.183.98.66", "initiator_port": 61775, "responder_port": 53, "initiator_bytes": 71, "last_seen_epoch": "1575413457.526856", "responder_bytes": 193, "first_seen_epoch": "1575413457.34826" }, { "bytes": 1735, "stream": 429, "flow_id": "flow-733fec0da2e935a5d5d555df", "packets": 11, "transport": "tcp", "last_frame": 16190, "first_frame": 16180, "initiator_ip": "10.18.20.97", "responder_ip": "8.208.24.139", "initiator_port": 49601, "responder_port": 80, "initiator_bytes": 1178, "last_seen_epoch": "1575413458.48878", "responder_bytes": 557, "first_seen_epoch": "1575413457.527512" }, { "bytes": 264, "stream": 162, "flow_id": "flow-ac33165bd4921e0939f9a90d", "packets": 2, "transport": "udp", "last_frame": 16196, "first_frame": 16195, "initiator_ip": "10.18.20.97", "responder_ip": "193.183.98.66", "initiator_port": 57421, "responder_port": 53, "initiator_bytes": 71, "last_seen_epoch": "1575413468.760703", "responder_bytes": 193, "first_seen_epoch": "1575413468.491491" }, { "bytes": 1964, "stream": 430, "flow_id": "flow-01413d89abec0d8dfbd2640b", "packets": 11, "transport": "tcp", "last_frame": 16207, "first_frame": 16197, "initiator_ip": "10.18.20.97", "responder_ip": "8.208.24.139", "initiator_port": 49602, "responder_port": 80, "initiator_bytes": 1407, "last_seen_epoch": "1575413469.614678", "responder_bytes": 557, "first_seen_epoch": "1575413468.761589" }, { "bytes": 264, "stream": 163, "flow_id": "flow-292f0df73654b5cdba389875", "packets": 2, "transport": "udp", "last_frame": 16209, "first_frame": 16208, "initiator_ip": "10.18.20.97", "responder_ip": "193.183.98.66", "initiator_port": 63553, "responder_port": 53, "initiator_bytes": 71, "last_seen_epoch": "1575413469.819055", "responder_bytes": 193, "first_seen_epoch": "1575413469.615843" }, { "bytes": 1965, "stream": 431, "flow_id": "flow-2cd2380687fa8e042533ce8c", "packets": 11, "transport": "tcp", "last_frame": 16220, "first_frame": 16210, "initiator_ip": "10.18.20.97", "responder_ip": "8.208.24.139", "initiator_port": 49603, "responder_port": 80, "initiator_bytes": 1408, "last_seen_epoch": "1575413470.633492", "responder_bytes": 557, "first_seen_epoch": "1575413469.819776" }, { "bytes": 19199, "stream": 432, "flow_id": "flow-8d806d5473792370c7053712", "packets": 53, "transport": "tcp", "last_frame": 16283, "first_frame": 16224, "initiator_ip": "10.18.20.97", "responder_ip": "69.147.64.34", "initiator_port": 49604, "responder_port": 443, "initiator_bytes": 11859, "last_seen_epoch": "1575413715.779846", "responder_bytes": 7340, "first_seen_epoch": "1575413485.952153" }, { "bytes": 9728, "stream": 433, "flow_id": "flow-41e6d007781efd2487b8990f", "packets": 30, "transport": "tcp", "last_frame": 16328, "first_frame": 16284, "initiator_ip": "10.18.20.97", "responder_ip": "69.147.64.34", "initiator_port": 49605, "responder_port": 443, "initiator_bytes": 4584, "last_seen_epoch": "1575413825.835529", "responder_bytes": 5144, "first_seen_epoch": "1575413725.92183" }, { "bytes": 264, "stream": 164, "flow_id": "flow-92bc78c3d88359bb1ee2d378", "packets": 2, "transport": "udp", "last_frame": 16309, "first_frame": 16308, "initiator_ip": "10.18.20.97", "responder_ip": "193.183.98.66", "initiator_port": 60992, "responder_port": 53, "initiator_bytes": 71, "last_seen_epoch": "1575413756.347599", "responder_bytes": 193, "first_seen_epoch": "1575413756.153041" }, { "bytes": 1541, "stream": 434, "flow_id": "flow-f925e1f9158b8fa743832575", "packets": 11, "transport": "tcp", "last_frame": 16320, "first_frame": 16310, "initiator_ip": "10.18.20.97", "responder_ip": "8.208.24.139", "initiator_port": 49606, "responder_port": 80, "initiator_bytes": 984, "last_seen_epoch": "1575413757.172264", "responder_bytes": 557, "first_seen_epoch": "1575413756.349052" }, { "bytes": 9228, "stream": 435, "flow_id": "flow-ae64832f6727786e1d4edcf9", "packets": 28, "transport": "tcp", "last_frame": 16400, "first_frame": 16329, "initiator_ip": "10.18.20.97", "responder_ip": "69.147.64.34", "initiator_port": 49608, "responder_port": 443, "initiator_bytes": 4258, "last_seen_epoch": "1575413935.875482", "responder_bytes": 4970, "first_seen_epoch": "1575413845.91662" }, { "bytes": 4723, "stream": 436, "flow_id": "flow-03f5bb362122aa9603928618", "packets": 18, "transport": "tcp", "last_frame": 16402, "first_frame": 16330, "initiator_ip": "10.18.20.97", "responder_ip": "69.147.64.34", "initiator_port": 49607, "responder_port": 443, "initiator_bytes": 810, "last_seen_epoch": "1575413935.892773", "responder_bytes": 3913, "first_seen_epoch": "1575413845.916691" }, { "bytes": 9667, "stream": 437, "flow_id": "flow-1988a34f2fbffd6cfb173b36", "packets": 30, "transport": "tcp", "last_frame": 16406, "first_frame": 16331, "initiator_ip": "10.18.20.97", "responder_ip": "69.147.64.34", "initiator_port": 49609, "responder_port": 443, "initiator_bytes": 4583, "last_seen_epoch": "1575413936.170793", "responder_bytes": 5084, "first_seen_epoch": "1575413845.946543" }, { "bytes": 6301, "stream": 438, "flow_id": "flow-2cb5270dde258dde52794681", "packets": 22, "transport": "tcp", "last_frame": 16428, "first_frame": 16407, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 49610, "responder_port": 445, "initiator_bytes": 4599, "last_seen_epoch": "1575414001.214682", "responder_bytes": 1702, "first_seen_epoch": "1575413985.650184" }, { "bytes": 264, "stream": 165, "flow_id": "flow-a533c9e4e26b62a141ea35aa", "packets": 2, "transport": "udp", "last_frame": 16432, "first_frame": 16431, "initiator_ip": "10.18.20.97", "responder_ip": "193.183.98.66", "initiator_port": 54072, "responder_port": 53, "initiator_bytes": 71, "last_seen_epoch": "1575414056.349092", "responder_bytes": 193, "first_seen_epoch": "1575414056.144786" }, { "bytes": 1335, "stream": 439, "flow_id": "flow-f5d4418cba21c6826b381f6d", "packets": 9, "transport": "tcp", "last_frame": 16441, "first_frame": 16433, "initiator_ip": "10.18.20.97", "responder_ip": "8.208.24.139", "initiator_port": 49611, "responder_port": 80, "initiator_bytes": 832, "last_seen_epoch": "1575414057.218652", "responder_bytes": 503, "first_seen_epoch": "1575414056.351077" }, { "bytes": 264, "stream": 166, "flow_id": "flow-dfe5926b132b8a3165eba3df", "packets": 2, "transport": "udp", "last_frame": 16443, "first_frame": 16442, "initiator_ip": "10.18.20.97", "responder_ip": "193.183.98.66", "initiator_port": 55358, "responder_port": 53, "initiator_bytes": 71, "last_seen_epoch": "1575414057.413839", "responder_bytes": 193, "first_seen_epoch": "1575414057.220629" }, { "bytes": 1489, "stream": 440, "flow_id": "flow-4e3843e2fd9dec85106afc29", "packets": 11, "transport": "tcp", "last_frame": 16454, "first_frame": 16444, "initiator_ip": "10.18.20.97", "responder_ip": "8.208.24.139", "initiator_port": 49612, "responder_port": 80, "initiator_bytes": 932, "last_seen_epoch": "1575414058.242116", "responder_bytes": 557, "first_seen_epoch": "1575414057.415108" }, { "bytes": 220, "stream": 167, "flow_id": "flow-efeaec2f7fcc1be457f69e35", "packets": 2, "transport": "udp", "last_frame": 16457, "first_frame": 16456, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 123, "responder_port": 123, "initiator_bytes": 110, "last_seen_epoch": "1575414114.114089", "responder_bytes": 110, "first_seen_epoch": "1575414114.111446" }, { "bytes": 8013, "stream": 441, "flow_id": "flow-c6e6b80691549f1bd9ea74dd", "packets": 39, "transport": "tcp", "last_frame": 21171, "first_frame": 16458, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 49613, "responder_port": 445, "initiator_bytes": 5905, "last_seen_epoch": "1575414808.259047", "responder_bytes": 2108, "first_seen_epoch": "1575414185.260305" }, { "bytes": 264, "stream": 168, "flow_id": "flow-9e7a37465815ee617668f00e", "packets": 2, "transport": "udp", "last_frame": 16487, "first_frame": 16486, "initiator_ip": "10.18.20.97", "responder_ip": "193.183.98.66", "initiator_port": 60728, "responder_port": 53, "initiator_bytes": 71, "last_seen_epoch": "1575414357.417756", "responder_bytes": 193, "first_seen_epoch": "1575414357.231323" }, { "bytes": 1475, "stream": 442, "flow_id": "flow-a26ec77ba9cc40f08dbf6511", "packets": 11, "transport": "tcp", "last_frame": 16498, "first_frame": 16488, "initiator_ip": "10.18.20.97", "responder_ip": "8.208.24.139", "initiator_port": 49614, "responder_port": 80, "initiator_bytes": 918, "last_seen_epoch": "1575414358.277923", "responder_bytes": 557, "first_seen_epoch": "1575414357.41988" }, { "bytes": 215, "stream": 169, "flow_id": "flow-2ab647fed4201be574ba438f", "packets": 2, "transport": "udp", "last_frame": 16502, "first_frame": 16501, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 51972, "responder_port": 53, "initiator_bytes": 84, "last_seen_epoch": "1575414483.604203", "responder_bytes": 131, "first_seen_epoch": "1575414483.432527" }, { "bytes": 229, "stream": 170, "flow_id": "flow-11a293a06481ba0fa2b4dead", "packets": 2, "transport": "udp", "last_frame": 16504, "first_frame": 16503, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 54641, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1575414483.742885", "responder_bytes": 151, "first_seen_epoch": "1575414483.742573" }, { "bytes": 227, "stream": 171, "flow_id": "flow-bb8ba527c761fec53e9642cc", "packets": 2, "transport": "udp", "last_frame": 16509, "first_frame": 16505, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 65327, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1575414483.793161", "responder_bytes": 151, "first_seen_epoch": "1575414483.74313" }, { "bytes": 342, "stream": 172, "flow_id": "flow-e42695815f9a31967712a0a9", "packets": 1, "transport": "udp", "last_frame": 16506, "first_frame": 16506, "initiator_ip": "10.18.20.97", "responder_ip": "255.255.255.255", "initiator_port": 68, "responder_port": 67, "initiator_bytes": 342, "last_seen_epoch": "1575414483.749103", "responder_bytes": 0, "first_seen_epoch": "1575414483.749103" }, { "bytes": 342, "stream": 173, "flow_id": "flow-cebcb8279667ed8a811c97ba", "packets": 1, "transport": "udp", "last_frame": 16507, "first_frame": 16507, "initiator_ip": "10.18.20.8", "responder_ip": "10.18.20.97", "initiator_port": 67, "responder_port": 68, "initiator_bytes": 342, "last_seen_epoch": "1575414483.749453", "responder_bytes": 0, "first_seen_epoch": "1575414483.749453" }, { "bytes": 150699, "stream": 443, "flow_id": "flow-8b6c4a3d80b6e622c4b989c9", "packets": 220, "transport": "tcp", "last_frame": 21061, "first_frame": 16508, "initiator_ip": "10.18.20.97", "responder_ip": "171.161.198.200", "initiator_port": 49616, "responder_port": 443, "initiator_bytes": 9104, "last_seen_epoch": "1575414533.923582", "responder_bytes": 141595, "first_seen_epoch": "1575414483.777712" }, { "bytes": 128, "stream": 174, "flow_id": "flow-fd547544edd0f28d99d23e84", "packets": 2, "transport": "udp", "last_frame": 16515, "first_frame": 16510, "initiator_ip": "10.18.20.97", "responder_ip": "224.0.0.252", "initiator_port": 53100, "responder_port": 5355, "initiator_bytes": 128, "last_seen_epoch": "1575414483.890674", "responder_bytes": 0, "first_seen_epoch": "1575414483.793665" }, { "bytes": 482017, "stream": 444, "flow_id": "flow-ed2d0b20ea7f0e63d75a60d6", "packets": 608, "transport": "tcp", "last_frame": 21063, "first_frame": 16552, "initiator_ip": "10.18.20.97", "responder_ip": "171.161.198.200", "initiator_port": 49617, "responder_port": 443, "initiator_bytes": 17548, "last_seen_epoch": "1575414533.923912", "responder_bytes": 464469, "first_seen_epoch": "1575414484.720516" }, { "bytes": 33087, "stream": 445, "flow_id": "flow-9de6fadb43b1d305d5f6e94d", "packets": 55, "transport": "tcp", "last_frame": 21064, "first_frame": 16553, "initiator_ip": "10.18.20.97", "responder_ip": "171.161.198.200", "initiator_port": 49618, "responder_port": 443, "initiator_bytes": 3471, "last_seen_epoch": "1575414533.923996", "responder_bytes": 29616, "first_seen_epoch": "1575414484.722314" }, { "bytes": 297079, "stream": 446, "flow_id": "flow-3222709e53e7247220481020", "packets": 407, "transport": "tcp", "last_frame": 21065, "first_frame": 16554, "initiator_ip": "10.18.20.97", "responder_ip": "171.161.198.200", "initiator_port": 49619, "responder_port": 443, "initiator_bytes": 50071, "last_seen_epoch": "1575414533.924065", "responder_bytes": 247008, "first_seen_epoch": "1575414484.723481" }, { "bytes": 126672, "stream": 447, "flow_id": "flow-e42bde9c483c057e94768a2f", "packets": 181, "transport": "tcp", "last_frame": 21066, "first_frame": 16555, "initiator_ip": "10.18.20.97", "responder_ip": "171.161.198.200", "initiator_port": 49620, "responder_port": 443, "initiator_bytes": 11462, "last_seen_epoch": "1575414533.924135", "responder_bytes": 115210, "first_seen_epoch": "1575414484.724704" }, { "bytes": 2874, "stream": 448, "flow_id": "flow-f3c2b3ff871c4845d919f5e8", "packets": 14, "transport": "tcp", "last_frame": 21060, "first_frame": 16998, "initiator_ip": "10.18.20.97", "responder_ip": "171.161.198.200", "initiator_port": 49615, "responder_port": 443, "initiator_bytes": 1618, "last_seen_epoch": "1575414533.923469", "responder_bytes": 1256, "first_seen_epoch": "1575414486.776866" }, { "bytes": 265, "stream": 175, "flow_id": "flow-d35c7a93a270e52e4bacf8c3", "packets": 2, "transport": "udp", "last_frame": 17251, "first_frame": 17195, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 57206, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1575414487.898873", "responder_bytes": 193, "first_seen_epoch": "1575414487.621771" }, { "bytes": 276, "stream": 176, "flow_id": "flow-fe458ba170c273d28882fa59", "packets": 2, "transport": "udp", "last_frame": 17248, "first_frame": 17196, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 50672, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1575414487.898629", "responder_bytes": 204, "first_seen_epoch": "1575414487.622706" }, { "bytes": 220, "stream": 177, "flow_id": "flow-bfea13e8339a222ffb68920f", "packets": 2, "transport": "udp", "last_frame": 17247, "first_frame": 17197, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 55769, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1575414487.89851", "responder_bytes": 148, "first_seen_epoch": "1575414487.622818" }, { "bytes": 276, "stream": 178, "flow_id": "flow-a80dbc6418dda3a1f701989d", "packets": 2, "transport": "udp", "last_frame": 17249, "first_frame": 17198, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 62255, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1575414487.898713", "responder_bytes": 204, "first_seen_epoch": "1575414487.624217" }, { "bytes": 276, "stream": 179, "flow_id": "flow-7a3ff8ca1f9a84b3cc72f505", "packets": 2, "transport": "udp", "last_frame": 17250, "first_frame": 17199, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 61500, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1575414487.898793", "responder_bytes": 204, "first_seen_epoch": "1575414487.624494" }, { "bytes": 231, "stream": 180, "flow_id": "flow-c990a49d276920bf44c19095", "packets": 2, "transport": "udp", "last_frame": 17245, "first_frame": 17200, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 56618, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1575414487.898383", "responder_bytes": 159, "first_seen_epoch": "1575414487.625563" }, { "bytes": 1245, "stream": 449, "flow_id": "flow-b4a7c9e3034dc30e4d21e59a", "packets": 8, "transport": "tcp", "last_frame": 21093, "first_frame": 17298, "initiator_ip": "10.18.20.97", "responder_ip": "204.79.197.200", "initiator_port": 49621, "responder_port": 80, "initiator_bytes": 502, "last_seen_epoch": "1575414533.946508", "responder_bytes": 743, "first_seen_epoch": "1575414488.708693" }, { "bytes": 232, "stream": 450, "flow_id": "flow-4b6d9743eb997753d24d91c2", "packets": 4, "transport": "tcp", "last_frame": 21094, "first_frame": 17299, "initiator_ip": "10.18.20.97", "responder_ip": "204.79.197.200", "initiator_port": 49622, "responder_port": 80, "initiator_bytes": 174, "last_seen_epoch": "1575414533.94663", "responder_bytes": 58, "first_seen_epoch": "1575414488.70876" }, { "bytes": 430, "stream": 181, "flow_id": "flow-7201b8f603dc5480ba69a916", "packets": 2, "transport": "udp", "last_frame": 17335, "first_frame": 17334, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 63363, "responder_port": 53, "initiator_bytes": 87, "last_seen_epoch": "1575414489.184029", "responder_bytes": 343, "first_seen_epoch": "1575414489.08971" }, { "bytes": 8083, "stream": 451, "flow_id": "flow-c620019d0906ab4916a794e9", "packets": 26, "transport": "tcp", "last_frame": 19675, "first_frame": 17336, "initiator_ip": "10.18.20.97", "responder_ip": "66.235.147.244", "initiator_port": 49623, "responder_port": 443, "initiator_bytes": 2036, "last_seen_epoch": "1575414520.756097", "responder_bytes": 6047, "first_seen_epoch": "1575414489.185579" }, { "bytes": 4623, "stream": 452, "flow_id": "flow-cf56ed007c35e2868dce55af", "packets": 19, "transport": "tcp", "last_frame": 19678, "first_frame": 17337, "initiator_ip": "10.18.20.97", "responder_ip": "66.235.147.244", "initiator_port": 49624, "responder_port": 443, "initiator_bytes": 887, "last_seen_epoch": "1575414520.756439", "responder_bytes": 3736, "first_seen_epoch": "1575414489.185647" }, { "bytes": 319, "stream": 182, "flow_id": "flow-7a6347978693a72ee9406daf", "packets": 2, "transport": "udp", "last_frame": 17363, "first_frame": 17338, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 55281, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1575414489.352624", "responder_bytes": 237, "first_seen_epoch": "1575414489.185931" }, { "bytes": 319, "stream": 183, "flow_id": "flow-5a5d2507da633e7bc56774ed", "packets": 2, "transport": "udp", "last_frame": 17364, "first_frame": 17339, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 53540, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1575414489.352724", "responder_bytes": 237, "first_seen_epoch": "1575414489.187171" }, { "bytes": 319, "stream": 184, "flow_id": "flow-2b0fc18616e3bd4570d36f73", "packets": 2, "transport": "udp", "last_frame": 17359, "first_frame": 17340, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 63747, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1575414489.334625", "responder_bytes": 237, "first_seen_epoch": "1575414489.188976" }, { "bytes": 319, "stream": 185, "flow_id": "flow-088a6b8fb43095894dbc9a52", "packets": 2, "transport": "udp", "last_frame": 17386, "first_frame": 17347, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 56056, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1575414489.544905", "responder_bytes": 237, "first_seen_epoch": "1575414489.232049" }, { "bytes": 180, "stream": 186, "flow_id": "flow-ede58eb140078f652cec47bf", "packets": 2, "transport": "udp", "last_frame": 17389, "first_frame": 17348, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 54966, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1575414489.558324", "responder_bytes": 98, "first_seen_epoch": "1575414489.271248" }, { "bytes": 299247, "stream": 453, "flow_id": "flow-a310514129d649889adca961", "packets": 449, "transport": "tcp", "last_frame": 21062, "first_frame": 17360, "initiator_ip": "10.18.20.97", "responder_ip": "3.83.197.207", "initiator_port": 49625, "responder_port": 443, "initiator_bytes": 180696, "last_seen_epoch": "1575414533.923815", "responder_bytes": 118551, "first_seen_epoch": "1575414489.335367" }, { "bytes": 170499, "stream": 454, "flow_id": "flow-496ecef77b5b86cb43bdcfdf", "packets": 268, "transport": "tcp", "last_frame": 21069, "first_frame": 17361, "initiator_ip": "10.18.20.97", "responder_ip": "3.83.197.207", "initiator_port": 49626, "responder_port": 443, "initiator_bytes": 77440, "last_seen_epoch": "1575414533.9245", "responder_bytes": 93059, "first_seen_epoch": "1575414489.335576" }, { "bytes": 1000, "stream": 455, "flow_id": "flow-4d84c6ea6286ed850d34f32d", "packets": 10, "transport": "tcp", "last_frame": 21070, "first_frame": 17362, "initiator_ip": "10.18.20.97", "responder_ip": "171.161.198.200", "initiator_port": 49627, "responder_port": 443, "initiator_bytes": 609, "last_seen_epoch": "1575414533.924565", "responder_bytes": 391, "first_seen_epoch": "1575414489.349722" }, { "bytes": 176027, "stream": 456, "flow_id": "flow-aaf908a07e70e25877d1c14a", "packets": 269, "transport": "tcp", "last_frame": 21071, "first_frame": 17365, "initiator_ip": "10.18.20.97", "responder_ip": "54.175.7.235", "initiator_port": 49628, "responder_port": 443, "initiator_bytes": 89375, "last_seen_epoch": "1575414533.924631", "responder_bytes": 86652, "first_seen_epoch": "1575414489.353382" }, { "bytes": 114776, "stream": 457, "flow_id": "flow-f4cee7f28192b8cae7057619", "packets": 201, "transport": "tcp", "last_frame": 21072, "first_frame": 17366, "initiator_ip": "10.18.20.97", "responder_ip": "54.175.7.235", "initiator_port": 49629, "responder_port": 443, "initiator_bytes": 23245, "last_seen_epoch": "1575414533.924697", "responder_bytes": 91531, "first_seen_epoch": "1575414489.353525" }, { "bytes": 120930, "stream": 458, "flow_id": "flow-d5a81d1b5e9b81b32299cd31", "packets": 196, "transport": "tcp", "last_frame": 21055, "first_frame": 17367, "initiator_ip": "10.18.20.97", "responder_ip": "52.202.55.102", "initiator_port": 49630, "responder_port": 443, "initiator_bytes": 23700, "last_seen_epoch": "1575414533.818777", "responder_bytes": 97230, "first_seen_epoch": "1575414489.353793" }, { "bytes": 253783, "stream": 459, "flow_id": "flow-3a678f5a52428d4c57468513", "packets": 432, "transport": "tcp", "last_frame": 19595, "first_frame": 17368, "initiator_ip": "10.18.20.97", "responder_ip": "52.202.55.102", "initiator_port": 49631, "responder_port": 443, "initiator_bytes": 94080, "last_seen_epoch": "1575414519.360758", "responder_bytes": 159703, "first_seen_epoch": "1575414489.353846" }, { "bytes": 1000, "stream": 460, "flow_id": "flow-8afef6e64150a91c9a17fdf6", "packets": 10, "transport": "tcp", "last_frame": 21073, "first_frame": 17385, "initiator_ip": "10.18.20.97", "responder_ip": "171.161.198.200", "initiator_port": 49632, "responder_port": 443, "initiator_bytes": 609, "last_seen_epoch": "1575414533.924762", "responder_bytes": 391, "first_seen_epoch": "1575414489.414401" }, { "bytes": 47421, "stream": 461, "flow_id": "flow-4a8292f12f5f7cb83a47b1d6", "packets": 90, "transport": "tcp", "last_frame": 21074, "first_frame": 17387, "initiator_ip": "10.18.20.97", "responder_ip": "18.214.122.84", "initiator_port": 49633, "responder_port": 443, "initiator_bytes": 5432, "last_seen_epoch": "1575414533.92483", "responder_bytes": 41989, "first_seen_epoch": "1575414489.545722" }, { "bytes": 6330, "stream": 462, "flow_id": "flow-a1fca2ac4ac397e5c5475db9", "packets": 18, "transport": "tcp", "last_frame": 21075, "first_frame": 17388, "initiator_ip": "10.18.20.97", "responder_ip": "18.214.122.84", "initiator_port": 49634, "responder_port": 443, "initiator_bytes": 882, "last_seen_epoch": "1575414533.924895", "responder_bytes": 5448, "first_seen_epoch": "1575414489.54658" }, { "bytes": 4975, "stream": 463, "flow_id": "flow-f56f35bdf66a0b16cb3dce93", "packets": 17, "transport": "tcp", "last_frame": 21076, "first_frame": 17390, "initiator_ip": "10.18.20.97", "responder_ip": "199.255.32.89", "initiator_port": 49635, "responder_port": 443, "initiator_bytes": 828, "last_seen_epoch": "1575414533.924958", "responder_bytes": 4147, "first_seen_epoch": "1575414489.559231" }, { "bytes": 15817, "stream": 464, "flow_id": "flow-51e2eea6de98abe16c22ab4c", "packets": 36, "transport": "tcp", "last_frame": 21077, "first_frame": 17391, "initiator_ip": "10.18.20.97", "responder_ip": "199.255.32.89", "initiator_port": 49636, "responder_port": 443, "initiator_bytes": 8454, "last_seen_epoch": "1575414533.925025", "responder_bytes": 7363, "first_seen_epoch": "1575414489.5593" }, { "bytes": 176, "stream": 187, "flow_id": "flow-1d99f1b1da7697698c4fe4ac", "packets": 2, "transport": "udp", "last_frame": 18068, "first_frame": 17999, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 57212, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1575414490.617736", "responder_bytes": 96, "first_seen_epoch": "1575414490.527327" }, { "bytes": 6417, "stream": 465, "flow_id": "flow-34d9bcdce3289c32d36c147c", "packets": 21, "transport": "tcp", "last_frame": 21078, "first_frame": 18069, "initiator_ip": "10.18.20.97", "responder_ip": "129.33.138.31", "initiator_port": 49637, "responder_port": 443, "initiator_bytes": 1675, "last_seen_epoch": "1575414533.925192", "responder_bytes": 4742, "first_seen_epoch": "1575414490.618237" }, { "bytes": 4783, "stream": 466, "flow_id": "flow-232504535cd919a39de3c013", "packets": 17, "transport": "tcp", "last_frame": 21079, "first_frame": 18070, "initiator_ip": "10.18.20.97", "responder_ip": "129.33.138.31", "initiator_port": 49638, "responder_port": 443, "initiator_bytes": 826, "last_seen_epoch": "1575414533.925274", "responder_bytes": 3957, "first_seen_epoch": "1575414490.618437" }, { "bytes": 170911, "stream": 467, "flow_id": "flow-d8a3dbe80cc7de30d8c98227", "packets": 269, "transport": "tcp", "last_frame": 21080, "first_frame": 18147, "initiator_ip": "10.18.20.97", "responder_ip": "54.175.7.235", "initiator_port": 49639, "responder_port": 443, "initiator_bytes": 87020, "last_seen_epoch": "1575414533.925337", "responder_bytes": 83891, "first_seen_epoch": "1575414491.07074" }, { "bytes": 49658, "stream": 468, "flow_id": "flow-54761868a8f642c570d5ab70", "packets": 70, "transport": "tcp", "last_frame": 21081, "first_frame": 18148, "initiator_ip": "10.18.20.97", "responder_ip": "52.202.55.102", "initiator_port": 49640, "responder_port": 443, "initiator_bytes": 5139, "last_seen_epoch": "1575414533.925404", "responder_bytes": 44519, "first_seen_epoch": "1575414491.071829" }, { "bytes": 86302, "stream": 469, "flow_id": "flow-3cae9651a548396e92a93b98", "packets": 149, "transport": "tcp", "last_frame": 21082, "first_frame": 18163, "initiator_ip": "10.18.20.97", "responder_ip": "54.175.7.235", "initiator_port": 49641, "responder_port": 443, "initiator_bytes": 14154, "last_seen_epoch": "1575414533.925462", "responder_bytes": 72148, "first_seen_epoch": "1575414491.080191" }, { "bytes": 29454, "stream": 470, "flow_id": "flow-4c06b6db113cf1026483cbbc", "packets": 53, "transport": "tcp", "last_frame": 21083, "first_frame": 18168, "initiator_ip": "10.18.20.97", "responder_ip": "52.202.55.102", "initiator_port": 49642, "responder_port": 443, "initiator_bytes": 4449, "last_seen_epoch": "1575414533.925521", "responder_bytes": 25005, "first_seen_epoch": "1575414491.085396" }, { "bytes": 208, "stream": 188, "flow_id": "flow-9e53778cc7783d76f8def584", "packets": 2, "transport": "udp", "last_frame": 18644, "first_frame": 18643, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 58937, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1575414491.788534", "responder_bytes": 127, "first_seen_epoch": "1575414491.729589" }, { "bytes": 8516, "stream": 471, "flow_id": "flow-1ebb644cf9bccf56c7b76d46", "packets": 22, "transport": "tcp", "last_frame": 19496, "first_frame": 18645, "initiator_ip": "10.18.20.97", "responder_ip": "171.161.202.100", "initiator_port": 49643, "responder_port": 443, "initiator_bytes": 1980, "last_seen_epoch": "1575414515.502007", "responder_bytes": 6536, "first_seen_epoch": "1575414491.789118" }, { "bytes": 6162, "stream": 472, "flow_id": "flow-6f766d453711531d1e957c12", "packets": 18, "transport": "tcp", "last_frame": 19374, "first_frame": 18646, "initiator_ip": "10.18.20.97", "responder_ip": "171.161.202.100", "initiator_port": 49644, "responder_port": 443, "initiator_bytes": 811, "last_seen_epoch": "1575414512.392978", "responder_bytes": 5351, "first_seen_epoch": "1575414491.789275" }, { "bytes": 29243, "stream": 473, "flow_id": "flow-02543c20b715cfb0204876b5", "packets": 48, "transport": "tcp", "last_frame": 21084, "first_frame": 18846, "initiator_ip": "10.18.20.97", "responder_ip": "54.175.7.235", "initiator_port": 49645, "responder_port": 443, "initiator_bytes": 5661, "last_seen_epoch": "1575414533.925591", "responder_bytes": 23582, "first_seen_epoch": "1575414492.466492" }, { "bytes": 342, "stream": 189, "flow_id": "flow-f4559e5b92c96c84a4a6a2fd", "packets": 2, "transport": "udp", "last_frame": 18913, "first_frame": 18877, "initiator_ip": "10.18.20.97", "responder_ip": "10.18.20.8", "initiator_port": 58325, "responder_port": 53, "initiator_bytes": 93, "last_seen_epoch": "1575414494.106735", "responder_bytes": 249, "first_seen_epoch": "1575414493.246643" }, { "bytes": 37629, "stream": 474, "flow_id": "flow-fe7a7a79bc20299e26b95792", "packets": 69, "transport": "tcp", "last_frame": 21085, "first_frame": 18878, "initiator_ip": "10.18.20.97", "responder_ip": "54.175.7.235", "initiator_port": 49646, "responder_port": 443, "initiator_bytes": 11648, "last_seen_epoch": "1575414533.925679", "responder_bytes": 25981, "first_seen_epoch": "1575414493.25433" }, { "bytes": 4682, "stream": 475, "flow_id": "flow-e91ffe33ae542b201e33964c", "packets": 16, "transport": "tcp", "last_frame": 21068, "first_frame": 18914, "initiator_ip": "10.18.20.97", "responder_ip": "52.71.154.85", "initiator_port": 49647, "responder_port": 443, "initiator_bytes": 839, "last_seen_epoch": "1575414533.924432", "responder_bytes": 3843, "first_seen_epoch": "1575414494.107151" }, { "bytes": 44204, "stream": 476, "flow_id": "flow-bf0711d825aea2eda8f43892", "packets": 78, "transport": "tcp", "last_frame": 21086, "first_frame": 18915, "initiator_ip": "10.18.20.97", "responder_ip": "52.71.154.85", "initiator_port": 49648, "responder_port": 443, "initiator_bytes": 3853, "last_seen_epoch": "1575414533.925743", "responder_bytes": 40351, "first_seen_epoch": "1575414494.107283" }, { "bytes": 44600, "stream": 477, "flow_id": "flow-1b1342088ef49b8f1c5d2caf", "packets": 71, "transport": "tcp", "last_frame": 21095, "first_frame": 19400, "initiator_ip": "10.18.20.97", "responder_ip": "72.21.81.200", "initiator_port": 49649, "responder_port": 443, "initiator_bytes": 2557, "last_seen_epoch": "1575414533.946761", "responder_bytes": 42043, "first_seen_epoch": "1575414513.693605" }, { "bytes": 8627, "stream": 478, "flow_id": "flow-34dc21d0c6ea6430765d0ac3", "packets": 21, "transport": "tcp", "last_frame": 21092, "first_frame": 19401, "initiator_ip": "10.18.20.97", "responder_ip": "72.21.81.200", "initiator_port": 49650, "responder_port": 443, "initiator_bytes": 936, "last_seen_epoch": "1575414533.946197", "responder_bytes": 7691, "first_seen_epoch": "1575414513.693684" }, { "bytes": 1424, "stream": 479, "flow_id": "flow-f93ff29bf56311c4e4f36aa8", "packets": 16, "transport": "tcp", "last_frame": 21058, "first_frame": 19679, "initiator_ip": "10.18.20.97", "responder_ip": "66.235.147.244", "initiator_port": 49651, "responder_port": 443, "initiator_bytes": 790, "last_seen_epoch": "1575414533.905245", "responder_bytes": 634, "first_seen_epoch": "1575414520.756594" }, { "bytes": 4373, "stream": 480, "flow_id": "flow-1105443e8b6230c962853882", "packets": 16, "transport": "tcp", "last_frame": 21067, "first_frame": 19680, "initiator_ip": "10.18.20.97", "responder_ip": "66.235.147.244", "initiator_port": 49652, "responder_port": 443, "initiator_bytes": 2107, "last_seen_epoch": "1575414533.924301", "responder_bytes": 2266, "first_seen_epoch": "1575414520.756702" }, { "bytes": 1020, "stream": 481, "flow_id": "flow-3ec03f72fc25c18b8ccba9a3", "packets": 10, "transport": "tcp", "last_frame": 21091, "first_frame": 20040, "initiator_ip": "10.18.20.97", "responder_ip": "52.202.55.102", "initiator_port": 49653, "responder_port": 443, "initiator_bytes": 623, "last_seen_epoch": "1575414533.926151", "responder_bytes": 397, "first_seen_epoch": "1575414522.07294" }, { "bytes": 1020, "stream": 482, "flow_id": "flow-d3da3841bb61a212c2c6c6aa", "packets": 10, "transport": "tcp", "last_frame": 21087, "first_frame": 20059, "initiator_ip": "10.18.20.97", "responder_ip": "54.175.7.235", "initiator_port": 49654, "responder_port": 443, "initiator_bytes": 623, "last_seen_epoch": "1575414533.925809", "responder_bytes": 397, "first_seen_epoch": "1575414522.252695" }, { "bytes": 1020, "stream": 483, "flow_id": "flow-c229d652ba71b4ab1d5de9ba", "packets": 10, "transport": "tcp", "last_frame": 21088, "first_frame": 20153, "initiator_ip": "10.18.20.97", "responder_ip": "54.175.7.235", "initiator_port": 49655, "responder_port": 443, "initiator_bytes": 623, "last_seen_epoch": "1575414533.925905", "responder_bytes": 397, "first_seen_epoch": "1575414522.456661" }, { "bytes": 1020, "stream": 484, "flow_id": "flow-85f31831efba724fd3572628", "packets": 10, "transport": "tcp", "last_frame": 21089, "first_frame": 20154, "initiator_ip": "10.18.20.97", "responder_ip": "54.175.7.235", "initiator_port": 49656, "responder_port": 443, "initiator_bytes": 623, "last_seen_epoch": "1575414533.925996", "responder_bytes": 397, "first_seen_epoch": "1575414522.459515" }, { "bytes": 1020, "stream": 485, "flow_id": "flow-b0daf2ed26da509f8c467643", "packets": 10, "transport": "tcp", "last_frame": 21059, "first_frame": 20355, "initiator_ip": "10.18.20.97", "responder_ip": "54.175.7.235", "initiator_port": 49657, "responder_port": 443, "initiator_bytes": 623, "last_seen_epoch": "1575414533.923199", "responder_bytes": 397, "first_seen_epoch": "1575414522.920165" }, { "bytes": 1020, "stream": 486, "flow_id": "flow-d5bc59849abd421b7d6ea6f1", "packets": 10, "transport": "tcp", "last_frame": 21090, "first_frame": 20361, "initiator_ip": "10.18.20.97", "responder_ip": "52.202.55.102", "initiator_port": 49658, "responder_port": 443, "initiator_bytes": 623, "last_seen_epoch": "1575414533.92608", "responder_bytes": 397, "first_seen_epoch": "1575414522.938425" }, { "bytes": 264, "stream": 190, "flow_id": "flow-418b71ed5516e15bcc6016cb", "packets": 2, "transport": "udp", "last_frame": 21099, "first_frame": 21098, "initiator_ip": "10.18.20.97", "responder_ip": "193.183.98.66", "initiator_port": 55759, "responder_port": 53, "initiator_bytes": 71, "last_seen_epoch": "1575414657.443819", "responder_bytes": 193, "first_seen_epoch": "1575414657.235731" }, { "bytes": 1358, "stream": 487, "flow_id": "flow-9421eaeb3714de3c7ca731ef", "packets": 9, "transport": "tcp", "last_frame": 21108, "first_frame": 21100, "initiator_ip": "10.18.20.97", "responder_ip": "8.208.24.139", "initiator_port": 49659, "responder_port": 80, "initiator_bytes": 855, "last_seen_epoch": "1575414658.308629", "responder_bytes": 503, "first_seen_epoch": "1575414657.445848" }, { "bytes": 264, "stream": 191, "flow_id": "flow-0d89f817db4c4bd133babeb8", "packets": 2, "transport": "udp", "last_frame": 21110, "first_frame": 21109, "initiator_ip": "10.18.20.97", "responder_ip": "193.183.98.66", "initiator_port": 63644, "responder_port": 53, "initiator_bytes": 71, "last_seen_epoch": "1575414658.500356", "responder_bytes": 193, "first_seen_epoch": "1575414658.310606" }, { "bytes": 1482, "stream": 488, "flow_id": "flow-bb5daa9e2e3c5f4ca2ff1efb", "packets": 11, "transport": "tcp", "last_frame": 21121, "first_frame": 21111, "initiator_ip": "10.18.20.97", "responder_ip": "8.208.24.139", "initiator_port": 49660, "responder_port": 80, "initiator_bytes": 925, "last_seen_epoch": "1575414659.434778", "responder_bytes": 557, "first_seen_epoch": "1575414658.501426" }, { "bytes": 264, "stream": 192, "flow_id": "flow-c6eef603a385e8a5d3f5ee05", "packets": 2, "transport": "udp", "last_frame": 21123, "first_frame": 21122, "initiator_ip": "10.18.20.97", "responder_ip": "193.183.98.66", "initiator_port": 57089, "responder_port": 53, "initiator_bytes": 71, "last_seen_epoch": "1575414669.784425", "responder_bytes": 193, "first_seen_epoch": "1575414669.448772" }, { "bytes": 26293, "stream": 489, "flow_id": "flow-4103a569ae93ec1728c867d7", "packets": 41, "transport": "tcp", "last_frame": 21164, "first_frame": 21124, "initiator_ip": "10.18.20.97", "responder_ip": "8.208.24.139", "initiator_port": 49661, "responder_port": 80, "initiator_bytes": 24926, "last_seen_epoch": "1575414671.928875", "responder_bytes": 1367, "first_seen_epoch": "1575414669.785692" } ], "events": { "dns": [ { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.Icemaiden-DC.icemaiden.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-47f25d5be450b891a521aacc", "src_port": 59102, "tcp_stream": null, "udp_stream": 0, "frame_number": 195, "timestamp_epoch": "1575413122.764317000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.Icemaiden-DC.icemaiden.com", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 59102, "event_id": "evt-40a56780fc518dc7b2eded70", "src_port": 53, "tcp_stream": null, "udp_stream": 0, "frame_number": 196, "timestamp_epoch": "1575413122.764586000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "_ldap._tcp.Icemaiden-DC.icemaiden.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-a946af1cd3667b9a96a14cae", "src_port": 53522, "tcp_stream": null, "udp_stream": 1, "frame_number": 197, "timestamp_epoch": "1575413122.765075000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.qry.name": "_ldap._tcp.Icemaiden-DC.icemaiden.com", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 53522, "event_id": "evt-58f5b7c2d2c22cd0f93c6e03", "src_port": 53, "tcp_stream": null, "udp_stream": 1, "frame_number": 198, "timestamp_epoch": "1575413122.765282000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-f6c2d0066fbc401f3f395d94", "src_port": 52634, "tcp_stream": null, "udp_stream": 2, "frame_number": 253, "timestamp_epoch": "1575413123.292845000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "131.107.255.255", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 52634, "event_id": "evt-f4a27dec2218a515c8b1e7bf", "src_port": 53, "tcp_stream": null, "udp_stream": 2, "frame_number": 257, "timestamp_epoch": "1575413123.352446000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "28", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-7b3a521f5a886f8ba7b53e07", "src_port": 62941, "tcp_stream": null, "udp_stream": 3, "frame_number": 258, "timestamp_epoch": "1575413123.353131000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.aaaa": "fd3e:4f5a:5b81::1", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "28", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 62941, "event_id": "evt-7c4b182b8c5d0c9b7c537b1c", "src_port": 53, "tcp_stream": null, "udp_stream": 3, "frame_number": 259, "timestamp_epoch": "1575413123.412011000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "mail.aol.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-4da6564110cc5798c218f013", "src_port": 63849, "tcp_stream": null, "udp_stream": 4, "frame_number": 275, "timestamp_epoch": "1575413155.172788000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "69.147.64.34,69.147.64.33", "dns.cname": "geoycpi-uno.gycpi.b.yahoodns.net", "dns.qry.name": "mail.aol.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 63849, "event_id": "evt-19b1afe8250fbd5bdb558d57", "src_port": 53, "tcp_stream": null, "udp_stream": 4, "frame_number": 276, "timestamp_epoch": "1575413155.227694000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "oidc.mail.aol.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-9689c4da1f3626fc653021d1", "src_port": 57937, "tcp_stream": null, "udp_stream": 6, "frame_number": 307, "timestamp_epoch": "1575413156.673565000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "67.195.204.151,98.137.156.136", "dns.cname": "ds-ats.member.g02.yahoodns.net", "dns.qry.name": "oidc.mail.aol.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 57937, "event_id": "evt-74909155f175179ccd33cf23", "src_port": 53, "tcp_stream": null, "udp_stream": 6, "frame_number": 308, "timestamp_epoch": "1575413156.734046000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "api.login.aol.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-01508a048b3767061e1b5fdf", "src_port": 63013, "tcp_stream": null, "udp_stream": 7, "frame_number": 351, "timestamp_epoch": "1575413157.216685000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "98.137.156.136,67.195.204.151", "dns.cname": "ds-ats.member.g02.yahoodns.net", "dns.qry.name": "api.login.aol.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 63013, "event_id": "evt-7e708aa32fc27967f1a5849c", "src_port": 53, "tcp_stream": null, "udp_stream": 7, "frame_number": 352, "timestamp_epoch": "1575413157.278971000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "login.aol.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-a6191d0e5c0a9d6e066e4611", "src_port": 62613, "tcp_stream": null, "udp_stream": 8, "frame_number": 398, "timestamp_epoch": "1575413157.773625000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "67.195.204.151,98.137.156.136", "dns.cname": "ds-ats.member.g02.yahoodns.net", "dns.qry.name": "login.aol.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 62613, "event_id": "evt-747a168f1425723584782562", "src_port": 53, "tcp_stream": null, "udp_stream": 8, "frame_number": 399, "timestamp_epoch": "1575413157.843186000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "s.yimg.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-5e907b4b076dcc52e9a5468f", "src_port": 59748, "tcp_stream": null, "udp_stream": 9, "frame_number": 502, "timestamp_epoch": "1575413158.880779000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "69.147.64.34,69.147.64.33", "dns.cname": "edge.gycpi.b.yahoodns.net", "dns.qry.name": "s.yimg.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 59748, "event_id": "evt-92ce51812543cff84716bda5", "src_port": 53, "tcp_stream": null, "udp_stream": 9, "frame_number": 504, "timestamp_epoch": "1575413158.967341000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-f3384e91b1927d1b5e6fb02b", "src_port": 57621, "tcp_stream": null, "udp_stream": 10, "frame_number": 550, "timestamp_epoch": "1575413159.406992000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "api.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-4c61f039a20f16471451c88c", "src_port": 63874, "tcp_stream": null, "udp_stream": 11, "frame_number": 551, "timestamp_epoch": "1575413159.407057000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "api.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-bc883a559d297db8cdf472cc", "src_port": 59279, "tcp_stream": null, "udp_stream": 12, "frame_number": 552, "timestamp_epoch": "1575413159.407211000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-6775ed03b6a895c993886e80", "src_port": 50702, "tcp_stream": null, "udp_stream": 13, "frame_number": 553, "timestamp_epoch": "1575413159.407451000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-8608bf6efa31f4f9931bcddd", "src_port": 61598, "tcp_stream": null, "udp_stream": 14, "frame_number": 554, "timestamp_epoch": "1575413159.407503000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-b65aff809de9df7cef07a89d", "src_port": 52900, "tcp_stream": null, "udp_stream": 15, "frame_number": 555, "timestamp_epoch": "1575413159.407726000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,dual-a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 50702, "event_id": "evt-bb124aea104582731a82ad11", "src_port": 53, "tcp_stream": null, "udp_stream": 13, "frame_number": 556, "timestamp_epoch": "1575413159.571651000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,dual-a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 61598, "event_id": "evt-f681a252b4c31a0bb5d17e1c", "src_port": 53, "tcp_stream": null, "udp_stream": 14, "frame_number": 557, "timestamp_epoch": "1575413159.571721000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,dual-a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 52900, "event_id": "evt-d364d01bbb497ffc10b7576e", "src_port": 53, "tcp_stream": null, "udp_stream": 15, "frame_number": 558, "timestamp_epoch": "1575413159.571772000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,dual-a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 57621, "event_id": "evt-3d3f8b6b535379a420a37631", "src_port": 53, "tcp_stream": null, "udp_stream": 10, "frame_number": 559, "timestamp_epoch": "1575413159.571825000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "13.107.5.80", "dns.cname": "api-bing-com.e-0001.e-msedge.net,e-0001.e-msedge.net", "dns.qry.name": "api.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 63874, "event_id": "evt-4a9a5253f56b34f6f4eac858", "src_port": 53, "tcp_stream": null, "udp_stream": 11, "frame_number": 560, "timestamp_epoch": "1575413159.571932000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "13.107.5.80", "dns.cname": "api-bing-com.e-0001.e-msedge.net,e-0001.e-msedge.net", "dns.qry.name": "api.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 59279, "event_id": "evt-72ae25a9257a77be27d02569", "src_port": 53, "tcp_stream": null, "udp_stream": 12, "frame_number": 561, "timestamp_epoch": "1575413159.572020000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "udc.yahoo.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-cb09c5daf428f92454c337d7", "src_port": 63690, "tcp_stream": null, "udp_stream": 16, "frame_number": 639, "timestamp_epoch": "1575413160.313364000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "geo.yahoo.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-945722b4ff387f259a0f74bc", "src_port": 55634, "tcp_stream": null, "udp_stream": 17, "frame_number": 640, "timestamp_epoch": "1575413160.316417000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "fc.yahoo.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-882e35605de989069c79efa8", "src_port": 59976, "tcp_stream": null, "udp_stream": 18, "frame_number": 641, "timestamp_epoch": "1575413160.335721000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "66.218.84.42,74.6.228.137,74.6.228.136,66.218.84.43", "dns.cname": "ds-geoycpi-uno-lite.gycpi.b.yahoodns.net", "dns.qry.name": "udc.yahoo.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 63690, "event_id": "evt-7ca7e3e9f16e638decfd3334", "src_port": 53, "tcp_stream": null, "udp_stream": 16, "frame_number": 644, "timestamp_epoch": "1575413160.441484000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "98.137.156.137,66.218.87.15", "dns.cname": "fam-geo-atsv2.prod.media.g03.yahoodns.net", "dns.qry.name": "geo.yahoo.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 55634, "event_id": "evt-061c25ceadbfde3628b55c11", "src_port": 53, "tcp_stream": null, "udp_stream": 17, "frame_number": 647, "timestamp_epoch": "1575413160.623478000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "69.147.64.34,69.147.64.33", "dns.cname": "sdarlasplitroute.gapx.yahoodns.net", "dns.qry.name": "fc.yahoo.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 59976, "event_id": "evt-d39fd26763cd1ebe872e1883", "src_port": 53, "tcp_stream": null, "udp_stream": 18, "frame_number": 648, "timestamp_epoch": "1575413160.623583000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "us.y.atwola.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-897612d840f234d7c9d084b0", "src_port": 60225, "tcp_stream": null, "udp_stream": 19, "frame_number": 919, "timestamp_epoch": "1575413162.712452000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "opus.analytics.yahoo.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-1fad5a267f91d699f3198bb3", "src_port": 49658, "tcp_stream": null, "udp_stream": 20, "frame_number": 920, "timestamp_epoch": "1575413162.714269000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "tag.sp.advertising.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-fb6fdc2c4bc7fced26ba0e41", "src_port": 49423, "tcp_stream": null, "udp_stream": 21, "frame_number": 921, "timestamp_epoch": "1575413162.716337000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "152.199.24.48", "dns.cname": "cs964.wpc.9465e.mucdn.net,cs964199420.wpc.mucdn.net", "dns.qry.name": "opus.analytics.yahoo.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 49658, "event_id": "evt-72ade3f4bfe431dfba7a4628", "src_port": 53, "tcp_stream": null, "udp_stream": 20, "frame_number": 928, "timestamp_epoch": "1575413162.912415000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "152.195.32.163", "dns.cname": "cs747173190.wac.omegacdn.net", "dns.qry.name": "tag.sp.advertising.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 49423, "event_id": "evt-5c6bbdb67d52eee994ac82e1", "src_port": 53, "tcp_stream": null, "udp_stream": 21, "frame_number": 929, "timestamp_epoch": "1575413162.912621000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "152.199.6.14", "dns.cname": "cs670.wpc.thetacdn.net,cs670.lb.wpc.apr-1b09e.edgecastdns.net,cs936.wpc.thetacdn.net", "dns.qry.name": "us.y.atwola.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 60225, "event_id": "evt-e57a3cbc6f355944f5c48129", "src_port": 53, "tcp_stream": null, "udp_stream": 19, "frame_number": 934, "timestamp_epoch": "1575413162.915618000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "aka-cdn.adtechus.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-8f9194b2b73bcce09268400c", "src_port": 52091, "tcp_stream": null, "udp_stream": 22, "frame_number": 1037, "timestamp_epoch": "1575413163.086015000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "ad.doubleclick.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-8bb9f9d5f10219021b27411e", "src_port": 56275, "tcp_stream": null, "udp_stream": 23, "frame_number": 1040, "timestamp_epoch": "1575413163.088488000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "172.217.14.166", "dns.cname": "dart.l.doubleclick.net", "dns.qry.name": "ad.doubleclick.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 56275, "event_id": "evt-e8d1dc7f3b855c62e8da5799", "src_port": 53, "tcp_stream": null, "udp_stream": 23, "frame_number": 1069, "timestamp_epoch": "1575413163.198550000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "152.199.6.11", "dns.cname": "cs704.wpc.thetacdn.net,cs701.lb.wpc.apr-1b09e.edgecastdns.net,cs1697.wpc.thetacdn.net", "dns.qry.name": "aka-cdn.adtechus.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 52091, "event_id": "evt-d96b4aeea5a8a0268e2a1584", "src_port": 53, "tcp_stream": null, "udp_stream": 22, "frame_number": 1072, "timestamp_epoch": "1575413163.219942000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "tag.idsync.analytics.yahoo.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-40dcd35cedbeab2f32a3d181", "src_port": 59553, "tcp_stream": null, "udp_stream": 24, "frame_number": 1103, "timestamp_epoch": "1575413163.334867000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "152.195.14.41", "dns.cname": "cs815.wac.84914.omegacdn.net,cs815200983.wac.omegacdn.net", "dns.qry.name": "tag.idsync.analytics.yahoo.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 59553, "event_id": "evt-fdd9d3acb2e69a0f0cf14dac", "src_port": 53, "tcp_stream": null, "udp_stream": 24, "frame_number": 1144, "timestamp_epoch": "1575413163.522891000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "s0.2mdn.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-d5797cab3b66f78a6f3d7627", "src_port": 54089, "tcp_stream": null, "udp_stream": 25, "frame_number": 1395, "timestamp_epoch": "1575413164.035420000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "geo.moatads.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-5437a113bbd25c22b539cc92", "src_port": 54576, "tcp_stream": null, "udp_stream": 26, "frame_number": 1430, "timestamp_epoch": "1575413164.247294000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "apx.moatads.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-c7f67e58df0151c3ab323f8f", "src_port": 62857, "tcp_stream": null, "udp_stream": 27, "frame_number": 1431, "timestamp_epoch": "1575413164.249265000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "172.217.12.38", "dns.cname": "s0-2mdn-net.l.google.com", "dns.qry.name": "s0.2mdn.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 54089, "event_id": "evt-70c19bf7994ede380408a1b6", "src_port": 53, "tcp_stream": null, "udp_stream": 25, "frame_number": 1448, "timestamp_epoch": "1575413164.452822000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "cms.analytics.yahoo.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-d5e2cf428b1b52b65d03a31c", "src_port": 62337, "tcp_stream": null, "udp_stream": 28, "frame_number": 1598, "timestamp_epoch": "1575413164.774429000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "apx.moatads.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-0f325ae276a497004864db4f", "src_port": 62857, "tcp_stream": null, "udp_stream": 27, "frame_number": 2058, "timestamp_epoch": "1575413165.535569000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "geo.moatads.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-6af865ab69f583ca59f8f67b", "src_port": 54576, "tcp_stream": null, "udp_stream": 26, "frame_number": 2059, "timestamp_epoch": "1575413165.536404000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "cms.analytics.yahoo.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-64b57ea17f0b041e1cd9ec58", "src_port": 62337, "tcp_stream": null, "udp_stream": 28, "frame_number": 2213, "timestamp_epoch": "1575413165.783856000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "34.232.64.168", "dns.cname": "pixel.moatads.com,pool9.moatads.com", "dns.qry.name": "apx.moatads.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 62857, "event_id": "evt-72aac51ee5231d2adbd0623c", "src_port": 53, "tcp_stream": null, "udp_stream": 27, "frame_number": 2214, "timestamp_epoch": "1575413165.990675000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "3.136.40.187,3.136.2.145,3.136.4.126,3.13.100.77,3.135.8.221,3.18.142.126,18.190.121.125,3.19.254.171", "dns.cname": "ecs.mb.moatads.com,us-east-1.ecs.mb.moatads.com,nado-ecs-lb-us-east-2-1690985176.us-east-2.elb.amazonaws.com", "dns.qry.name": "geo.moatads.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 54576, "event_id": "evt-2a1b91d801ffb726ffaf74a7", "src_port": 53, "tcp_stream": null, "udp_stream": 26, "frame_number": 2223, "timestamp_epoch": "1575413165.992964000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "98.137.155.9", "dns.cname": "spcms-global.pbp.gysm.yahoodns.net", "dns.qry.name": "cms.analytics.yahoo.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 62337, "event_id": "evt-ad76fe172d71a8ccab89c3fa", "src_port": 53, "tcp_stream": null, "udp_stream": 28, "frame_number": 2224, "timestamp_epoch": "1575413165.993066000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "service.idsync.analytics.yahoo.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-db677f7873c40a78711ee2f5", "src_port": 53972, "tcp_stream": null, "udp_stream": 29, "frame_number": 2499, "timestamp_epoch": "1575413166.433997000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "3.220.227.225,54.88.96.255,54.209.58.223", "dns.cname": "service.sp.aolp-ds-prd.aws.oath.cloud", "dns.qry.name": "service.idsync.analytics.yahoo.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 53972, "event_id": "evt-1c400fca18f98c61af767ae8", "src_port": 53, "tcp_stream": null, "udp_stream": 29, "frame_number": 2546, "timestamp_epoch": "1575413166.668934000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "tags.bluekai.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-28879228dac0318448144f19", "src_port": 50143, "tcp_stream": null, "udp_stream": 30, "frame_number": 2643, "timestamp_epoch": "1575413167.102944000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "aa.agkn.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-19e5e9cc2731141b443ceaa9", "src_port": 53487, "tcp_stream": null, "udp_stream": 31, "frame_number": 2655, "timestamp_epoch": "1575413167.132764000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "audex.userreport.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-0252446e5806769fe8c8d6a7", "src_port": 58876, "tcp_stream": null, "udp_stream": 32, "frame_number": 2658, "timestamp_epoch": "1575413167.147746000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "156.154.202.36,156.154.136.36", "dns.qry.name": "aa.agkn.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 53487, "event_id": "evt-6da4b373e58b71fcfcb1b9e0", "src_port": 53, "tcp_stream": null, "udp_stream": 31, "frame_number": 2659, "timestamp_epoch": "1575413167.210776000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "99.86.77.108,99.86.77.59,99.86.77.5,99.86.77.3", "dns.cname": "d2u28gf9o4d1cv.cloudfront.net", "dns.qry.name": "audex.userreport.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 58876, "event_id": "evt-9a5439ffd28592bb319f83cb", "src_port": 53, "tcp_stream": null, "udp_stream": 32, "frame_number": 2663, "timestamp_epoch": "1575413167.216789000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "96.6.83.178", "dns.cname": "tags.bluekai.com.edgekey.net,e13541.x.akamaiedge.net", "dns.qry.name": "tags.bluekai.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 50143, "event_id": "evt-0e8a4e222c0c4f1f1978a3c0", "src_port": 53, "tcp_stream": null, "udp_stream": 30, "frame_number": 2668, "timestamp_epoch": "1575413167.222296000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "dpm.demdex.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-3f3361da4d5c7f6f0ded9c59", "src_port": 57021, "tcp_stream": null, "udp_stream": 33, "frame_number": 2677, "timestamp_epoch": "1575413167.227450000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "54.186.165.46,52.39.132.98,52.38.185.101,52.42.99.244,52.43.190.106,35.161.118.229,35.165.180.187,52.36.218.9", "dns.cname": "gslb-2.demdex.net,edge-usw2.demdex.net,dcs-edge-usw2-620097651.us-west-2.elb.amazonaws.com", "dns.qry.name": "dpm.demdex.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 57021, "event_id": "evt-6dc9dbb560d5b1a7e1e87838", "src_port": 53, "tcp_stream": null, "udp_stream": 33, "frame_number": 2703, "timestamp_epoch": "1575413167.311200000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "iecvlist.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-477fa2ac5c3ef3ba7965a2d1", "src_port": 52911, "tcp_stream": null, "udp_stream": 34, "frame_number": 2890, "timestamp_epoch": "1575413185.149414000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "r20swj13mr.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-34d7f9ef6f4c8ad0d733ca81", "src_port": 49314, "tcp_stream": null, "udp_stream": 35, "frame_number": 2891, "timestamp_epoch": "1575413185.149481000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "72.21.81.200", "dns.cname": "ie9comview.vo.msecnd.net,cs9.wpc.v0cdn.net", "dns.qry.name": "iecvlist.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 52911, "event_id": "evt-ca62fc01e3df350910be48c9", "src_port": 53, "tcp_stream": null, "udp_stream": 34, "frame_number": 2902, "timestamp_epoch": "1575413185.249277000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "72.21.81.200", "dns.cname": "ie9comview.vo.msecnd.net,cs9.wpc.v0cdn.net", "dns.qry.name": "r20swj13mr.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 49314, "event_id": "evt-d4eab9a6d2ec506f40b2c7f0", "src_port": 53, "tcp_stream": null, "udp_stream": 35, "frame_number": 2904, "timestamp_epoch": "1575413185.267497000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "uipus.semasio.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-fb063104f6cdd00037133acc", "src_port": 63591, "tcp_stream": null, "udp_stream": 37, "frame_number": 3572, "timestamp_epoch": "1575413212.793168000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "50.57.31.206", "dns.qry.name": "uipus.semasio.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 63591, "event_id": "evt-ef709ab44d7ca9c0282bd2e8", "src_port": 53, "tcp_stream": null, "udp_stream": 37, "frame_number": 3573, "timestamp_epoch": "1575413212.855201000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "track.adform.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-d852ab4eba8b1b0a3c40395b", "src_port": 59064, "tcp_stream": null, "udp_stream": 38, "frame_number": 3632, "timestamp_epoch": "1575413213.379305000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "37.157.6.246,37.157.4.41,37.157.4.23,37.157.2.236,37.157.6.252,37.157.2.237", "dns.cname": "track-eu.adformnet.akadns.net", "dns.qry.name": "track.adform.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 59064, "event_id": "evt-bafb0100242b64b5edd8646b", "src_port": 53, "tcp_stream": null, "udp_stream": 38, "frame_number": 3635, "timestamp_epoch": "1575413213.479991000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "guce.aol.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-fcd9b7606acb705349f8c4ef", "src_port": 51589, "tcp_stream": null, "udp_stream": 39, "frame_number": 3794, "timestamp_epoch": "1575413237.817285000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "107.23.73.96,54.236.178.170,18.232.193.181,3.225.187.149,54.145.171.0,18.208.41.141", "dns.cname": "real.rotation.guce.aws.oath.cloud,prod-rotation-v2.guce.aws.oath.cloud", "dns.qry.name": "guce.aol.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 51589, "event_id": "evt-71ff98a0f8c68be8737ff02f", "src_port": 53, "tcp_stream": null, "udp_stream": 39, "frame_number": 3795, "timestamp_epoch": "1575413237.897960000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "guce.advertising.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-3811c913556226db396fb3d8", "src_port": 61245, "tcp_stream": null, "udp_stream": 40, "frame_number": 3836, "timestamp_epoch": "1575413238.467239000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "54.236.178.170,18.232.193.181,3.225.187.149,54.145.171.0,18.208.41.141,107.23.73.96", "dns.cname": "real.rotation.guce.aws.oath.cloud,prod-rotation-v2.guce.aws.oath.cloud", "dns.qry.name": "guce.advertising.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 61245, "event_id": "evt-2f1f87b981ac5f5adbd51600", "src_port": 53, "tcp_stream": null, "udp_stream": 40, "frame_number": 3837, "timestamp_epoch": "1575413238.558263000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "s.aolcdn.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-ad927096d882290e70334816", "src_port": 50768, "tcp_stream": null, "udp_stream": 41, "frame_number": 4182, "timestamp_epoch": "1575413244.526729000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "consent.cmp.oath.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-dfccbecdaf3a153e41c300ec", "src_port": 60425, "tcp_stream": null, "udp_stream": 42, "frame_number": 4183, "timestamp_epoch": "1575413244.536843000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "192.229.211.36", "dns.cname": "cs629.wpc.lambdacdn.net", "dns.qry.name": "s.aolcdn.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 50768, "event_id": "evt-4ba0f0f0181def0856545f55", "src_port": 53, "tcp_stream": null, "udp_stream": 41, "frame_number": 4184, "timestamp_epoch": "1575413244.602338000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "152.195.55.192", "dns.cname": "cs550162656.adn.psicdn.net", "dns.qry.name": "consent.cmp.oath.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 60425, "event_id": "evt-b04620c41f2b98ddbad64b15", "src_port": 53, "tcp_stream": null, "udp_stream": 42, "frame_number": 4187, "timestamp_epoch": "1575413244.607312000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "gxp2.mail.aol.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-0c44b4fc91a44460f8655d27", "src_port": 55293, "tcp_stream": null, "udp_stream": 43, "frame_number": 4873, "timestamp_epoch": "1575413246.231562000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "www.aol.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-654e6aa5f7a55aeee9c24981", "src_port": 61554, "tcp_stream": null, "udp_stream": 44, "frame_number": 4889, "timestamp_epoch": "1575413246.290389000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "3.218.16.73,52.71.118.158,52.0.90.21", "dns.cname": "prod.gxp.pse.public.aol.com", "dns.qry.name": "gxp2.mail.aol.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 55293, "event_id": "evt-e8ec66d660eb66adea7b7785", "src_port": 53, "tcp_stream": null, "udp_stream": 43, "frame_number": 4892, "timestamp_epoch": "1575413246.304051000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "66.218.87.13", "dns.cname": "media-router-aol1.prod.media.yahoo.com,media-router-aol1.prod.g03.yahoodns.net", "dns.qry.name": "www.aol.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 61554, "event_id": "evt-2ca83cf7365ab87a2107ae80", "src_port": 53, "tcp_stream": null, "udp_stream": 44, "frame_number": 4922, "timestamp_epoch": "1575413246.488601000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "sb.scorecardresearch.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-14455c13b3b491e5a0b2fa08", "src_port": 63710, "tcp_stream": null, "udp_stream": 45, "frame_number": 5058, "timestamp_epoch": "1575413247.024624000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "184.86.155.127", "dns.cname": "sb.scorecardresearch.com.edgekey.net,e1879.e7.akamaiedge.net", "dns.qry.name": "sb.scorecardresearch.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 63710, "event_id": "evt-8dbc09dd6b8bf26217e7392a", "src_port": 53, "tcp_stream": null, "udp_stream": 45, "frame_number": 5073, "timestamp_epoch": "1575413247.091636000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "s.blogsmithmedia.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-5b8a3af46ad147c35a2f56df", "src_port": 52026, "tcp_stream": null, "udp_stream": 46, "frame_number": 5160, "timestamp_epoch": "1575413247.781242000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "192.229.210.141", "dns.cname": "cs737157920.wpc.omicroncdn.net", "dns.qry.name": "s.blogsmithmedia.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 52026, "event_id": "evt-77f983627a32f37d66e870cd", "src_port": 53, "tcp_stream": null, "udp_stream": 46, "frame_number": 5225, "timestamp_epoch": "1575413248.059796000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "o.aolcdn.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-c69fdfdc732112147a4b51a4", "src_port": 58401, "tcp_stream": null, "udp_stream": 47, "frame_number": 5344, "timestamp_epoch": "1575413248.190906000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "192.229.211.36", "dns.cname": "cs629.wpc.lambdacdn.net", "dns.qry.name": "o.aolcdn.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 58401, "event_id": "evt-813161fb7f2d87dc16fac603", "src_port": 53, "tcp_stream": null, "udp_stream": 47, "frame_number": 5418, "timestamp_epoch": "1575413248.467142000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "at.atwola.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-63fe1ca976510a4b68bc8ed7", "src_port": 50240, "tcp_stream": null, "udp_stream": 48, "frame_number": 5605, "timestamp_epoch": "1575413248.806325000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "152.199.6.14", "dns.cname": "cs670.wpc.thetacdn.net,cs670.lb.wpc.apr-1b09e.edgecastdns.net,cs936.wpc.thetacdn.net", "dns.qry.name": "at.atwola.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 50240, "event_id": "evt-dcc5cc8c9e170a3bb074b17c", "src_port": 53, "tcp_stream": null, "udp_stream": 48, "frame_number": 5656, "timestamp_epoch": "1575413248.903560000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "ads.yap.yahoo.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-727624bf1501ed87a424fd20", "src_port": 58498, "tcp_stream": null, "udp_stream": 49, "frame_number": 6379, "timestamp_epoch": "1575413249.766503000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "98.136.96.149,74.6.138.64", "dns.cname": "media-router-flurry1.prod.media.wg1.b.yahoo.com", "dns.qry.name": "ads.yap.yahoo.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 58498, "event_id": "evt-e09ddfa93caa5351a7dc06cd", "src_port": 53, "tcp_stream": null, "udp_stream": 49, "frame_number": 6460, "timestamp_epoch": "1575413250.068987000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "adserver.adtech.advertising.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-11b431cd0424ebc18437f575", "src_port": 64025, "tcp_stream": null, "udp_stream": 50, "frame_number": 6833, "timestamp_epoch": "1575413250.760262000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "152.199.6.24", "dns.cname": "cs671.wac.thetacdn.net,cs671.lb.wac.apr-1b09e.edgecastdns.net,cs925.wpc.thetacdn.net", "dns.qry.name": "adserver.adtech.advertising.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 64025, "event_id": "evt-e9f535d91423efdd23c8f1d0", "src_port": 53, "tcp_stream": null, "udp_stream": 50, "frame_number": 6899, "timestamp_epoch": "1575413251.062084000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "beap.gemini.yahoo.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-cd1454aa64970dce3aaa39fc", "src_port": 65420, "tcp_stream": null, "udp_stream": 51, "frame_number": 7120, "timestamp_epoch": "1575413252.786071000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "74.6.138.72,98.138.71.148", "dns.cname": "beap1.cb.g01.yahoodns.net", "dns.qry.name": "beap.gemini.yahoo.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 65420, "event_id": "evt-b2ea06b945e2971af178b0d9", "src_port": 53, "tcp_stream": null, "udp_stream": 51, "frame_number": 7139, "timestamp_epoch": "1575413252.926670000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "oao-js-tag.onemobile.yahoo.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-e26bca6dc66abda8cef42858", "src_port": 55959, "tcp_stream": null, "udp_stream": 52, "frame_number": 7180, "timestamp_epoch": "1575413253.008581000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "34.231.235.125,35.171.168.180,34.204.4.212,35.172.104.215,34.204.123.32,35.153.187.227,107.23.112.106,52.206.226.12", "dns.cname": "oao-js-tag.one-mobile-prod.aws.oath.cloud,us-east-1.onemobile.yahoo.com,m-node-alb-us-east-1-prod-530825477.us-east-1.elb.amazonaws.com", "dns.qry.name": "oao-js-tag.onemobile.yahoo.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 55959, "event_id": "evt-4c7e834abfec7d03f08f6128", "src_port": 53, "tcp_stream": null, "udp_stream": 52, "frame_number": 7233, "timestamp_epoch": "1575413253.235151000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "b.aol.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-83fd3c50ecea8d0f54a42d2e", "src_port": 57045, "tcp_stream": null, "udp_stream": 53, "frame_number": 7456, "timestamp_epoch": "1575413253.970345000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.qry.name": "b.aol.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 57045, "event_id": "evt-c90c526540428e23c8bc9153", "src_port": 53, "tcp_stream": null, "udp_stream": 53, "frame_number": 7467, "timestamp_epoch": "1575413254.084287000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "z.moatads.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-fd7e352be4a3c7edcc109360", "src_port": 65041, "tcp_stream": null, "udp_stream": 54, "frame_number": 7490, "timestamp_epoch": "1575413254.183995000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "23.11.218.15", "dns.cname": "wildcard.moatads.com.edgekey.net,e13136.g.akamaiedge.net", "dns.qry.name": "z.moatads.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 65041, "event_id": "evt-b9389d1edb24259c339b13ed", "src_port": 53, "tcp_stream": null, "udp_stream": 54, "frame_number": 7496, "timestamp_epoch": "1575413254.362555000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "px.moatads.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-f4eeb4c2793edd0d081632e4", "src_port": 51376, "tcp_stream": null, "udp_stream": 55, "frame_number": 7649, "timestamp_epoch": "1575413255.007713000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "prod-m-node-1111.ssp.advertising.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-36fc42005527764602003da4", "src_port": 62894, "tcp_stream": null, "udp_stream": 56, "frame_number": 7650, "timestamp_epoch": "1575413255.026754000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "www.googletagservices.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-8642737966b17a520b03dd6f", "src_port": 62267, "tcp_stream": null, "udp_stream": 57, "frame_number": 7651, "timestamp_epoch": "1575413255.030588000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "23.11.218.15", "dns.cname": "wildcard.moatads.com.edgekey.net,e13136.g.akamaiedge.net", "dns.qry.name": "px.moatads.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 51376, "event_id": "evt-f1951fa54b728805a34082b9", "src_port": 53, "tcp_stream": null, "udp_stream": 55, "frame_number": 7652, "timestamp_epoch": "1575413255.067988000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "35.171.168.180,34.204.4.212,35.172.104.215,34.204.123.32,35.153.187.227,107.23.112.106,52.206.226.12,34.231.235.125", "dns.cname": "m-node-alb-us-east-1-prod-530825477.us-east-1.elb.amazonaws.com", "dns.qry.name": "prod-m-node-1111.ssp.advertising.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 62894, "event_id": "evt-37b132fe696ced5016d1d317", "src_port": 53, "tcp_stream": null, "udp_stream": 56, "frame_number": 7655, "timestamp_epoch": "1575413255.099136000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "172.217.1.130", "dns.cname": "pagead46.l.doubleclick.net", "dns.qry.name": "www.googletagservices.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 62267, "event_id": "evt-b2a8a5596ef8990bc5f143e6", "src_port": 53, "tcp_stream": null, "udp_stream": 57, "frame_number": 7658, "timestamp_epoch": "1575413255.123657000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "tpc.googlesyndication.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-e564e9ba3dc36264cd2100e2", "src_port": 65118, "tcp_stream": null, "udp_stream": 58, "frame_number": 7806, "timestamp_epoch": "1575413255.813989000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "172.217.12.65", "dns.cname": "pagead-googlehosted.l.google.com", "dns.qry.name": "tpc.googlesyndication.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 65118, "event_id": "evt-fe1682155ceff1773582b59a", "src_port": 53, "tcp_stream": null, "udp_stream": 58, "frame_number": 7823, "timestamp_epoch": "1575413255.913526000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "pagead2.googlesyndication.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-0a668766b859ca7e96ddf523", "src_port": 52531, "tcp_stream": null, "udp_stream": 59, "frame_number": 7967, "timestamp_epoch": "1575413256.911444000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "172.217.1.130", "dns.cname": "pagead46.l.doubleclick.net", "dns.qry.name": "pagead2.googlesyndication.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 52531, "event_id": "evt-5da6777587d7e8ea59b4d9e1", "src_port": 53, "tcp_stream": null, "udp_stream": 59, "frame_number": 7972, "timestamp_epoch": "1575413257.008584000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "bm.adentifi.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-04a6925e7997febfa253f647", "src_port": 58202, "tcp_stream": null, "udp_stream": 60, "frame_number": 8002, "timestamp_epoch": "1575413257.206920000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "34.204.232.247,52.3.11.61,34.201.90.208,52.44.42.164,52.86.75.171,52.73.155.113,52.73.69.206,54.209.98.151", "dns.qry.name": "bm.adentifi.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 58202, "event_id": "evt-de8edb53dbef114ae66087f3", "src_port": 53, "tcp_stream": null, "udp_stream": 60, "frame_number": 8009, "timestamp_epoch": "1575413257.314055000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "rtb.adentifi.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-23ab6a89a8795febd72e4904", "src_port": 59814, "tcp_stream": null, "udp_stream": 61, "frame_number": 8073, "timestamp_epoch": "1575413257.790729000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "tags.bkrtx.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-22b7c72261ee7b0428c23c4d", "src_port": 64590, "tcp_stream": null, "udp_stream": 62, "frame_number": 8074, "timestamp_epoch": "1575413257.791396000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "52.54.122.125,54.156.168.222,52.45.29.95,52.87.22.170,52.73.9.0,54.152.229.194,52.70.198.170,52.6.242.143", "dns.qry.name": "rtb.adentifi.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 59814, "event_id": "evt-12a124f3c3efc187a13f8acf", "src_port": 53, "tcp_stream": null, "udp_stream": 61, "frame_number": 8080, "timestamp_epoch": "1575413257.956936000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "23.67.118.68", "dns.cname": "wildcard.bkrtx.com.edgekey.net,e5529.g.akamaiedge.net", "dns.qry.name": "tags.bkrtx.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 64590, "event_id": "evt-8eb8418869ac4569d3b08807", "src_port": 53, "tcp_stream": null, "udp_stream": 62, "frame_number": 8085, "timestamp_epoch": "1575413257.988658000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "googleads4.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-bbc4a4fb5cb1e41c8b27c2b3", "src_port": 57356, "tcp_stream": null, "udp_stream": 63, "frame_number": 8116, "timestamp_epoch": "1575413258.171271000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "d.agkn.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-f1dd1bc7ea4fcf85ac65c407", "src_port": 56755, "tcp_stream": null, "udp_stream": 64, "frame_number": 8117, "timestamp_epoch": "1575413258.171519000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "216.58.193.130", "dns.cname": "pagead.l.doubleclick.net", "dns.qry.name": "googleads4.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 57356, "event_id": "evt-a6b75c89962dfc6e6c1f5f8b", "src_port": 53, "tcp_stream": null, "udp_stream": 63, "frame_number": 8199, "timestamp_epoch": "1575413258.370803000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "13.249.22.83,13.249.22.105,13.249.22.87,13.249.22.84", "dns.cname": "data.agkn.com,d2ctznuk6ro1vp.cloudfront.net", "dns.qry.name": "d.agkn.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 56755, "event_id": "evt-bea2c7b61425449ace65dc7c", "src_port": 53, "tcp_stream": null, "udp_stream": 64, "frame_number": 8202, "timestamp_epoch": "1575413258.371041000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "fonts.googleapis.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-d01a77e168d88ae85fc2d4e7", "src_port": 61692, "tcp_stream": null, "udp_stream": 65, "frame_number": 8238, "timestamp_epoch": "1575413258.535495000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "c.fqtag.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-88d1f02fe5f7e44d888cfbe6", "src_port": 64795, "tcp_stream": null, "udp_stream": 66, "frame_number": 8270, "timestamp_epoch": "1575413258.607616000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "216.58.194.106", "dns.qry.name": "fonts.googleapis.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 61692, "event_id": "evt-cdfa70719aa44083189cc9ed", "src_port": 53, "tcp_stream": null, "udp_stream": 65, "frame_number": 8315, "timestamp_epoch": "1575413258.762246000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "35.190.72.161", "dns.qry.name": "c.fqtag.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 64795, "event_id": "evt-20ec52c75d0dfaa8ae78e162", "src_port": 53, "tcp_stream": null, "udp_stream": 66, "frame_number": 8331, "timestamp_epoch": "1575413258.871609000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "fonts.gstatic.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-3bd139e0cb028035496d577c", "src_port": 58111, "tcp_stream": null, "udp_stream": 67, "frame_number": 8582, "timestamp_epoch": "1575413259.995926000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "cdn.fqtag.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-0759e5ada3fe307c79b01c63", "src_port": 54344, "tcp_stream": null, "udp_stream": 68, "frame_number": 8601, "timestamp_epoch": "1575413260.162620000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "ads.yahoo.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-29b238a728efe574538783c5", "src_port": 57868, "tcp_stream": null, "udp_stream": 69, "frame_number": 8604, "timestamp_epoch": "1575413260.166154000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "172.217.12.67", "dns.cname": "gstaticadssl.l.google.com", "dns.qry.name": "fonts.gstatic.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 58111, "event_id": "evt-f46cfdaabb046b2db6b9c314", "src_port": 53, "tcp_stream": null, "udp_stream": 67, "frame_number": 8615, "timestamp_epoch": "1575413260.271166000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "35.190.36.172", "dns.qry.name": "cdn.fqtag.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 54344, "event_id": "evt-bb065beb1b9a04602038ed60", "src_port": 53, "tcp_stream": null, "udp_stream": 68, "frame_number": 8643, "timestamp_epoch": "1575413260.379428000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "76.13.32.137,98.138.71.149,74.6.143.14,74.6.231.10", "dns.cname": "fo-fd-world-new.yax.gysm.yahoodns.net", "dns.qry.name": "ads.yahoo.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 57868, "event_id": "evt-22fcb10ea060a0a223593cb5", "src_port": 53, "tcp_stream": null, "udp_stream": 69, "frame_number": 8646, "timestamp_epoch": "1575413260.432992000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "t.myvisualiq.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-1e8ebaaaf0edd7ed69d5844b", "src_port": 53644, "tcp_stream": null, "udp_stream": 70, "frame_number": 9117, "timestamp_epoch": "1575413262.140958000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "18.210.147.153,107.23.111.253,18.209.186.85,100.24.88.255,18.211.132.79,18.235.25.252,18.233.219.152,18.233.175.78", "dns.cname": "pool-use.visualiq.iponweb.net,elb-aws-va-visualiq-39389596.us-east-1.elb.amazonaws.com", "dns.qry.name": "t.myvisualiq.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 53644, "event_id": "evt-9542e19c5c8e7620c607c20b", "src_port": 53, "tcp_stream": null, "udp_stream": 70, "frame_number": 9126, "timestamp_epoch": "1575413262.266157000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "us-east-1.onemobile.yahoo.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-9db59f9afe64f9b8e4829690", "src_port": 60396, "tcp_stream": null, "udp_stream": 71, "frame_number": 9151, "timestamp_epoch": "1575413262.342123000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "34.204.4.212,35.172.104.215,34.204.123.32,35.153.187.227,107.23.112.106,52.206.226.12,34.231.235.125,35.171.168.180", "dns.cname": "m-node-alb-us-east-1-prod-530825477.us-east-1.elb.amazonaws.com", "dns.qry.name": "us-east-1.onemobile.yahoo.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 60396, "event_id": "evt-d23a93fce5932c35bca43704", "src_port": 53, "tcp_stream": null, "udp_stream": 71, "frame_number": 9152, "timestamp_epoch": "1575413262.342458000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "cm.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-0c4a9b989043f2b34aa76981", "src_port": 57291, "tcp_stream": null, "udp_stream": 72, "frame_number": 9281, "timestamp_epoch": "1575413262.562854000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "pixel.advertising.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-85eee2ffdcbb5e726559e617", "src_port": 57752, "tcp_stream": null, "udp_stream": 73, "frame_number": 9286, "timestamp_epoch": "1575413262.570113000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "googleads.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-08ca2609891f0775a6750ba4", "src_port": 51627, "tcp_stream": null, "udp_stream": 74, "frame_number": 9288, "timestamp_epoch": "1575413262.571454000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "match.adsrvr.org", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-d7ddea5b5a4fbc505bf2d05d", "src_port": 52285, "tcp_stream": null, "udp_stream": 75, "frame_number": 9289, "timestamp_epoch": "1575413262.574246000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "ssum-sec.casalemedia.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-dd8732d8998fe29baf4673b4", "src_port": 50848, "tcp_stream": null, "udp_stream": 76, "frame_number": 9290, "timestamp_epoch": "1575413262.576039000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "sync.mathtag.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-0f9d96d77bcbf1ab2a6a73ae", "src_port": 55758, "tcp_stream": null, "udp_stream": 77, "frame_number": 9291, "timestamp_epoch": "1575413262.579955000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "ad.turn.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-68ed81ab70d842406e0bafaa", "src_port": 59139, "tcp_stream": null, "udp_stream": 78, "frame_number": 9292, "timestamp_epoch": "1575413262.581216000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "x.bidswitch.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-2a25c2cda8e74a790a2652df", "src_port": 61186, "tcp_stream": null, "udp_stream": 79, "frame_number": 9293, "timestamp_epoch": "1575413262.584920000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "ads.pubmatic.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-499359be75a1d29057fb4d7c", "src_port": 53252, "tcp_stream": null, "udp_stream": 80, "frame_number": 9294, "timestamp_epoch": "1575413262.587877000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "ib.adnxs.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-970f4e7917279738f44939b3", "src_port": 58656, "tcp_stream": null, "udp_stream": 81, "frame_number": 9295, "timestamp_epoch": "1575413262.589105000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "pixel.quantserve.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-e3fb552bf8109451d7a7876c", "src_port": 65108, "tcp_stream": null, "udp_stream": 82, "frame_number": 9296, "timestamp_epoch": "1575413262.590656000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "216.200.232.221,74.121.138.90,74.121.138.36,216.200.232.201", "dns.cname": "pixel-origin.mathtag.com", "dns.qry.name": "sync.mathtag.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 55758, "event_id": "evt-14816dd1aeec2ce858efa17e", "src_port": 53, "tcp_stream": null, "udp_stream": 77, "frame_number": 9305, "timestamp_epoch": "1575413262.640867000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "172.217.1.130", "dns.cname": "pagead46.l.doubleclick.net", "dns.qry.name": "googleads.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 51627, "event_id": "evt-1210a6e980dd2b8a0d0403e1", "src_port": 53, "tcp_stream": null, "udp_stream": 74, "frame_number": 9306, "timestamp_epoch": "1575413262.640954000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "216.58.193.130", "dns.cname": "pagead.l.doubleclick.net", "dns.qry.name": "cm.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 57291, "event_id": "evt-82c7bafe75bb6a16433afe70", "src_port": 53, "tcp_stream": null, "udp_stream": 72, "frame_number": 9322, "timestamp_epoch": "1575413262.643180000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "54.158.57.141,52.22.184.73,3.215.246.105,52.3.158.69,3.213.8.28,54.152.30.174,54.226.243.22,52.6.39.34", "dns.cname": "prod.ups-adcom.aolp-ds-prd.aws.oath.cloud,prod.ups-us-east-1.aolp-ds-prd.aws.oath.cloud", "dns.qry.name": "pixel.advertising.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 57752, "event_id": "evt-20a7497b889fd708097941ee", "src_port": 53, "tcp_stream": null, "udp_stream": 73, "frame_number": 9324, "timestamp_epoch": "1575413262.643694000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "54.84.47.220,34.228.100.37,35.170.121.134,34.235.254.111,34.224.172.188,52.202.174.197,52.22.146.21,34.196.158.70", "dns.cname": "match-975362022.us-east-1.elb.amazonaws.com", "dns.qry.name": "match.adsrvr.org", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 52285, "event_id": "evt-423913af50b45ae32e8523bc", "src_port": 53, "tcp_stream": null, "udp_stream": 75, "frame_number": 9334, "timestamp_epoch": "1575413262.647446000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "23.11.217.71", "dns.cname": "ssum-sec.casalemedia.com.edgekey.net,e8037.g.akamaiedge.net", "dns.qry.name": "ssum-sec.casalemedia.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 50848, "event_id": "evt-c7dc3e9f402aef1dc687ca79", "src_port": 53, "tcp_stream": null, "udp_stream": 76, "frame_number": 9336, "timestamp_epoch": "1575413262.649448000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "104.254.149.101,104.254.148.196,104.254.148.198,104.254.149.100,104.254.149.69,104.254.149.68,104.254.148.133,104.254.148.165", "dns.cname": "g.geogslb.com,ib.anycast.adnxs.com", "dns.qry.name": "ib.adnxs.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 58656, "event_id": "evt-982e3b918ae7bdb343329e36", "src_port": 53, "tcp_stream": null, "udp_stream": 81, "frame_number": 9344, "timestamp_epoch": "1575413262.653946000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "23.11.217.11", "dns.cname": "pubmatic.edgekey.net,e6603.g.akamaiedge.net", "dns.qry.name": "ads.pubmatic.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 53252, "event_id": "evt-6ae4c73dab0cef69fc740110", "src_port": 53, "tcp_stream": null, "udp_stream": 80, "frame_number": 9345, "timestamp_epoch": "1575413262.654064000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "35.211.144.153,35.211.183.51", "dns.qry.name": "x.bidswitch.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 61186, "event_id": "evt-95c8aa42ec09b0c73c3c8fef", "src_port": 53, "tcp_stream": null, "udp_stream": 79, "frame_number": 9350, "timestamp_epoch": "1575413262.658303000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "50.116.194.21", "dns.cname": "ad.turn.com.akadns.net", "dns.qry.name": "ad.turn.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 59139, "event_id": "evt-b84c9b0b7d6a5ae8b1bb355b", "src_port": 53, "tcp_stream": null, "udp_stream": 78, "frame_number": 9357, "timestamp_epoch": "1575413262.702392000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "192.184.69.225,192.184.69.183,192.184.69.155,192.184.69.243,192.184.69.204,192.184.69.156,192.184.69.197,192.184.69.244", "dns.cname": "global.px.quantserve.com,pixel-usw101-pixelserver-http.pixel.quantserve.net", "dns.qry.name": "pixel.quantserve.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 65108, "event_id": "evt-de29ec0d5a26c77c8c1f2995", "src_port": 53, "tcp_stream": null, "udp_stream": 82, "frame_number": 9360, "timestamp_epoch": "1575413262.717743000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "pr-bh.ybp.yahoo.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-062a1d6d79b08a0210567aa2", "src_port": 61623, "tcp_stream": null, "udp_stream": 83, "frame_number": 9748, "timestamp_epoch": "1575413263.778707000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "ups.analytics.yahoo.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-c26643f2a18f537778ebc027", "src_port": 56809, "tcp_stream": null, "udp_stream": 84, "frame_number": 9786, "timestamp_epoch": "1575413264.031399000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "74.6.138.75", "dns.cname": "ds-pr-bh.ybp.gysm.yahoodns.net", "dns.qry.name": "pr-bh.ybp.yahoo.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 61623, "event_id": "evt-51e751a57accab530872e94c", "src_port": 53, "tcp_stream": null, "udp_stream": 83, "frame_number": 9810, "timestamp_epoch": "1575413264.126151000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "image6.pubmatic.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-4bfb6f36126013246b3ac8f1", "src_port": 54857, "tcp_stream": null, "udp_stream": 85, "frame_number": 9852, "timestamp_epoch": "1575413264.386247000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "34.193.46.35,34.225.20.218,52.202.0.127,3.216.103.132,52.21.200.160,3.232.65.116,107.23.26.245,54.88.83.158", "dns.cname": "prod.ups-yahoo.aolp-ds-prd.aws.oath.cloud", "dns.qry.name": "ups.analytics.yahoo.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 56809, "event_id": "evt-bfad21a102289d6d056d005a", "src_port": 53, "tcp_stream": null, "udp_stream": 84, "frame_number": 9864, "timestamp_epoch": "1575413264.518110000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "p.rfihub.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-af876589d9a9b5a06926d658", "src_port": 53963, "tcp_stream": null, "udp_stream": 86, "frame_number": 9893, "timestamp_epoch": "1575413264.532818000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "pm.w55c.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-42d81ff37d3662e93fe2a6a5", "src_port": 55677, "tcp_stream": null, "udp_stream": 87, "frame_number": 9894, "timestamp_epoch": "1575413264.533633000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "casale-match.dotomi.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-f9045a3c58e70b3380af5a93", "src_port": 50010, "tcp_stream": null, "udp_stream": 88, "frame_number": 9897, "timestamp_epoch": "1575413264.536227000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "cm.eyereturn.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-53c44a755fc392c037e72b82", "src_port": 55899, "tcp_stream": null, "udp_stream": 89, "frame_number": 9898, "timestamp_epoch": "1575413264.537914000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "c1.adform.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-18f2e687cd67333924b34c76", "src_port": 53293, "tcp_stream": null, "udp_stream": 90, "frame_number": 9899, "timestamp_epoch": "1575413264.539023000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "cm.adgrx.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-ff1e6237ece279b2f88472a5", "src_port": 50663, "tcp_stream": null, "udp_stream": 91, "frame_number": 9900, "timestamp_epoch": "1575413264.539552000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "match.prod.bidr.io", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-1a2d5432cc45cb39fc2643ad", "src_port": 64653, "tcp_stream": null, "udp_stream": 92, "frame_number": 9907, "timestamp_epoch": "1575413264.560359000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "104.36.113.23", "dns.cname": "pugm33000nfc.pubmatic.com,pugm33000nf.pubmatic.com", "dns.qry.name": "image6.pubmatic.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 54857, "event_id": "evt-b03a580ad20dca21a7e94cac", "src_port": 53, "tcp_stream": null, "udp_stream": 85, "frame_number": 9934, "timestamp_epoch": "1575413264.714628000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "dsum-sec.casalemedia.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-4ef0ba6071cfa15c1057b1a7", "src_port": 60137, "tcp_stream": null, "udp_stream": 93, "frame_number": 9973, "timestamp_epoch": "1575413264.829744000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "52.7.147.140,54.89.56.97,52.202.126.226,34.237.248.89,35.153.21.25,18.235.19.208,54.164.248.61,52.5.227.122", "dns.cname": "dxedge-prod-lb-946522505.us-east-1.elb.amazonaws.com", "dns.qry.name": "pm.w55c.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 55677, "event_id": "evt-2fc934ea982008d2cb21691d", "src_port": 53, "tcp_stream": null, "udp_stream": 87, "frame_number": 9974, "timestamp_epoch": "1575413264.859950000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "35.186.239.238", "dns.qry.name": "cm.eyereturn.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 55899, "event_id": "evt-39b3bf9690205adc026836ce", "src_port": 53, "tcp_stream": null, "udp_stream": 89, "frame_number": 9979, "timestamp_epoch": "1575413264.894068000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "35.169.207.73,52.21.98.231,52.203.83.158,52.22.131.123,50.16.169.17,52.204.50.104,107.23.4.236,35.174.30.193", "dns.qry.name": "match.prod.bidr.io", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 64653, "event_id": "evt-cc189dd074c58294ee40e4cd", "src_port": 53, "tcp_stream": null, "udp_stream": 92, "frame_number": 9982, "timestamp_epoch": "1575413264.913423000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "198.8.70.128", "dns.cname": "a.rfihub.com,a.rfihub.com.akadns.net,a-us-east.rfihub.com.akadns.net", "dns.qry.name": "p.rfihub.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 53963, "event_id": "evt-0970636f63cecc278b4b3425", "src_port": 53, "tcp_stream": null, "udp_stream": 86, "frame_number": 9983, "timestamp_epoch": "1575413264.913538000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "173.231.184.20", "dns.cname": "rtb.adgrx.com,rtb.adgrx.com.tech.akadns.net", "dns.qry.name": "cm.adgrx.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 50663, "event_id": "evt-526591de2569a0bfa52a0124", "src_port": 53, "tcp_stream": null, "udp_stream": 91, "frame_number": 9990, "timestamp_epoch": "1575413264.924248000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "185.167.164.42,185.167.164.43,185.167.164.49,185.167.164.51", "dns.cname": "track.adformnet.akadns.net,track-us.adformnet.akadns.net", "dns.qry.name": "c1.adform.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 53293, "event_id": "evt-7ff93e35e00e7cd1c35e63e3", "src_port": 53, "tcp_stream": null, "udp_stream": 90, "frame_number": 9997, "timestamp_epoch": "1575413264.964593000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "205.180.86.172", "dns.cname": "afp.dotomi.weighted.com.akadns.net,afp.us.sjc.dotomi.weighted.com.akadns.net,sjc05-login-ds.dotomi.com", "dns.qry.name": "casale-match.dotomi.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 50010, "event_id": "evt-681dcc754a514ea04e215539", "src_port": 53, "tcp_stream": null, "udp_stream": 88, "frame_number": 10032, "timestamp_epoch": "1575413265.132382000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "23.11.217.71", "dns.cname": "dsum-sec.casalemedia.com.edgekey.net,e8037.g.akamaiedge.net", "dns.qry.name": "dsum-sec.casalemedia.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 60137, "event_id": "evt-59b0fb03e9b0c8243947569d", "src_port": 53, "tcp_stream": null, "udp_stream": 93, "frame_number": 10059, "timestamp_epoch": "1575413265.173234000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "crt.usertrust.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-0d0fccd9fd4cb3ba46e18ac0", "src_port": 57603, "tcp_stream": null, "udp_stream": 94, "frame_number": 10413, "timestamp_epoch": "1575413265.792188000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "crt.usertrust.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-71bce90553dbe34260ccfef4", "src_port": 60198, "tcp_stream": null, "udp_stream": 95, "frame_number": 10468, "timestamp_epoch": "1575413265.946223000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "91.199.212.52", "dns.qry.name": "crt.usertrust.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 60198, "event_id": "evt-178d208d509fd2c9754f4972", "src_port": 53, "tcp_stream": null, "udp_stream": 95, "frame_number": 10536, "timestamp_epoch": "1575413266.379001000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "91.199.212.52", "dns.qry.name": "crt.usertrust.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 57603, "event_id": "evt-ecdeb10fc0ee34e92b868772", "src_port": 53, "tcp_stream": null, "udp_stream": 94, "frame_number": 10537, "timestamp_epoch": "1575413266.379122000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "www.download.windowsupdate.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-ba3045ff27a38d141dffef8c", "src_port": 57793, "tcp_stream": null, "udp_stream": 96, "frame_number": 10540, "timestamp_epoch": "1575413266.407974000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "www.download.windowsupdate.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-014b2cc874a681a89c77c6c1", "src_port": 60508, "tcp_stream": null, "udp_stream": 97, "frame_number": 10559, "timestamp_epoch": "1575413266.470287000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "198.70.69.154,198.70.69.161", "dns.cname": "2-01-3cf7-0009.cdx.cedexis.net,download.windowsupdate.com.edgesuite.net,a767.dspw65.akamai.net", "dns.qry.name": "www.download.windowsupdate.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 60508, "event_id": "evt-953a5f921dbf8a0ec0e3282f", "src_port": 53, "tcp_stream": null, "udp_stream": 97, "frame_number": 10617, "timestamp_epoch": "1575413266.894861000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "198.70.69.154,198.70.69.161", "dns.cname": "2-01-3cf7-0009.cdx.cedexis.net,download.windowsupdate.com.edgesuite.net,a767.dspw65.akamai.net", "dns.qry.name": "www.download.windowsupdate.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 57793, "event_id": "evt-acd9f750c5cdd76827c04161", "src_port": 53, "tcp_stream": null, "udp_stream": 96, "frame_number": 10618, "timestamp_epoch": "1575413266.894952000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "p.adsymptotic.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-f60c65fdd4dca7b582710cd0", "src_port": 62108, "tcp_stream": null, "udp_stream": 98, "frame_number": 10765, "timestamp_epoch": "1575413267.635090000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "sync-tm.everesttech.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-818597fdf4273ac656fa49d3", "src_port": 62405, "tcp_stream": null, "udp_stream": 99, "frame_number": 10777, "timestamp_epoch": "1575413267.639995000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "dis.criteo.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-7ce2e4aa02881a9b68dcdf27", "src_port": 56729, "tcp_stream": null, "udp_stream": 100, "frame_number": 10786, "timestamp_epoch": "1575413267.654094000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "pixel-sync.sitescout.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-54a7909d6302e3341939b727", "src_port": 55032, "tcp_stream": null, "udp_stream": 101, "frame_number": 10787, "timestamp_epoch": "1575413267.655554000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "pubmatic-match.dotomi.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-ebd99bc19daaf5746cd56761", "src_port": 50348, "tcp_stream": null, "udp_stream": 102, "frame_number": 10790, "timestamp_epoch": "1575413267.656198000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "um.simpli.fi", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-51af76e44c6c2a3c31ea1a97", "src_port": 64370, "tcp_stream": null, "udp_stream": 103, "frame_number": 10791, "timestamp_epoch": "1575413267.658014000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "pmp.mxptint.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-3e9fb47cbccd00f14b3228da", "src_port": 54449, "tcp_stream": null, "udp_stream": 104, "frame_number": 10794, "timestamp_epoch": "1575413267.660148000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "sync.ipredictive.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-91eac111bc57cccb48ae7b12", "src_port": 65467, "tcp_stream": null, "udp_stream": 105, "frame_number": 10799, "timestamp_epoch": "1575413267.663441000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "match.rundsp.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-1aa0feaa72a61b8b486357f9", "src_port": 62076, "tcp_stream": null, "udp_stream": 106, "frame_number": 10802, "timestamp_epoch": "1575413267.665708000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "52.72.249.172,52.45.100.81,52.87.90.62,34.236.202.21,35.171.48.153,54.208.163.85,54.165.26.158,52.204.252.186", "dns.cname": "p-awse-ebs.adsymptotic.com,awseb-e-3-awsebloa-8y5luacxamgu-1960109003.us-east-1.elb.amazonaws.com", "dns.qry.name": "p.adsymptotic.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 62108, "event_id": "evt-e069da457adfab472bdfc0cb", "src_port": 53, "tcp_stream": null, "udp_stream": 98, "frame_number": 10815, "timestamp_epoch": "1575413267.789823000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "image4.pubmatic.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-23d4bdc65efe2e1508c7b6db", "src_port": 64400, "tcp_stream": null, "udp_stream": 107, "frame_number": 10824, "timestamp_epoch": "1575413267.805499000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "image2.pubmatic.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-2371a760e09e91c8a532e448", "src_port": 56777, "tcp_stream": null, "udp_stream": 108, "frame_number": 10829, "timestamp_epoch": "1575413267.830137000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "simage2.pubmatic.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-cad287c956349787872a1908", "src_port": 61050, "tcp_stream": null, "udp_stream": 109, "frame_number": 10839, "timestamp_epoch": "1575413267.846641000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "151.101.2.49,151.101.66.49,151.101.130.49,151.101.194.49", "dns.cname": "sync.tubemogul.com,syncf.tubemogul.com,h2.shared.global.fastly.net", "dns.qry.name": "sync-tm.everesttech.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 62405, "event_id": "evt-084543d1f969eeabe4c971de", "src_port": 53, "tcp_stream": null, "udp_stream": 99, "frame_number": 10840, "timestamp_epoch": "1575413267.869627000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "74.119.118.138", "dns.qry.name": "dis.criteo.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 56729, "event_id": "evt-36ef32113b8c46b089ffcf5e", "src_port": 53, "tcp_stream": null, "udp_stream": 100, "frame_number": 10847, "timestamp_epoch": "1575413267.948443000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "209.15.36.35", "dns.cname": "pixel-a.sitescout.com", "dns.qry.name": "pixel-sync.sitescout.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 55032, "event_id": "evt-c41f2b7c75ace75091bffeee", "src_port": 53, "tcp_stream": null, "udp_stream": 101, "frame_number": 10850, "timestamp_epoch": "1575413267.965591000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "169.62.192.207,50.97.145.208,184.172.48.71", "dns.qry.name": "um.simpli.fi", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 64370, "event_id": "evt-450c590ece7a56437f99ee13", "src_port": 53, "tcp_stream": null, "udp_stream": 103, "frame_number": 10851, "timestamp_epoch": "1575413267.965671000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "38.67.14.233", "dns.qry.name": "pmp.mxptint.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 54449, "event_id": "evt-bf29d631ceb6e6c1ce0f549f", "src_port": 53, "tcp_stream": null, "udp_stream": 104, "frame_number": 10858, "timestamp_epoch": "1575413267.969283000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "205.180.86.172", "dns.cname": "afp.dotomi.weighted.com.akadns.net,afp.us.sjc.dotomi.weighted.com.akadns.net,sjc05-login-ds.dotomi.com", "dns.qry.name": "pubmatic-match.dotomi.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 50348, "event_id": "evt-556a03933a26b79abaac19b6", "src_port": 53, "tcp_stream": null, "udp_stream": 102, "frame_number": 10873, "timestamp_epoch": "1575413268.023538000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "34.235.45.38,34.226.173.88,34.200.67.128,34.236.135.105,3.221.250.206,3.223.16.87,34.236.118.184,34.233.8.16", "dns.qry.name": "sync.ipredictive.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 65467, "event_id": "evt-693e1fa5b70cd93e2d9da237", "src_port": 53, "tcp_stream": null, "udp_stream": 105, "frame_number": 10876, "timestamp_epoch": "1575413268.026147000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "sync.srv.stackadapt.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-2fd890ad740a600ff840f0fe", "src_port": 64227, "tcp_stream": null, "udp_stream": 110, "frame_number": 10887, "timestamp_epoch": "1575413268.077678000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "54.85.102.186,54.209.242.98,35.171.202.176,34.239.215.228", "dns.cname": "matchuseast-1393638539.us-east-1.elb.amazonaws.com", "dns.qry.name": "match.rundsp.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 62076, "event_id": "evt-68c76fe549ed26be243d02a4", "src_port": 53, "tcp_stream": null, "udp_stream": 106, "frame_number": 10888, "timestamp_epoch": "1575413268.087189000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "104.36.113.17", "dns.cname": "pug33000nfc.pubmatic.com,pug33000nf.pubmatic.com", "dns.qry.name": "image2.pubmatic.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 56777, "event_id": "evt-a168ee67f944740d4b2ba3f9", "src_port": 53, "tcp_stream": null, "udp_stream": 108, "frame_number": 10910, "timestamp_epoch": "1575413268.262916000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "104.36.113.24", "dns.cname": "spug33000nfc.pubmatic.com,spug33000nf.pubmatic.com", "dns.qry.name": "image4.pubmatic.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 64400, "event_id": "evt-d498c075c14ee0dc8d205f90", "src_port": 53, "tcp_stream": null, "udp_stream": 107, "frame_number": 10924, "timestamp_epoch": "1575413268.273846000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "104.36.113.17", "dns.cname": "pug33000nfc.pubmatic.com,pug33000nf.pubmatic.com", "dns.qry.name": "simage2.pubmatic.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 61050, "event_id": "evt-22b2cd85d8962ed7548bc786", "src_port": 53, "tcp_stream": null, "udp_stream": 109, "frame_number": 10931, "timestamp_epoch": "1575413268.278653000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "54.175.88.188,52.71.168.120,34.238.112.88,52.201.28.115,3.213.234.38,35.170.22.17,52.86.28.222,52.55.150.239", "dns.qry.name": "sync.srv.stackadapt.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 64227, "event_id": "evt-7f89993e8716fc02dc9217e0", "src_port": 53, "tcp_stream": null, "udp_stream": 110, "frame_number": 10993, "timestamp_epoch": "1575413268.359202000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "dsum.casalemedia.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-c677d149f64f75754a7a278e", "src_port": 63356, "tcp_stream": null, "udp_stream": 111, "frame_number": 11021, "timestamp_epoch": "1575413268.446252000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "23.11.217.71", "dns.cname": "dsum.casalemedia.com.edgekey.net,e8037.g.akamaiedge.net", "dns.qry.name": "dsum.casalemedia.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 63356, "event_id": "evt-4b9cdf0bc7ca9b8b9df1ed01", "src_port": 53, "tcp_stream": null, "udp_stream": 111, "frame_number": 11250, "timestamp_epoch": "1575413268.813668000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "simage4.pubmatic.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-cedadaac7f5d388b762fbd9b", "src_port": 52119, "tcp_stream": null, "udp_stream": 112, "frame_number": 11551, "timestamp_epoch": "1575413269.662704000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "104.36.113.24", "dns.cname": "spug33000nfc.pubmatic.com,spug33000nf.pubmatic.com", "dns.qry.name": "simage4.pubmatic.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 52119, "event_id": "evt-13913f6155919c13d49f313e", "src_port": 53, "tcp_stream": null, "udp_stream": 112, "frame_number": 11592, "timestamp_epoch": "1575413269.831186000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-5933ef93e9729d3362da2a61", "src_port": 50223, "tcp_stream": null, "udp_stream": 113, "frame_number": 12656, "timestamp_epoch": "1575413305.238225000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-dbc78da239913219e541cd7d", "src_port": 58606, "tcp_stream": null, "udp_stream": 114, "frame_number": 12657, "timestamp_epoch": "1575413305.239167000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-4dc7bef85f32a808eb2eb248", "src_port": 50161, "tcp_stream": null, "udp_stream": 115, "frame_number": 12662, "timestamp_epoch": "1575413305.242542000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-8be2cf80c87cfb71987b9d24", "src_port": 60490, "tcp_stream": null, "udp_stream": 116, "frame_number": 12663, "timestamp_epoch": "1575413305.243188000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "go.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-6a3062ab1c1a1666532108b1", "src_port": 64166, "tcp_stream": null, "udp_stream": 117, "frame_number": 12700, "timestamp_epoch": "1575413305.285884000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,dual-a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 58606, "event_id": "evt-c10eac6a0633ed58f373e5d6", "src_port": 53, "tcp_stream": null, "udp_stream": 114, "frame_number": 12765, "timestamp_epoch": "1575413305.326078000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,dual-a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 50161, "event_id": "evt-048ff7d47becfb01d5001f30", "src_port": 53, "tcp_stream": null, "udp_stream": 115, "frame_number": 12766, "timestamp_epoch": "1575413305.326160000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,dual-a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 60490, "event_id": "evt-47b4c9e5a214d9b072ba2a2b", "src_port": 53, "tcp_stream": null, "udp_stream": 116, "frame_number": 12767, "timestamp_epoch": "1575413305.326217000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,dual-a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 50223, "event_id": "evt-f8d139ec994fc5aba9462c88", "src_port": 53, "tcp_stream": null, "udp_stream": 113, "frame_number": 12768, "timestamp_epoch": "1575413305.326272000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "104.69.23.209", "dns.cname": "go.microsoft.com.edgekey.net,e11290.dspg.akamaiedge.net", "dns.qry.name": "go.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 64166, "event_id": "evt-8a7c2fa7617a5205316edaa4", "src_port": 53, "tcp_stream": null, "udp_stream": 117, "frame_number": 12826, "timestamp_epoch": "1575413305.449366000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "csm2waycm-atl.netmng.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-664e99f08a6d8b8564688c00", "src_port": 51267, "tcp_stream": null, "udp_stream": 118, "frame_number": 13021, "timestamp_epoch": "1575413305.963396000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "d.adroll.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-4f456449ee5a5ecf5bf60480", "src_port": 59061, "tcp_stream": null, "udp_stream": 119, "frame_number": 13023, "timestamp_epoch": "1575413305.964081000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "rtb.mfadsrvr.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-a75cf18793f8c4ad638ce9b2", "src_port": 62681, "tcp_stream": null, "udp_stream": 120, "frame_number": 13057, "timestamp_epoch": "1575413306.033399000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "104.193.80.60", "dns.cname": "j2waycm.netmng.com,j2waycm-us-sjc.netmng.com", "dns.qry.name": "csm2waycm-atl.netmng.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 51267, "event_id": "evt-96b7fa0427678cc5d8fab296", "src_port": 53, "tcp_stream": null, "udp_stream": 118, "frame_number": 13081, "timestamp_epoch": "1575413306.074332000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "54.82.194.252,52.45.82.224", "dns.cname": "adserver-vpc-alb-0-2072243822.us-east-1.elb.amazonaws.com", "dns.qry.name": "d.adroll.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 59061, "event_id": "evt-6739a2eb50ca0c3c62ece961", "src_port": 53, "tcp_stream": null, "udp_stream": 119, "frame_number": 13113, "timestamp_epoch": "1575413306.103126000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "35.207.24.140", "dns.cname": "pool.dorpat.iponweb.net,dorpat.geo.iponweb.net", "dns.qry.name": "rtb.mfadsrvr.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 62681, "event_id": "evt-5c89a26c62fef136636bfef9", "src_port": 53, "tcp_stream": null, "udp_stream": 120, "frame_number": 13146, "timestamp_epoch": "1575413306.126479000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "px.owneriq.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-64b613673e174b81bd9fab55", "src_port": 60211, "tcp_stream": null, "udp_stream": 121, "frame_number": 13170, "timestamp_epoch": "1575413306.135970000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "sync.1rx.io", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-c2c4e32f3b22479c8e08d05f", "src_port": 58735, "tcp_stream": null, "udp_stream": 122, "frame_number": 13182, "timestamp_epoch": "1575413306.139497000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "trc.taboola.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-f59f11359fc5554b0772a44c", "src_port": 50747, "tcp_stream": null, "udp_stream": 123, "frame_number": 13183, "timestamp_epoch": "1575413306.141232000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "a.tribalfusion.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-a46984a400ccc50a13e59d4e", "src_port": 52515, "tcp_stream": null, "udp_stream": 124, "frame_number": 13184, "timestamp_epoch": "1575413306.142255000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "bh.contextweb.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-eea268a4f9fe615f9008751a", "src_port": 63690, "tcp_stream": null, "udp_stream": 16, "frame_number": 13189, "timestamp_epoch": "1575413306.146694000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "cookie.brealtime.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-97a2718b755e97da7360dc77", "src_port": 51450, "tcp_stream": null, "udp_stream": 125, "frame_number": 13190, "timestamp_epoch": "1575413306.147638000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "px.adhigh.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-9952b83bd5bcd4e59fec2960", "src_port": 56959, "tcp_stream": null, "udp_stream": 126, "frame_number": 13193, "timestamp_epoch": "1575413306.150408000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "b1sync.zemanta.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-59a3fbe3376f89415f5a28c8", "src_port": 53999, "tcp_stream": null, "udp_stream": 127, "frame_number": 13194, "timestamp_epoch": "1575413306.152210000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "e.serverbid.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-d13a82dbbea9a7074c58823e", "src_port": 50366, "tcp_stream": null, "udp_stream": 128, "frame_number": 13195, "timestamp_epoch": "1575413306.154087000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "pubmatic2waycm-atl.netmng.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-f491b6e6706efa8405fd3e8f", "src_port": 52870, "tcp_stream": null, "udp_stream": 129, "frame_number": 13200, "timestamp_epoch": "1575413306.158220000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "rp.gwallet.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-be008c944c5c99003b245c3d", "src_port": 51349, "tcp_stream": null, "udp_stream": 130, "frame_number": 13201, "timestamp_epoch": "1575413306.159653000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "23.67.120.135", "dns.cname": "wildcard.owneriq.net.edgekey.net,e11294.g.akamaiedge.net", "dns.qry.name": "px.owneriq.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 60211, "event_id": "evt-657a8683f50958c317a7a812", "src_port": 53, "tcp_stream": null, "udp_stream": 121, "frame_number": 13263, "timestamp_epoch": "1575413306.258315000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "70.42.32.63", "dns.cname": "zemanta-ny.outbrain.org,nydc1.outbrain.org", "dns.qry.name": "b1sync.zemanta.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 53999, "event_id": "evt-519173f5c940458c15b43f65", "src_port": 53, "tcp_stream": null, "udp_stream": 127, "frame_number": 13285, "timestamp_epoch": "1575413306.270237000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "8.41.222.150", "dns.qry.name": "sync.1rx.io", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 58735, "event_id": "evt-1bf947c46aa33453ed30f183", "src_port": 53, "tcp_stream": null, "udp_stream": 122, "frame_number": 13288, "timestamp_epoch": "1575413306.271668000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "104.17.119.107,104.17.120.107", "dns.cname": "cookie.brealtime.com.cdn.cloudflare.net", "dns.qry.name": "cookie.brealtime.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 51450, "event_id": "evt-006a77fb970d1358e7614674", "src_port": 53, "tcp_stream": null, "udp_stream": 125, "frame_number": 13293, "timestamp_epoch": "1575413306.272141000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "151.101.2.2,151.101.66.2,151.101.130.2,151.101.194.2", "dns.cname": "f2.taboola.map.fastly.net", "dns.qry.name": "trc.taboola.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 50747, "event_id": "evt-79c727924c023abe2e0e414a", "src_port": 53, "tcp_stream": null, "udp_stream": 123, "frame_number": 13306, "timestamp_epoch": "1575413306.288790000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "104.193.80.60", "dns.cname": "j2waycm.netmng.com,j2waycm-us-sjc.netmng.com", "dns.qry.name": "pubmatic2waycm-atl.netmng.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 52870, "event_id": "evt-12e1779e61280c6ae172a214", "src_port": 53, "tcp_stream": null, "udp_stream": 129, "frame_number": 13307, "timestamp_epoch": "1575413306.288918000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "72.5.64.63", "dns.qry.name": "rp.gwallet.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 51349, "event_id": "evt-715104cb0709b20019e430a1", "src_port": 53, "tcp_stream": null, "udp_stream": 130, "frame_number": 13311, "timestamp_epoch": "1575413306.289844000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "151.101.0.166,151.101.64.166,151.101.128.166,151.101.192.166", "dns.cname": "prod.contextweb.map.fastlylb.net", "dns.qry.name": "bh.contextweb.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 63690, "event_id": "evt-78416a800321d0cee11fa320", "src_port": 53, "tcp_stream": null, "udp_stream": 16, "frame_number": 13337, "timestamp_epoch": "1575413306.294911000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "134.209.129.254", "dns.qry.name": "e.serverbid.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 50366, "event_id": "evt-56f55834ddcf7e6b6a5f17f4", "src_port": 53, "tcp_stream": null, "udp_stream": 128, "frame_number": 13344, "timestamp_epoch": "1575413306.297988000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "23.7.93.115", "dns.cname": "a-lb.tribalfusion.com.akadns.net,a.tribalfusion.com-v1.edgekey.net,e10524.b.akamaiedge.net", "dns.qry.name": "a.tribalfusion.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 52515, "event_id": "evt-33a78636a76f1e24f6376703", "src_port": 53, "tcp_stream": null, "udp_stream": 124, "frame_number": 13357, "timestamp_epoch": "1575413306.307779000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "204.74.252.20,204.74.252.28,64.58.119.36,64.58.116.196,64.58.116.236", "dns.cname": "px-us.adhigh.net,px-us-ca.adhigh.net", "dns.qry.name": "px.adhigh.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 56959, "event_id": "evt-9b7e5754adaa4ea7a3df19f4", "src_port": 53, "tcp_stream": null, "udp_stream": 126, "frame_number": 13408, "timestamp_epoch": "1575413306.386965000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "secure.adnxs.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-bdf7d881c03a6b8a9aab30fb", "src_port": 58455, "tcp_stream": null, "udp_stream": 131, "frame_number": 13968, "timestamp_epoch": "1575413307.128376000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "pixel.tapad.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-5e69b32bcc4980ed8b4d3760", "src_port": 53615, "tcp_stream": null, "udp_stream": 132, "frame_number": 13991, "timestamp_epoch": "1575413307.175029000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "match.taboola.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-c134cd3bf13abc6be8a6a01b", "src_port": 59482, "tcp_stream": null, "udp_stream": 133, "frame_number": 14021, "timestamp_epoch": "1575413307.237564000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "104.254.148.196,104.254.148.198,104.254.149.100,104.254.149.69,104.254.149.68,104.254.148.133,104.254.148.165,104.254.149.101", "dns.cname": "g.geogslb.com,ib.anycast.adnxs.com", "dns.qry.name": "secure.adnxs.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 58455, "event_id": "evt-e46d2f84e05dc9e08dcc6023", "src_port": 53, "tcp_stream": null, "udp_stream": 131, "frame_number": 14067, "timestamp_epoch": "1575413307.383718000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "107.178.246.49", "dns.qry.name": "pixel.tapad.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 53615, "event_id": "evt-1c2f1a129d26625edc809541", "src_port": 53, "tcp_stream": null, "udp_stream": 132, "frame_number": 14090, "timestamp_epoch": "1575413307.406763000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "151.101.2.49,151.101.66.49,151.101.130.49,151.101.194.49", "dns.cname": "trc.taboola.map.fastly.net", "dns.qry.name": "match.taboola.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 59482, "event_id": "evt-6778ab121820cdf08bdc3534", "src_port": 53, "tcp_stream": null, "udp_stream": 133, "frame_number": 14095, "timestamp_epoch": "1575413307.419283000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "match.zorosrv.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-f23d2d2cce31b92fe6d0e8ec", "src_port": 63975, "tcp_stream": null, "udp_stream": 134, "frame_number": 14309, "timestamp_epoch": "1575413308.047524000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "151.101.66.49,151.101.130.49,151.101.194.49,151.101.2.49", "dns.cname": "trc.taboola.map.fastly.net", "dns.qry.name": "match.zorosrv.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 63975, "event_id": "evt-bcbe0702cdbcd7ae702ab26d", "src_port": 53, "tcp_stream": null, "udp_stream": 134, "frame_number": 14321, "timestamp_epoch": "1575413308.123917000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "www.dropbox.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-9b84ddc124569f5990d6b310", "src_port": 56350, "tcp_stream": null, "udp_stream": 135, "frame_number": 14418, "timestamp_epoch": "1575413311.212281000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "162.125.8.1", "dns.cname": "www.dropbox-dns.com", "dns.qry.name": "www.dropbox.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 56350, "event_id": "evt-ddc772b00debb74f91f68acc", "src_port": 53, "tcp_stream": null, "udp_stream": 135, "frame_number": 14419, "timestamp_epoch": "1575413311.311989000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "uca20a5adbe8d64fd0c7a816e1ec.dl.dropboxusercontent.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-3995125f140ca27a3fa80dda", "src_port": 62422, "tcp_stream": null, "udp_stream": 136, "frame_number": 14462, "timestamp_epoch": "1575413312.368596000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "162.125.8.6", "dns.cname": "dl.dropboxusercontent.com,edge-block-www.dropbox-dns.com", "dns.qry.name": "uca20a5adbe8d64fd0c7a816e1ec.dl.dropboxusercontent.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 62422, "event_id": "evt-f34d2c6f7619da0307a70837", "src_port": 53, "tcp_stream": null, "udp_stream": 136, "frame_number": 14467, "timestamp_epoch": "1575413312.488886000" }, { "kind": "dns", "dst_ip": "193.183.98.66", "fields": { "dns.qry.name": "w8.wensa.at", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-8fc1fb9140645c0437de7cb9", "src_port": 59730, "tcp_stream": null, "udp_stream": 137, "frame_number": 15280, "timestamp_epoch": "1575413425.196289000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "8.208.24.139,58.251.121.110,101.226.79.205,119.28.48.231,180.163.8.114", "dns.qry.name": "w8.wensa.at", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "193.183.98.66", "dst_port": 59730, "event_id": "evt-710f0eec73e104decdba1046", "src_port": 53, "tcp_stream": null, "udp_stream": 137, "frame_number": 15281, "timestamp_epoch": "1575413425.403718000" }, { "kind": "dns", "dst_ip": "193.183.98.66", "fields": { "dns.qry.name": "w8.wensa.at", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-4ca86d4270071317a6bffc1e", "src_port": 52218, "tcp_stream": null, "udp_stream": 138, "frame_number": 15575, "timestamp_epoch": "1575413428.383528000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "8.208.24.139,101.226.79.205,58.251.121.110,119.28.48.231,180.163.8.114", "dns.qry.name": "w8.wensa.at", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "193.183.98.66", "dst_port": 52218, "event_id": "evt-2e0ec24b9c9019ccc06c275d", "src_port": 53, "tcp_stream": null, "udp_stream": 138, "frame_number": 15576, "timestamp_epoch": "1575413428.584602000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "api.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-fb43ff23abba41008c7b3717", "src_port": 60500, "tcp_stream": null, "udp_stream": 139, "frame_number": 15894, "timestamp_epoch": "1575413432.609808000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "api.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-f26f2f753edeb52310a41901", "src_port": 53654, "tcp_stream": null, "udp_stream": 140, "frame_number": 15895, "timestamp_epoch": "1575413432.610255000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-04f9e852441f4e08a834290a", "src_port": 64023, "tcp_stream": null, "udp_stream": 141, "frame_number": 15896, "timestamp_epoch": "1575413432.610799000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-02ec7d50a2a3b72e2c6266a7", "src_port": 52845, "tcp_stream": null, "udp_stream": 142, "frame_number": 15897, "timestamp_epoch": "1575413432.611022000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-7e5ebedf7b6937e52c34f61a", "src_port": 52852, "tcp_stream": null, "udp_stream": 143, "frame_number": 15900, "timestamp_epoch": "1575413432.612065000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-9c0c67f5c2b0f7bd15cf02ba", "src_port": 54788, "tcp_stream": null, "udp_stream": 144, "frame_number": 15901, "timestamp_epoch": "1575413432.612721000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "13.107.5.80", "dns.cname": "api-bing-com.e-0001.e-msedge.net,e-0001.e-msedge.net", "dns.qry.name": "api.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 53654, "event_id": "evt-5310263a0d7c6216ca288eaf", "src_port": 53, "tcp_stream": null, "udp_stream": 140, "frame_number": 15924, "timestamp_epoch": "1575413432.761525000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "13.107.5.80", "dns.cname": "api-bing-com.e-0001.e-msedge.net,e-0001.e-msedge.net", "dns.qry.name": "api.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 60500, "event_id": "evt-483cd8c0993588ef4a18a3c0", "src_port": 53, "tcp_stream": null, "udp_stream": 139, "frame_number": 15925, "timestamp_epoch": "1575413432.761612000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,dual-a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 52845, "event_id": "evt-c64ef0ed773bca1dd059f310", "src_port": 53, "tcp_stream": null, "udp_stream": 142, "frame_number": 15930, "timestamp_epoch": "1575413432.778153000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,dual-a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 52852, "event_id": "evt-87fd3ccf845e3c162aceaee8", "src_port": 53, "tcp_stream": null, "udp_stream": 143, "frame_number": 15931, "timestamp_epoch": "1575413432.778226000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,dual-a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 54788, "event_id": "evt-641882f9359cd02f7ddad5c9", "src_port": 53, "tcp_stream": null, "udp_stream": 144, "frame_number": 15932, "timestamp_epoch": "1575413432.778283000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,dual-a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 64023, "event_id": "evt-7de6d5ac07c271336dbcd4bf", "src_port": 53, "tcp_stream": null, "udp_stream": 141, "frame_number": 15933, "timestamp_epoch": "1575413432.778338000" }, { "kind": "dns", "dst_ip": "193.183.98.66", "fields": { "dns.qry.name": "w8.wensa.at", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-6dbac048610f9f933c2ff653", "src_port": 57803, "tcp_stream": null, "udp_stream": 145, "frame_number": 15950, "timestamp_epoch": "1575413433.872759000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "8.208.24.139,58.251.121.110,101.226.79.205,180.163.8.114,119.28.48.231", "dns.qry.name": "w8.wensa.at", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "193.183.98.66", "dst_port": 57803, "event_id": "evt-182c4d711f5944053af20dc3", "src_port": 53, "tcp_stream": null, "udp_stream": 145, "frame_number": 15951, "timestamp_epoch": "1575413434.109141000" }, { "kind": "dns", "dst_ip": "193.183.98.66", "fields": { "dns.qry.name": "api2.casus.at", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-109242aaca9a13471b47eddf", "src_port": 54524, "tcp_stream": null, "udp_stream": 146, "frame_number": 15966, "timestamp_epoch": "1575413440.200051000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "8.208.24.139,101.226.79.205,58.251.121.110,119.28.48.231,180.163.8.114", "dns.qry.name": "api2.casus.at", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "193.183.98.66", "dst_port": 54524, "event_id": "evt-d5e8f644d054e5c7e7b2b99d", "src_port": 53, "tcp_stream": null, "udp_stream": 146, "frame_number": 15967, "timestamp_epoch": "1575413440.498835000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "resolver1.opendns.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-97fd09c459ccda6724d1b5d3", "src_port": 53622, "tcp_stream": null, "udp_stream": 147, "frame_number": 16128, "timestamp_epoch": "1575413450.199517000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "resolver1.opendns.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-e6b8bff37c4c504fbd30bb91", "src_port": 50078, "tcp_stream": null, "udp_stream": 148, "frame_number": 16129, "timestamp_epoch": "1575413450.209086000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "208.67.222.222", "dns.qry.name": "resolver1.opendns.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 50078, "event_id": "evt-0f76994b5a4dd8cf06105b84", "src_port": 53, "tcp_stream": null, "udp_stream": 148, "frame_number": 16130, "timestamp_epoch": "1575413450.595849000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "208.67.222.222", "dns.qry.name": "resolver1.opendns.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 53622, "event_id": "evt-c06ca8565f2fb7df727ae537", "src_port": 53, "tcp_stream": null, "udp_stream": 147, "frame_number": 16131, "timestamp_epoch": "1575413450.595932000" }, { "kind": "dns", "dst_ip": "208.67.222.222", "fields": { "dns.qry.name": "222.222.67.208.in-addr.arpa", "dns.qry.type": "12", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-b585202f20249b0ef35d3310", "src_port": 50079, "tcp_stream": null, "udp_stream": 149, "frame_number": 16132, "timestamp_epoch": "1575413450.598824000" }, { "kind": "dns", "dst_ip": "208.67.222.222", "fields": { "dns.qry.name": "222.222.67.208.in-addr.arpa", "dns.qry.type": "12", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-3f4427e1e359001741e8219e", "src_port": 50080, "tcp_stream": null, "udp_stream": 150, "frame_number": 16133, "timestamp_epoch": "1575413450.598925000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.qry.name": "222.222.67.208.in-addr.arpa", "dns.qry.type": "12", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "208.67.222.222", "dst_port": 50079, "event_id": "evt-e1cd6781ac2231855738c657", "src_port": 53, "tcp_stream": null, "udp_stream": 149, "frame_number": 16134, "timestamp_epoch": "1575413450.991320000" }, { "kind": "dns", "dst_ip": "208.67.222.222", "fields": { "dns.qry.name": "myip.opendns.com.icemaiden.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-bc9c08027f82a122e2801dce", "src_port": 50081, "tcp_stream": null, "udp_stream": 151, "frame_number": 16135, "timestamp_epoch": "1575413450.992534000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.qry.name": "222.222.67.208.in-addr.arpa", "dns.qry.type": "12", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "208.67.222.222", "dst_port": 50080, "event_id": "evt-f6a714298985adceb2013256", "src_port": 53, "tcp_stream": null, "udp_stream": 150, "frame_number": 16136, "timestamp_epoch": "1575413450.995136000" }, { "kind": "dns", "dst_ip": "208.67.222.222", "fields": { "dns.qry.name": "myip.opendns.com.icemaiden.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-c9dad4ee3eb72661ee47a265", "src_port": 50082, "tcp_stream": null, "udp_stream": 152, "frame_number": 16137, "timestamp_epoch": "1575413450.995863000" }, { "kind": "dns", "dst_ip": "208.67.222.222", "fields": { "dns.qry.name": "myip.opendns.com.icemaiden.com", "dns.qry.type": "28", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-ab90212e0efea3410109c8e9", "src_port": 50083, "tcp_stream": null, "udp_stream": 153, "frame_number": 16138, "timestamp_epoch": "1575413452.999333000" }, { "kind": "dns", "dst_ip": "208.67.222.222", "fields": { "dns.qry.name": "myip.opendns.com.icemaiden.com", "dns.qry.type": "28", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-f29f5001977176c40ee8e0f5", "src_port": 50084, "tcp_stream": null, "udp_stream": 154, "frame_number": 16139, "timestamp_epoch": "1575413452.999457000" }, { "kind": "dns", "dst_ip": "208.67.222.222", "fields": { "dns.qry.name": "myip.opendns.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-21a213c71bb8a9b0af4634bb", "src_port": 50085, "tcp_stream": null, "udp_stream": 155, "frame_number": 16140, "timestamp_epoch": "1575413455.012126000" }, { "kind": "dns", "dst_ip": "208.67.222.222", "fields": { "dns.qry.name": "myip.opendns.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-813809675befee4379259657", "src_port": 50086, "tcp_stream": null, "udp_stream": 156, "frame_number": 16141, "timestamp_epoch": "1575413455.012294000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "184.203.37.188", "dns.qry.name": "myip.opendns.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "208.67.222.222", "dst_port": 50085, "event_id": "evt-c291787d8102236a79714cd0", "src_port": 53, "tcp_stream": null, "udp_stream": 155, "frame_number": 16142, "timestamp_epoch": "1575413455.067315000" }, { "kind": "dns", "dst_ip": "208.67.222.222", "fields": { "dns.qry.name": "myip.opendns.com", "dns.qry.type": "28", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-27a5aff1a64afe1dcddc4680", "src_port": 50087, "tcp_stream": null, "udp_stream": 157, "frame_number": 16143, "timestamp_epoch": "1575413455.070317000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "184.203.37.188", "dns.qry.name": "myip.opendns.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "208.67.222.222", "dst_port": 50086, "event_id": "evt-01c0197430a82fc5b56e266c", "src_port": 53, "tcp_stream": null, "udp_stream": 156, "frame_number": 16144, "timestamp_epoch": "1575413455.075680000" }, { "kind": "dns", "dst_ip": "208.67.222.222", "fields": { "dns.qry.name": "myip.opendns.com", "dns.qry.type": "28", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-aff92dceb86604faab33d703", "src_port": 50088, "tcp_stream": null, "udp_stream": 158, "frame_number": 16145, "timestamp_epoch": "1575413455.078339000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.qry.name": "myip.opendns.com", "dns.qry.type": "28", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "208.67.222.222", "dst_port": 50087, "event_id": "evt-f46fe33c6efca53b3d43aa8a", "src_port": 53, "tcp_stream": null, "udp_stream": 157, "frame_number": 16146, "timestamp_epoch": "1575413455.131069000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.qry.name": "myip.opendns.com", "dns.qry.type": "28", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "208.67.222.222", "dst_port": 50088, "event_id": "evt-c4736eb0e14cbbc9e20bd8a7", "src_port": 53, "tcp_stream": null, "udp_stream": 158, "frame_number": 16147, "timestamp_epoch": "1575413455.140510000" }, { "kind": "dns", "dst_ip": "193.183.98.66", "fields": { "dns.qry.name": "h1.wensa.at", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-ff6aa45c8fac288252b120df", "src_port": 50599, "tcp_stream": null, "udp_stream": 159, "frame_number": 16148, "timestamp_epoch": "1575413455.165434000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "8.208.24.139,101.226.79.205,58.251.121.110,119.28.48.231,180.163.8.114", "dns.qry.name": "h1.wensa.at", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "193.183.98.66", "dst_port": 50599, "event_id": "evt-a460df7cb2230f6e78409393", "src_port": 53, "tcp_stream": null, "udp_stream": 159, "frame_number": 16149, "timestamp_epoch": "1575413455.357740000" }, { "kind": "dns", "dst_ip": "193.183.98.66", "fields": { "dns.qry.name": "h1.wensa.at", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-f602d312ee0d2b1baa84a99f", "src_port": 62396, "tcp_stream": null, "udp_stream": 160, "frame_number": 16159, "timestamp_epoch": "1575413456.141997000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "8.208.24.139,101.226.79.205,58.251.121.110,119.28.48.231,180.163.8.114", "dns.qry.name": "h1.wensa.at", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "193.183.98.66", "dst_port": 62396, "event_id": "evt-ef166ecb831b9b05da817cff", "src_port": 53, "tcp_stream": null, "udp_stream": 160, "frame_number": 16160, "timestamp_epoch": "1575413456.425216000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.qry.name": "myip.opendns.com.icemaiden.com", "dns.qry.type": "1", "dns.flags.rcode": "2", "dns.flags.response": "True" }, "src_ip": "208.67.222.222", "dst_port": 50082, "event_id": "evt-5d536a6cb373202fa707425d", "src_port": 53, "tcp_stream": null, "udp_stream": 152, "frame_number": 16168, "timestamp_epoch": "1575413457.097506000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.qry.name": "myip.opendns.com.icemaiden.com", "dns.qry.type": "1", "dns.flags.rcode": "2", "dns.flags.response": "True" }, "src_ip": "208.67.222.222", "dst_port": 50081, "event_id": "evt-a48314eb35a601f5e98d58d8", "src_port": 53, "tcp_stream": null, "udp_stream": 151, "frame_number": 16169, "timestamp_epoch": "1575413457.100534000" }, { "kind": "dns", "dst_ip": "193.183.98.66", "fields": { "dns.qry.name": "h1.wensa.at", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-4d2d056234b72f8b595a9679", "src_port": 61775, "tcp_stream": null, "udp_stream": 161, "frame_number": 16178, "timestamp_epoch": "1575413457.348260000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "8.208.24.139,101.226.79.205,58.251.121.110,119.28.48.231,180.163.8.114", "dns.qry.name": "h1.wensa.at", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "193.183.98.66", "dst_port": 61775, "event_id": "evt-c05a1a87b906b023b937d2d0", "src_port": 53, "tcp_stream": null, "udp_stream": 161, "frame_number": 16179, "timestamp_epoch": "1575413457.526856000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.qry.name": "myip.opendns.com.icemaiden.com", "dns.qry.type": "28", "dns.flags.rcode": "2", "dns.flags.response": "True" }, "src_ip": "208.67.222.222", "dst_port": 50083, "event_id": "evt-9eb064e45da111faada1f792", "src_port": 53, "tcp_stream": null, "udp_stream": 153, "frame_number": 16191, "timestamp_epoch": "1575413459.043562000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.qry.name": "myip.opendns.com.icemaiden.com", "dns.qry.type": "28", "dns.flags.rcode": "2", "dns.flags.response": "True" }, "src_ip": "208.67.222.222", "dst_port": 50084, "event_id": "evt-569426003d7c298b83d45544", "src_port": 53, "tcp_stream": null, "udp_stream": 154, "frame_number": 16192, "timestamp_epoch": "1575413459.051947000" }, { "kind": "dns", "dst_ip": "193.183.98.66", "fields": { "dns.qry.name": "h1.wensa.at", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-3fb9aa83b05834dfc0ed4d03", "src_port": 57421, "tcp_stream": null, "udp_stream": 162, "frame_number": 16195, "timestamp_epoch": "1575413468.491491000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "8.208.24.139,101.226.79.205,58.251.121.110,119.28.48.231,180.163.8.114", "dns.qry.name": "h1.wensa.at", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "193.183.98.66", "dst_port": 57421, "event_id": "evt-022e2b47f0c4b928d8f0cce3", "src_port": 53, "tcp_stream": null, "udp_stream": 162, "frame_number": 16196, "timestamp_epoch": "1575413468.760703000" }, { "kind": "dns", "dst_ip": "193.183.98.66", "fields": { "dns.qry.name": "h1.wensa.at", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-e10b009635d140d7890f00e3", "src_port": 63553, "tcp_stream": null, "udp_stream": 163, "frame_number": 16208, "timestamp_epoch": "1575413469.615843000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "8.208.24.139,101.226.79.205,58.251.121.110,119.28.48.231,180.163.8.114", "dns.qry.name": "h1.wensa.at", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "193.183.98.66", "dst_port": 63553, "event_id": "evt-08cb3eb157dc0250e7784c93", "src_port": 53, "tcp_stream": null, "udp_stream": 163, "frame_number": 16209, "timestamp_epoch": "1575413469.819055000" }, { "kind": "dns", "dst_ip": "193.183.98.66", "fields": { "dns.qry.name": "h1.wensa.at", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-08ce17d54eaeb4edf26aeb3b", "src_port": 60992, "tcp_stream": null, "udp_stream": 164, "frame_number": 16308, "timestamp_epoch": "1575413756.153041000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "8.208.24.139,101.226.79.205,58.251.121.110,180.163.8.114,119.28.48.231", "dns.qry.name": "h1.wensa.at", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "193.183.98.66", "dst_port": 60992, "event_id": "evt-5cff8f565c7198b039617070", "src_port": 53, "tcp_stream": null, "udp_stream": 164, "frame_number": 16309, "timestamp_epoch": "1575413756.347599000" }, { "kind": "dns", "dst_ip": "193.183.98.66", "fields": { "dns.qry.name": "h1.wensa.at", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-cec307247b475457fc637ad3", "src_port": 54072, "tcp_stream": null, "udp_stream": 165, "frame_number": 16431, "timestamp_epoch": "1575414056.144786000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "8.208.24.139,58.251.121.110,101.226.79.205,180.163.8.114,119.28.48.231", "dns.qry.name": "h1.wensa.at", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "193.183.98.66", "dst_port": 54072, "event_id": "evt-c24e4946800672512ca29afb", "src_port": 53, "tcp_stream": null, "udp_stream": 165, "frame_number": 16432, "timestamp_epoch": "1575414056.349092000" }, { "kind": "dns", "dst_ip": "193.183.98.66", "fields": { "dns.qry.name": "h1.wensa.at", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-c46bac79ef0029bc3d11bdc7", "src_port": 55358, "tcp_stream": null, "udp_stream": 166, "frame_number": 16442, "timestamp_epoch": "1575414057.220629000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "8.208.24.139,58.251.121.110,101.226.79.205,180.163.8.114,119.28.48.231", "dns.qry.name": "h1.wensa.at", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "193.183.98.66", "dst_port": 55358, "event_id": "evt-a4503ced40a9fab82710323a", "src_port": 53, "tcp_stream": null, "udp_stream": 166, "frame_number": 16443, "timestamp_epoch": "1575414057.413839000" }, { "kind": "dns", "dst_ip": "193.183.98.66", "fields": { "dns.qry.name": "h1.wensa.at", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-e50b4c5c3ba17545142ba77e", "src_port": 60728, "tcp_stream": null, "udp_stream": 168, "frame_number": 16486, "timestamp_epoch": "1575414357.231323000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "8.208.24.139,58.251.121.110,101.226.79.205,119.28.48.231,180.163.8.114", "dns.qry.name": "h1.wensa.at", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "193.183.98.66", "dst_port": 60728, "event_id": "evt-7f6a7f60447d7b2a2bdf55d8", "src_port": 53, "tcp_stream": null, "udp_stream": 168, "frame_number": 16487, "timestamp_epoch": "1575414357.417756000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "secure.bankofamerica.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-563852ff96235999888ba92b", "src_port": 51972, "tcp_stream": null, "udp_stream": 169, "frame_number": 16501, "timestamp_epoch": "1575414483.432527000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "171.161.198.200", "dns.cname": "secure.ecglb.bac.com", "dns.qry.name": "secure.bankofamerica.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 51972, "event_id": "evt-76a9246b867915d15124e345", "src_port": 53, "tcp_stream": null, "udp_stream": 169, "frame_number": 16502, "timestamp_epoch": "1575414483.604203000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "wpad.icemaiden.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-0a97d41d64cd65096d13cadf", "src_port": 54641, "tcp_stream": null, "udp_stream": 170, "frame_number": 16503, "timestamp_epoch": "1575414483.742573000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.qry.name": "wpad.icemaiden.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 54641, "event_id": "evt-1c35564d57df79cd7c7cacbf", "src_port": 53, "tcp_stream": null, "udp_stream": 170, "frame_number": 16504, "timestamp_epoch": "1575414483.742885000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-00a38ec2aae55e4917812b34", "src_port": 65327, "tcp_stream": null, "udp_stream": 171, "frame_number": 16505, "timestamp_epoch": "1575414483.743130000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 65327, "event_id": "evt-22b7dd1ddc678a1a1f7e2be1", "src_port": 53, "tcp_stream": null, "udp_stream": 171, "frame_number": 16509, "timestamp_epoch": "1575414483.793161000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-2878d9128fb7db2210479c8d", "src_port": 57206, "tcp_stream": null, "udp_stream": 175, "frame_number": 17195, "timestamp_epoch": "1575414487.621771000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-d0ab38f999345a873d02e8b9", "src_port": 50672, "tcp_stream": null, "udp_stream": 176, "frame_number": 17196, "timestamp_epoch": "1575414487.622706000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "api.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-55fd34e58083d90da2bebcc8", "src_port": 55769, "tcp_stream": null, "udp_stream": 177, "frame_number": 17197, "timestamp_epoch": "1575414487.622818000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-f2085bdcb546152448f2a642", "src_port": 62255, "tcp_stream": null, "udp_stream": 178, "frame_number": 17198, "timestamp_epoch": "1575414487.624217000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-a17bac7015a055589b8c8f85", "src_port": 61500, "tcp_stream": null, "udp_stream": 179, "frame_number": 17199, "timestamp_epoch": "1575414487.624494000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "api.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-2ddad758020c23d9e54b2868", "src_port": 56618, "tcp_stream": null, "udp_stream": 180, "frame_number": 17200, "timestamp_epoch": "1575414487.625563000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "13.107.5.80", "dns.cname": "api-bing-com.e-0001.e-msedge.net,e-0001.e-msedge.net", "dns.qry.name": "api.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 56618, "event_id": "evt-204d9281213f34e26bf84d20", "src_port": 53, "tcp_stream": null, "udp_stream": 180, "frame_number": 17245, "timestamp_epoch": "1575414487.898383000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "13.107.5.80", "dns.cname": "api-bing-com.e-0001.e-msedge.net,e-0001.e-msedge.net", "dns.qry.name": "api.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 55769, "event_id": "evt-f265c6aa34874f64faa0fb85", "src_port": 53, "tcp_stream": null, "udp_stream": 177, "frame_number": 17247, "timestamp_epoch": "1575414487.898510000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,dual-a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 50672, "event_id": "evt-1b7a30be9894e98dcd521ed0", "src_port": 53, "tcp_stream": null, "udp_stream": 176, "frame_number": 17248, "timestamp_epoch": "1575414487.898629000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,dual-a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 62255, "event_id": "evt-3f15490e6d85923d727c590c", "src_port": 53, "tcp_stream": null, "udp_stream": 178, "frame_number": 17249, "timestamp_epoch": "1575414487.898713000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,dual-a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 61500, "event_id": "evt-d95b8a4ca116026b8ad5984a", "src_port": 53, "tcp_stream": null, "udp_stream": 179, "frame_number": 17250, "timestamp_epoch": "1575414487.898793000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,dual-a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 57206, "event_id": "evt-f1c92032060e555b639eda46", "src_port": 53, "tcp_stream": null, "udp_stream": 175, "frame_number": 17251, "timestamp_epoch": "1575414487.898873000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "bankofamerica.tt.omtrdc.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-d4750deeb626b444476840ab", "src_port": 63363, "tcp_stream": null, "udp_stream": 181, "frame_number": 17334, "timestamp_epoch": "1575414489.089710000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "66.235.147.244,66.235.147.240,130.248.144.16,66.235.147.237,66.235.147.236,130.248.144.23,66.235.147.238,66.235.147.232,66.235.147.234,130.248.144.17,66.235.147.239,66.235.147.233,130.248.144.19,66.235.147.235,66.235.147.246,130.248.144.18", "dns.qry.name": "bankofamerica.tt.omtrdc.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 63363, "event_id": "evt-769a9a751d1dec805f4b3f0a", "src_port": 53, "tcp_stream": null, "udp_stream": 181, "frame_number": 17335, "timestamp_epoch": "1575414489.184029000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "aero.bankofamerica.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-9afbc36c8c95617eb873ed7d", "src_port": 55281, "tcp_stream": null, "udp_stream": 182, "frame_number": 17338, "timestamp_epoch": "1575414489.185931000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "boss.bankofamerica.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-6bbf8a87f16a1ab034eba59e", "src_port": 53540, "tcp_stream": null, "udp_stream": 183, "frame_number": 17339, "timestamp_epoch": "1575414489.187171000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "dull.bankofamerica.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-a51a4453d971aa04fd555df4", "src_port": 63747, "tcp_stream": null, "udp_stream": 184, "frame_number": 17340, "timestamp_epoch": "1575414489.188976000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "rail.bankofamerica.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-74300a23f2e21b80e6d948b9", "src_port": 56056, "tcp_stream": null, "udp_stream": 185, "frame_number": 17347, "timestamp_epoch": "1575414489.232049000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "sofa.bankofamerica.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-8c64ff95ea21873238595410", "src_port": 54966, "tcp_stream": null, "udp_stream": 186, "frame_number": 17348, "timestamp_epoch": "1575414489.271248000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "3.83.197.207,18.214.122.84,35.153.252.120,18.207.32.160,52.70.56.26,54.236.214.197", "dns.cname": "prod-lb-10-490190718.us-east-1.elb.amazonaws.com", "dns.qry.name": "dull.bankofamerica.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 63747, "event_id": "evt-de10ba58379d3eaf651f867a", "src_port": 53, "tcp_stream": null, "udp_stream": 184, "frame_number": 17359, "timestamp_epoch": "1575414489.334625000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "52.202.55.102,34.232.21.42,52.73.52.157,18.215.90.62,34.199.169.142,54.209.91.178", "dns.cname": "prod-lb-8-1772099769.us-east-1.elb.amazonaws.com", "dns.qry.name": "aero.bankofamerica.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 55281, "event_id": "evt-ec3693263549529759776f84", "src_port": 53, "tcp_stream": null, "udp_stream": 182, "frame_number": 17363, "timestamp_epoch": "1575414489.352624000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "54.175.7.235,52.2.220.123,35.173.158.96,52.20.71.5,52.200.145.54,34.197.7.23", "dns.cname": "prod-lb-9-1476932994.us-east-1.elb.amazonaws.com", "dns.qry.name": "boss.bankofamerica.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 53540, "event_id": "evt-54fb449aa3ed5896a71e8a49", "src_port": 53, "tcp_stream": null, "udp_stream": 183, "frame_number": 17364, "timestamp_epoch": "1575414489.352724000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "18.214.122.84,35.153.252.120,18.207.32.160,52.70.56.26,54.236.214.197,3.83.197.207", "dns.cname": "prod-lb-10-490190718.us-east-1.elb.amazonaws.com", "dns.qry.name": "rail.bankofamerica.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 56056, "event_id": "evt-bae97f6164389b2030d573ff", "src_port": 53, "tcp_stream": null, "udp_stream": 185, "frame_number": 17386, "timestamp_epoch": "1575414489.544905000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "199.255.32.89", "dns.qry.name": "sofa.bankofamerica.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 54966, "event_id": "evt-8f41377fd486ac11b90bc518", "src_port": 53, "tcp_stream": null, "udp_stream": 186, "frame_number": 17389, "timestamp_epoch": "1575414489.558324000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "data.coremetrics.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-68291c201b02c7b9aff5777e", "src_port": 57212, "tcp_stream": null, "udp_stream": 187, "frame_number": 17999, "timestamp_epoch": "1575414490.527327000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "129.33.138.31", "dns.qry.name": "data.coremetrics.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 57212, "event_id": "evt-06deb68566ee94e901a4061b", "src_port": 53, "tcp_stream": null, "udp_stream": 187, "frame_number": 18068, "timestamp_epoch": "1575414490.617736000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "www.bankofamerica.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-e92fcb1ee9b5bb2a9167c4fd", "src_port": 58937, "tcp_stream": null, "udp_stream": 188, "frame_number": 18643, "timestamp_epoch": "1575414491.729589000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "171.161.202.100", "dns.cname": "wwwui.ecglb.bac.com", "dns.qry.name": "www.bankofamerica.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 58937, "event_id": "evt-d05caad597b5ec8e5e163ae5", "src_port": 53, "tcp_stream": null, "udp_stream": 188, "frame_number": 18644, "timestamp_epoch": "1575414491.788534000" }, { "kind": "dns", "dst_ip": "10.18.20.8", "fields": { "dns.qry.name": "awuseb.advanced-web-analytics.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-aadf1077ff831997deeb34ac", "src_port": 58325, "tcp_stream": null, "udp_stream": 189, "frame_number": 18877, "timestamp_epoch": "1575414493.246643000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "52.71.154.85,34.194.106.87,52.20.183.229,3.226.23.55,174.129.98.238,54.209.191.239", "dns.cname": "prod-lb-13-1730166618.us-east-1.elb.amazonaws.com", "dns.qry.name": "awuseb.advanced-web-analytics.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.18.20.8", "dst_port": 58325, "event_id": "evt-ea2ea2c81ac75586ae3af7a9", "src_port": 53, "tcp_stream": null, "udp_stream": 189, "frame_number": 18913, "timestamp_epoch": "1575414494.106735000" }, { "kind": "dns", "dst_ip": "193.183.98.66", "fields": { "dns.qry.name": "h1.wensa.at", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-6d768430bf830e83c0005a96", "src_port": 55759, "tcp_stream": null, "udp_stream": 190, "frame_number": 21098, "timestamp_epoch": "1575414657.235731000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "8.208.24.139,58.251.121.110,101.226.79.205,119.28.48.231,180.163.8.114", "dns.qry.name": "h1.wensa.at", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "193.183.98.66", "dst_port": 55759, "event_id": "evt-4160515317923bf43a1bfb75", "src_port": 53, "tcp_stream": null, "udp_stream": 190, "frame_number": 21099, "timestamp_epoch": "1575414657.443819000" }, { "kind": "dns", "dst_ip": "193.183.98.66", "fields": { "dns.qry.name": "h1.wensa.at", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-edfbd87f75f4ccae6f50e803", "src_port": 63644, "tcp_stream": null, "udp_stream": 191, "frame_number": 21109, "timestamp_epoch": "1575414658.310606000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "8.208.24.139,58.251.121.110,101.226.79.205,119.28.48.231,180.163.8.114", "dns.qry.name": "h1.wensa.at", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "193.183.98.66", "dst_port": 63644, "event_id": "evt-6bb943eccd4a7886d1d21b3c", "src_port": 53, "tcp_stream": null, "udp_stream": 191, "frame_number": 21110, "timestamp_epoch": "1575414658.500356000" }, { "kind": "dns", "dst_ip": "193.183.98.66", "fields": { "dns.qry.name": "h1.wensa.at", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": 53, "event_id": "evt-5941683ee17441b21b2f1051", "src_port": 57089, "tcp_stream": null, "udp_stream": 192, "frame_number": 21122, "timestamp_epoch": "1575414669.448772000" }, { "kind": "dns", "dst_ip": "10.18.20.97", "fields": { "dns.a": "8.208.24.139,58.251.121.110,101.226.79.205,180.163.8.114,119.28.48.231", "dns.qry.name": "h1.wensa.at", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "193.183.98.66", "dst_port": 57089, "event_id": "evt-a898511e831df129d983d312", "src_port": 53, "tcp_stream": null, "udp_stream": 192, "frame_number": 21123, "timestamp_epoch": "1575414669.784425000" } ], "dhcp": [ { "kind": "dhcp", "dst_ip": "255.255.255.255", "fields": { "eth.src": "00:01:24:56:9b:cf", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "00:01:24:56:9b:cf,00:01:24:56:9b:cf", "dhcp.option.dhcp": "8", "dhcp.option.hostname": "Juanita-Work-PC" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-892f324355cb4db6d7f60698", "src_port": null, "tcp_stream": null, "udp_stream": 172, "frame_number": 16506, "timestamp_epoch": "1575414483.749103000" }, { "kind": "dhcp", "dst_ip": "10.18.20.97", "fields": { "eth.src": "bc:30:5b:12:a7:3a", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "00:01:24:56:9b:cf", "dhcp.option.dhcp": "5" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-6be3b580b879c0e6e4f31ef0", "src_port": null, "tcp_stream": null, "udp_stream": 173, "frame_number": 16507, "timestamp_epoch": "1575414483.749453000" } ], "smtp": [], "identity": [ { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf", "kerberos.msg_type": "14" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-7cf525fc2eeba33b6fc024b6", "src_port": null, "tcp_stream": 0, "udp_stream": null, "frame_number": 9, "timestamp_epoch": "1575413096.038065000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a", "kerberos.msg_type": "15" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-88fc47f7c7d34eb33eb1c435", "src_port": null, "tcp_stream": 0, "udp_stream": null, "frame_number": 11, "timestamp_epoch": "1575413096.038592000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf", "kerberos.msg_type": "14" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-d6e77bc2fe3db14471b19a6d", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 24, "timestamp_epoch": "1575413096.050082000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a", "kerberos.msg_type": "15" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-cbf4fdbe80ce226c1898b649", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 26, "timestamp_epoch": "1575413096.050558000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf", "kerberos.msg_type": "10", "kerberos.CNameString": "JUANITA-WORK-PC$" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-5a31c89e3632ca77c270480b", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 32, "timestamp_epoch": "1575413096.052549000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a", "kerberos.msg_type": "30" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-1b4532a8315a81f3a60988f5", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 33, "timestamp_epoch": "1575413096.053203000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf", "kerberos.msg_type": "10", "kerberos.CNameString": "JUANITA-WORK-PC$" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-8ac9d65eb1dff0dfa497cedc", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 40, "timestamp_epoch": "1575413096.068791000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a", "kerberos.msg_type": "11", "kerberos.CNameString": "JUANITA-WORK-PC$" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-52f91b02f1e4263de9643220", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 42, "timestamp_epoch": "1575413096.069357000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf", "kerberos.msg_type": "12,14" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-3256ba8d3d35853879d90fa3", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 51, "timestamp_epoch": "1575413096.070606000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a", "kerberos.msg_type": "13", "kerberos.CNameString": "JUANITA-WORK-PC$" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-71a4551144943e177fc1f4e5", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 54, "timestamp_epoch": "1575413096.071249000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-13a4e069f0e821e2d9838ebd", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 65, "timestamp_epoch": "1575413101.218968000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-d6195ed939059ec51778df59", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 66, "timestamp_epoch": "1575413101.219310000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-1b055597d549eb845f43d831", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 67, "timestamp_epoch": "1575413101.219804000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-89ffa6279a79083979f5e183", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 68, "timestamp_epoch": "1575413101.220009000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-ff3258762286f2a9bd3eaf0f", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 69, "timestamp_epoch": "1575413101.220361000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-9a44c641c647de7393efc6f8", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 70, "timestamp_epoch": "1575413101.220513000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-15c077eba990e46d8c745e4f", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 71, "timestamp_epoch": "1575413101.220815000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-9a83beb89bbe6d1249fff360", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 72, "timestamp_epoch": "1575413101.220965000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-0ffc0a3ad679c17e7c100658", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 75, "timestamp_epoch": "1575413113.216021000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-334d2a12caaf5191ed9d350a", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 76, "timestamp_epoch": "1575413113.216351000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf", "kerberos.msg_type": "10", "kerberos.CNameString": "momia.juanita" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-8cee056d12e294b4e2255b27", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 89, "timestamp_epoch": "1575413121.832216000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a", "kerberos.msg_type": "30" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-be78e25e23872be8fdf45262", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 90, "timestamp_epoch": "1575413121.832961000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf", "kerberos.msg_type": "10", "kerberos.CNameString": "momia.juanita" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-dd348e92cd5389826412f79c", "src_port": null, "tcp_stream": 10, "udp_stream": null, "frame_number": 97, "timestamp_epoch": "1575413121.843796000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a", "kerberos.msg_type": "11", "kerberos.CNameString": "momia.juanita" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-01c98c434320f42f415c2993", "src_port": null, "tcp_stream": 10, "udp_stream": null, "frame_number": 99, "timestamp_epoch": "1575413121.844620000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf", "kerberos.msg_type": "12,14" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-53e0b3d0ceff89bb9b600aed", "src_port": null, "tcp_stream": 11, "udp_stream": null, "frame_number": 108, "timestamp_epoch": "1575413121.845437000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a", "kerberos.msg_type": "13", "kerberos.CNameString": "momia.juanita" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-cd2ddabdad5b5786e845e737", "src_port": null, "tcp_stream": 11, "udp_stream": null, "frame_number": 111, "timestamp_epoch": "1575413121.846043000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf", "kerberos.msg_type": "12,14" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-a6443a4c71240421dfdb1cae", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 127, "timestamp_epoch": "1575413122.233900000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a", "kerberos.msg_type": "13", "kerberos.CNameString": "momia.juanita" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-d3049d1c1da8c5ddfa96c1e8", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 130, "timestamp_epoch": "1575413122.234609000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf", "kerberos.msg_type": "14" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-4928e594e2fcc896baf1cafa", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 136, "timestamp_epoch": "1575413122.240229000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a", "kerberos.msg_type": "15" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-3e2416bb23f667012d4d687f", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 138, "timestamp_epoch": "1575413122.240645000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf", "kerberos.msg_type": "15" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-d0b5991682572e518b6e1e09", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 139, "timestamp_epoch": "1575413122.244194000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-25c69f4574a40b657ab8cbd2", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 153, "timestamp_epoch": "1575413122.267589000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-843a52a846bddebbe2182a5b", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 154, "timestamp_epoch": "1575413122.267825000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-d963cbd4684a17d3676ffa0c", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 155, "timestamp_epoch": "1575413122.268082000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf", "kerberos.msg_type": "12,14" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-5984494f3b99121e3bc96a20", "src_port": null, "tcp_stream": 16, "udp_stream": null, "frame_number": 160, "timestamp_epoch": "1575413122.269308000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a", "kerberos.msg_type": "13", "kerberos.CNameString": "momia.juanita" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-a205c4825065f3eaab3eb733", "src_port": null, "tcp_stream": 16, "udp_stream": null, "frame_number": 163, "timestamp_epoch": "1575413122.270169000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf", "kerberos.msg_type": "12,14" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-443426f8754f37e2e77bf290", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 172, "timestamp_epoch": "1575413122.270883000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a", "kerberos.msg_type": "13", "kerberos.CNameString": "momia.juanita" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-60f4e8498961d877312afca2", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 175, "timestamp_epoch": "1575413122.271201000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf", "kerberos.msg_type": "14" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-3cb2c2057b61381c8348cc5c", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 183, "timestamp_epoch": "1575413122.271984000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a", "kerberos.msg_type": "15" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-ccc5730285a598d7a4ba8e43", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 184, "timestamp_epoch": "1575413122.272594000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-985761782f10f3b78e2c4a4e", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 185, "timestamp_epoch": "1575413122.273108000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-95574e958e7dadcf6a0b0e7a", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 186, "timestamp_epoch": "1575413122.273235000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-62008e9f9c38744ea363fc55", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 187, "timestamp_epoch": "1575413122.273449000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-45ee4375bfd926749e8c24ce", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 189, "timestamp_epoch": "1575413122.491056000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-a1645c46a25e2324ae4671c2", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 190, "timestamp_epoch": "1575413122.493055000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-aebca31dddd505957421f00c", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 191, "timestamp_epoch": "1575413122.493211000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf", "kerberos.msg_type": "12,14" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-8501610fdbf34344ea50a420", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 206, "timestamp_epoch": "1575413122.768108000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a", "kerberos.msg_type": "13", "kerberos.CNameString": "momia.juanita" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-64e7f784f3e457be341914b5", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 209, "timestamp_epoch": "1575413122.768900000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf", "kerberos.msg_type": "14" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-edd0f88a1b9cf0e6c21bedab", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 215, "timestamp_epoch": "1575413122.769613000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a", "kerberos.msg_type": "15" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-31457f2e483d19957194336e", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 217, "timestamp_epoch": "1575413122.770131000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf", "kerberos.msg_type": "14" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-843fae7cae1c5df5eda50782", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 224, "timestamp_epoch": "1575413122.776163000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a", "kerberos.msg_type": "15" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-a61ef833d371dd5cfd5657d3", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 226, "timestamp_epoch": "1575413122.776674000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-6c71346b5b128e732f59e040", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 236, "timestamp_epoch": "1575413122.781031000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-32209b98b871613448da6e5c", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 237, "timestamp_epoch": "1575413122.781228000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf", "kerberos.msg_type": "14" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-6b37794073e3a720fdc88213", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 241, "timestamp_epoch": "1575413122.782120000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a", "kerberos.msg_type": "15" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-cc34b728b408ac80268409e7", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 242, "timestamp_epoch": "1575413122.782719000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-aaff901ce94bbdadcefd2242", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 243, "timestamp_epoch": "1575413122.783269000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-68b33feb2e2fa331b6b47c4a", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 244, "timestamp_epoch": "1575413122.783372000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-7de6c486b24af14502d60422", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 245, "timestamp_epoch": "1575413122.783705000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-44e22fc1003021900ed29b58", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 246, "timestamp_epoch": "1575413122.783974000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-6d604e3bca5c7cb385ca5fa6", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 247, "timestamp_epoch": "1575413122.784333000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-b7d42d21d5e58d55b5731e09", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 248, "timestamp_epoch": "1575413122.784443000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-7b5904226f0c0aa534f9a2da", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 260, "timestamp_epoch": "1575413125.209361000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-14afb7dbfb06fb6a8623a992", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 261, "timestamp_epoch": "1575413125.209575000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-9b2bbf75bf5847f0e53aaaa4", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 262, "timestamp_epoch": "1575413125.210348000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-cd61e7c67bc2c7d880c75d39", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 263, "timestamp_epoch": "1575413125.210480000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-d9a119d96e03cb43adcf22e5", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 265, "timestamp_epoch": "1575413137.208669000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-06411d7ccafa9fb238490b39", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 266, "timestamp_epoch": "1575413137.208885000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-21b7df0f264c4ba28fdc109b", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 272, "timestamp_epoch": "1575413149.205702000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-1dd6d4c63c518cc9da2882e5", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 273, "timestamp_epoch": "1575413149.205948000" }, { "kind": "identity", "dst_ip": "10.18.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:01:24:56:9b:cf", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-4b8b835dc0b6745e3d354ffc", "src_port": null, "tcp_stream": null, "udp_stream": 5, "frame_number": 277, "timestamp_epoch": "1575413155.774442000" }, { "kind": "identity", "dst_ip": "10.18.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:01:24:56:9b:cf", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-3ea9630908c2651c5d3ed995", "src_port": null, "tcp_stream": null, "udp_stream": 5, "frame_number": 302, "timestamp_epoch": "1575413156.536928000" }, { "kind": "identity", "dst_ip": "10.18.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:01:24:56:9b:cf", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-7bf5cd9320aa8b7802125177", "src_port": null, "tcp_stream": null, "udp_stream": 5, "frame_number": 355, "timestamp_epoch": "1575413157.300538000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-fb475642c3cca2104a74c8f1", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 728, "timestamp_epoch": "1575413161.216094000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-53e0389e35e719ca966d5192", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 729, "timestamp_epoch": "1575413161.216273000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-21f446599b402200e63b8db0", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 730, "timestamp_epoch": "1575413161.216455000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-832f93be4f068f2c7978d1a0", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 731, "timestamp_epoch": "1575413161.216573000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-53c022405243c0de75543bc8", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 2863, "timestamp_epoch": "1575413173.820847000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-ee5c97bbc88dc0897a91fd08", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 2864, "timestamp_epoch": "1575413173.821100000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-f1c6411f173401667edf86c5", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 2865, "timestamp_epoch": "1575413173.821760000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-ba1763de71ddb8d7ca648831", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 2866, "timestamp_epoch": "1575413173.927051000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-591b8cc95fdc73378d7c3397", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 2892, "timestamp_epoch": "1575413185.207779000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-1b7f45e485380ae86ad6d74d", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 2893, "timestamp_epoch": "1575413185.208046000" }, { "kind": "identity", "dst_ip": "10.18.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:01:24:56:9b:cf", "nbns.name": "B.AOL.COM<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-c99a8f2d1f92b9ca75f1b688", "src_port": null, "tcp_stream": null, "udp_stream": 5, "frame_number": 7468, "timestamp_epoch": "1575413254.085162000" }, { "kind": "identity", "dst_ip": "10.18.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:01:24:56:9b:cf", "nbns.name": "B.AOL.COM<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-83e98cb633931a776656c0e9", "src_port": null, "tcp_stream": null, "udp_stream": 5, "frame_number": 7619, "timestamp_epoch": "1575413254.834177000" }, { "kind": "identity", "dst_ip": "10.18.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:01:24:56:9b:cf", "nbns.name": "B.AOL.COM<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-5312f2d4324ad1c26cb7ba69", "src_port": null, "tcp_stream": null, "udp_stream": 5, "frame_number": 7777, "timestamp_epoch": "1575413255.599260000" }, { "kind": "identity", "dst_ip": "10.18.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:01:24:56:9b:cf", "nbns.name": "B.AOL.COM<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-0004b57d0d8ac0958cfa851b", "src_port": null, "tcp_stream": null, "udp_stream": 5, "frame_number": 7844, "timestamp_epoch": "1575413256.364191000" }, { "kind": "identity", "dst_ip": "10.18.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:01:24:56:9b:cf", "nbns.name": "B.AOL.COM<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-022282ff2adae8f247c94ee0", "src_port": null, "tcp_stream": null, "udp_stream": 5, "frame_number": 7983, "timestamp_epoch": "1575413257.126264000" }, { "kind": "identity", "dst_ip": "10.18.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:01:24:56:9b:cf", "nbns.name": "B.AOL.COM<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-a42e467bb09af5eb6cf51502", "src_port": null, "tcp_stream": null, "udp_stream": 5, "frame_number": 8075, "timestamp_epoch": "1575413257.883836000" }, { "kind": "identity", "dst_ip": "10.18.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:01:24:56:9b:cf", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-aeb27c9676ae1eb697dfc416", "src_port": null, "tcp_stream": null, "udp_stream": 5, "frame_number": 12176, "timestamp_epoch": "1575413302.544016000" }, { "kind": "identity", "dst_ip": "10.18.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:01:24:56:9b:cf", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-3a08e26936eb7e9e38a90c97", "src_port": null, "tcp_stream": null, "udp_stream": 5, "frame_number": 12518, "timestamp_epoch": "1575413303.301903000" }, { "kind": "identity", "dst_ip": "10.18.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:01:24:56:9b:cf", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-10ab02937a32b558e69dfff9", "src_port": null, "tcp_stream": null, "udp_stream": 5, "frame_number": 12541, "timestamp_epoch": "1575413304.066204000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-ffadd591f89673d67b34006c", "src_port": null, "tcp_stream": 438, "udp_stream": null, "frame_number": 16411, "timestamp_epoch": "1575413985.650875000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-7a17d13c0890dc6ba057fd6d", "src_port": null, "tcp_stream": 438, "udp_stream": null, "frame_number": 16412, "timestamp_epoch": "1575413985.651010000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-44f316521bd74ad7eff37ac6", "src_port": null, "tcp_stream": 438, "udp_stream": null, "frame_number": 16413, "timestamp_epoch": "1575413985.651158000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf", "kerberos.msg_type": "14" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-ba72a6085a387899257e98d7", "src_port": null, "tcp_stream": 438, "udp_stream": null, "frame_number": 16417, "timestamp_epoch": "1575413985.652198000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a", "kerberos.msg_type": "15" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-960bb74586b43223a337ff8e", "src_port": null, "tcp_stream": 438, "udp_stream": null, "frame_number": 16418, "timestamp_epoch": "1575413985.652796000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-dd4d62e1918f5df928ecdde2", "src_port": null, "tcp_stream": 438, "udp_stream": null, "frame_number": 16419, "timestamp_epoch": "1575413985.653135000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-93a812c0e2fbdfd58449dca6", "src_port": null, "tcp_stream": 438, "udp_stream": null, "frame_number": 16420, "timestamp_epoch": "1575413985.653235000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-b132e1f8d53ba065f10b76ba", "src_port": null, "tcp_stream": 438, "udp_stream": null, "frame_number": 16421, "timestamp_epoch": "1575413985.653484000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-c0e85761a9d419baf0bf4b5a", "src_port": null, "tcp_stream": 438, "udp_stream": null, "frame_number": 16422, "timestamp_epoch": "1575413985.653613000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-069fc05720cf546444bbffad", "src_port": null, "tcp_stream": 438, "udp_stream": null, "frame_number": 16424, "timestamp_epoch": "1575414001.213750000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-4ec7428600e2e90df5e55577", "src_port": null, "tcp_stream": 438, "udp_stream": null, "frame_number": 16425, "timestamp_epoch": "1575414001.214022000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-08a4de2a7d7d2e694d022bee", "src_port": null, "tcp_stream": 438, "udp_stream": null, "frame_number": 16426, "timestamp_epoch": "1575414001.214232000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-b63ee6fb7601e812a91a6da4", "src_port": null, "tcp_stream": 438, "udp_stream": null, "frame_number": 16427, "timestamp_epoch": "1575414001.214409000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-fcefdeb250206cac76cc6d68", "src_port": null, "tcp_stream": 441, "udp_stream": null, "frame_number": 16461, "timestamp_epoch": "1575414185.260990000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-60a3e0b05e9784569eb866dc", "src_port": null, "tcp_stream": 441, "udp_stream": null, "frame_number": 16462, "timestamp_epoch": "1575414185.261227000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf", "kerberos.msg_type": "14" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-3bcc05bfc3f0a3e50a045524", "src_port": null, "tcp_stream": 441, "udp_stream": null, "frame_number": 16466, "timestamp_epoch": "1575414185.262558000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a", "kerberos.msg_type": "15" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-d379e7dc1a774cc2c85331c4", "src_port": null, "tcp_stream": 441, "udp_stream": null, "frame_number": 16467, "timestamp_epoch": "1575414185.263116000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-e081c03cc591949c88b5e320", "src_port": null, "tcp_stream": 441, "udp_stream": null, "frame_number": 16468, "timestamp_epoch": "1575414185.263537000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-909c8bc726fcd633621fd63e", "src_port": null, "tcp_stream": 441, "udp_stream": null, "frame_number": 16469, "timestamp_epoch": "1575414185.263639000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-0dff50f0818adfe02675c218", "src_port": null, "tcp_stream": 441, "udp_stream": null, "frame_number": 16470, "timestamp_epoch": "1575414185.264157000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-fdbff3f084daab30ed3677c0", "src_port": null, "tcp_stream": 441, "udp_stream": null, "frame_number": 16471, "timestamp_epoch": "1575414185.374660000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-e03431404c7595e17e165a5e", "src_port": null, "tcp_stream": 441, "udp_stream": null, "frame_number": 16472, "timestamp_epoch": "1575414185.375135000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-95444b79e2895a22a78bb43a", "src_port": null, "tcp_stream": 441, "udp_stream": null, "frame_number": 16473, "timestamp_epoch": "1575414185.375319000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-0110376ce4a0712a15471155", "src_port": null, "tcp_stream": 441, "udp_stream": null, "frame_number": 16475, "timestamp_epoch": "1575414185.766511000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-2d86a10bddfd703ccdcc6007", "src_port": null, "tcp_stream": 441, "udp_stream": null, "frame_number": 16476, "timestamp_epoch": "1575414185.766900000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-3f87e1fe24d6612d94f63438", "src_port": null, "tcp_stream": 441, "udp_stream": null, "frame_number": 16478, "timestamp_epoch": "1575414194.876045000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-cbdda72afc8cbe439346a4ba", "src_port": null, "tcp_stream": 441, "udp_stream": null, "frame_number": 16479, "timestamp_epoch": "1575414194.876419000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-ea11ca8af9f74290a58154c5", "src_port": null, "tcp_stream": 441, "udp_stream": null, "frame_number": 16481, "timestamp_epoch": "1575414199.209553000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-fb7f3f293576e43c06012ff6", "src_port": null, "tcp_stream": 441, "udp_stream": null, "frame_number": 16482, "timestamp_epoch": "1575414199.209789000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:01:24:56:9b:cf", "dns.qry.name": "wpad" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-f39e624521903db03e20ddce", "src_port": null, "tcp_stream": null, "udp_stream": 174, "frame_number": 16510, "timestamp_epoch": "1575414483.793665000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:01:24:56:9b:cf", "dns.qry.name": "wpad" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-e5c222318f53cff2b242b568", "src_port": null, "tcp_stream": null, "udp_stream": 174, "frame_number": 16515, "timestamp_epoch": "1575414483.890674000" }, { "kind": "identity", "dst_ip": "10.18.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:01:24:56:9b:cf", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-ab2a624a77d554f567c95dae", "src_port": null, "tcp_stream": null, "udp_stream": 5, "frame_number": 16522, "timestamp_epoch": "1575414484.094923000" }, { "kind": "identity", "dst_ip": "10.18.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:01:24:56:9b:cf", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-c4352161b457bc5c7ae76a16", "src_port": null, "tcp_stream": null, "udp_stream": 5, "frame_number": 16556, "timestamp_epoch": "1575414484.858314000" }, { "kind": "identity", "dst_ip": "10.18.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:01:24:56:9b:cf", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-7c818b7c618d978c4ecc947b", "src_port": null, "tcp_stream": null, "udp_stream": 5, "frame_number": 16713, "timestamp_epoch": "1575414485.622146000" }, { "kind": "identity", "dst_ip": "10.18.20.8", "fields": { "eth.dst": "bc:30:5b:12:a7:3a", "eth.src": "00:01:24:56:9b:cf" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-45bb75f3ffb0ca563048078b", "src_port": null, "tcp_stream": 441, "udp_stream": null, "frame_number": 21167, "timestamp_epoch": "1575414688.037827000" }, { "kind": "identity", "dst_ip": "10.18.20.97", "fields": { "eth.dst": "00:01:24:56:9b:cf", "eth.src": "bc:30:5b:12:a7:3a" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-daee9a1beb730da0a9770b67", "src_port": null, "tcp_stream": 441, "udp_stream": null, "frame_number": 21168, "timestamp_epoch": "1575414688.038042000" } ], "http_request": [ { "kind": "http_request", "dst_ip": "69.147.64.34", "fields": { "http.host": "mail.aol.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/", "http.response_in": "283", "http.request.method": "GET", "http.request.full_uri": "http://mail.aol.com/" }, "src_ip": "10.18.20.97", "dst_port": 80, "event_id": "evt-ae87839368c83c59ea8b7ffc", "src_port": 49203, "tcp_stream": 22, "udp_stream": null, "frame_number": 281, "timestamp_epoch": "1575413155.938245000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-c575c13f8c09a4db99f6d673", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 3182, "timestamp_epoch": "1575413205.860754000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-be1dd033bd55a26fe070b393", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 3184, "timestamp_epoch": "1575413206.181964000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-47feabbf3a37fcebd6bfbcb8", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 3199, "timestamp_epoch": "1575413208.859570000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-aac2b3cd7f725daf593ecbc9", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 3218, "timestamp_epoch": "1575413209.186580000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-bdc2eb29f538b73fbd80d1b6", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 3498, "timestamp_epoch": "1575413211.874717000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-5b1620e709cd931657b0f392", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 3534, "timestamp_epoch": "1575413212.187013000" }, { "kind": "http_request", "dst_ip": "91.199.212.52", "fields": { "http.host": "crt.usertrust.com", "http.user_agent": "Microsoft-CryptoAPI/6.1", "http.request.uri": "/USERTrustRSAAddTrustCA.crt", "http.response_in": "10693", "http.request.method": "GET", "http.request.full_uri": "http://crt.usertrust.com/USERTrustRSAAddTrustCA.crt" }, "src_ip": "10.18.20.97", "dst_port": 80, "event_id": "evt-9fb3df2f5cf2356d3bf190bc", "src_port": 49434, "tcp_stream": 254, "udp_stream": null, "frame_number": 10625, "timestamp_epoch": "1575413266.902247000" }, { "kind": "http_request", "dst_ip": "91.199.212.52", "fields": { "http.host": "crt.usertrust.com", "http.user_agent": "Microsoft-CryptoAPI/6.1", "http.request.uri": "/USERTrustRSAAddTrustCA.crt", "http.response_in": "10698", "http.request.method": "GET", "http.request.full_uri": "http://crt.usertrust.com/USERTrustRSAAddTrustCA.crt" }, "src_ip": "10.18.20.97", "dst_port": 80, "event_id": "evt-d057130e30537ef91f68c469", "src_port": 49433, "tcp_stream": 253, "udp_stream": null, "frame_number": 10629, "timestamp_epoch": "1575413266.906579000" }, { "kind": "http_request", "dst_ip": "198.70.69.154", "fields": { "http.host": "www.download.windowsupdate.com", "http.user_agent": "Microsoft-CryptoAPI/6.1", "http.request.uri": "/msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt", "http.response_in": "10735", "http.request.method": "GET", "http.request.full_uri": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt" }, "src_ip": "10.18.20.97", "dst_port": 80, "event_id": "evt-d9f01e45eac5a50535013594", "src_port": 49436, "tcp_stream": 256, "udp_stream": null, "frame_number": 10681, "timestamp_epoch": "1575413267.275134000" }, { "kind": "http_request", "dst_ip": "198.70.69.154", "fields": { "http.host": "www.download.windowsupdate.com", "http.user_agent": "Microsoft-CryptoAPI/6.1", "http.request.uri": "/msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt", "http.response_in": "10737", "http.request.method": "GET", "http.request.full_uri": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt" }, "src_ip": "10.18.20.97", "dst_port": 80, "event_id": "evt-b0639d2579e473315c66fda9", "src_port": 49437, "tcp_stream": 257, "udp_stream": null, "frame_number": 10684, "timestamp_epoch": "1575413267.275288000" }, { "kind": "http_request", "dst_ip": "198.70.69.154", "fields": { "http.host": "www.download.windowsupdate.com", "http.user_agent": "Microsoft-CryptoAPI/6.1", "http.request.uri": "/msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt", "http.response_in": "10807", "http.request.method": "GET", "http.request.full_uri": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt" }, "src_ip": "10.18.20.97", "dst_port": 80, "event_id": "evt-224535e9548cdedda90fc632", "src_port": 49436, "tcp_stream": 256, "udp_stream": null, "frame_number": 10744, "timestamp_epoch": "1575413267.573647000" }, { "kind": "http_request", "dst_ip": "198.70.69.154", "fields": { "http.host": "www.download.windowsupdate.com", "http.user_agent": "Microsoft-CryptoAPI/6.1", "http.request.uri": "/msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt", "http.response_in": "10808", "http.request.method": "GET", "http.request.full_uri": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt" }, "src_ip": "10.18.20.97", "dst_port": 80, "event_id": "evt-27f173c28ef2f58a50d36c5a", "src_port": 49437, "tcp_stream": 257, "udp_stream": null, "frame_number": 10746, "timestamp_epoch": "1575413267.574570000" }, { "kind": "http_request", "dst_ip": "104.69.23.209", "fields": { "http.host": "go.microsoft.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/fwlink/?LinkID=403856&language=en-US&scale=100&contrast=gray", "http.response_in": "12995", "http.request.method": "GET", "http.request.full_uri": "http://go.microsoft.com/fwlink/?LinkID=403856&language=en-US&scale=100&contrast=gray" }, "src_ip": "10.18.20.97", "dst_port": 80, "event_id": "evt-3fc953cfd56841037e3eb73d", "src_port": 49509, "tcp_stream": 329, "udp_stream": null, "frame_number": 12951, "timestamp_epoch": "1575413305.661450000" }, { "kind": "http_request", "dst_ip": "8.208.24.139", "fields": { "http.host": "w8.wensa.at", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/api1/PUbKL64xdNDApQ_2FhOvR/PzVuL7v93RbB1xfc/OEnwN9VtRcH8Ccu/jPgnw0d37uDEzDiVOf/KHgo0k5Uc/k6JCnK_2FBZ4yd9zeeiC/VpJpc2JMgFpc_2BUK2N/MNdoh0fThkbLeh37DCpXrm/guVivsIWc_2FM/aKnRfxy_/2FhTlme15XsXbjEQesbQbAJ/Z9BLtjy3Zi/ZcwiqStUG_2BZapZN/hqA8oHVvfrmy/sqq6RrFWUhE/NiEXX3DV0k2wcp/3ypM4pRUl6ezpp8W_0A_0/Dq6VuunS4q_2BKna/0dWjHSjvGD9y/2", "http.response_in": "15565", "http.request.method": "GET", "http.request.full_uri": "http://w8.wensa.at/api1/PUbKL64xdNDApQ_2FhOvR/PzVuL7v93RbB1xfc/OEnwN9VtRcH8Ccu/jPgnw0d37uDEzDiVOf/KHgo0k5Uc/k6JCnK_2FBZ4yd9zeeiC/VpJpc2JMgFpc_2BUK2N/MNdoh0fThkbLeh37DCpXrm/guVivsIWc_2FM/aKnRfxy_/2FhTlme15XsXbjEQesbQbAJ/Z9BLtjy3Zi/ZcwiqStUG_2BZapZN/hqA8oHVvfrmy/sqq6RrFWUhE/NiEXX3DV0k2wcp/3ypM4pRUl6ezpp8W_0A_0/Dq6VuunS4q_2BKna/0dWjHSjvGD9y/2" }, "src_ip": "10.18.20.97", "dst_port": 80, "event_id": "evt-daa2eb11836ccbb1005884af", "src_port": 49593, "tcp_stream": 420, "udp_stream": null, "frame_number": 15288, "timestamp_epoch": "1575413425.959473000" }, { "kind": "http_request", "dst_ip": "8.208.24.139", "fields": { "http.host": "8.208.24.139", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/favicon.ico", "http.response_in": "15571", "http.request.method": "GET", "http.request.full_uri": "http://8.208.24.139/favicon.ico" }, "src_ip": "10.18.20.97", "dst_port": 80, "event_id": "evt-2f5cbea4d83780e3696a455a", "src_port": 49592, "tcp_stream": 421, "udp_stream": null, "frame_number": 15569, "timestamp_epoch": "1575413427.772846000" }, { "kind": "http_request", "dst_ip": "8.208.24.139", "fields": { "http.host": "w8.wensa.at", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/api1/I01zepn8d/lW8zbbQjFkfEikrpMjIM/BUpAeRTlHQ4bvFyNQ5b/QJQiaBloENVY8vhKyUyE0o/DlBxOkmYhfcXF/f83ZepX0/p4w8NwGSdWiq2d0xSm7dQRx/c9TVoEwwGP/q1ZfqVF4Kk65L3fk5/ZmA_2F4e_2Fz/EA15GMwiWYS/dM6cnd6KMsJ08_/2FGuylglowKzvlAqp_2B7/1F_2FeKeSZFlbTaP/MX93YLJkZgekq1k/2ECfT2iPz4_2FLNdDL/PjdGytsj5/j_2BwGYOG_0A_0DWVnLJ/lblBYSp5hbm4QlU/JSHmUi", "http.response_in": "15940", "http.request.method": "GET", "http.request.full_uri": "http://w8.wensa.at/api1/I01zepn8d/lW8zbbQjFkfEikrpMjIM/BUpAeRTlHQ4bvFyNQ5b/QJQiaBloENVY8vhKyUyE0o/DlBxOkmYhfcXF/f83ZepX0/p4w8NwGSdWiq2d0xSm7dQRx/c9TVoEwwGP/q1ZfqVF4Kk65L3fk5/ZmA_2F4e_2Fz/EA15GMwiWYS/dM6cnd6KMsJ08_/2FGuylglowKzvlAqp_2B7/1F_2FeKeSZFlbTaP/MX93YLJkZgekq1k/2ECfT2iPz4_2FLNdDL/PjdGytsj5/j_2BwGYOG_0A_0DWVnLJ/lblBYSp5hbm4QlU/JSHmUi" }, "src_ip": "10.18.20.97", "dst_port": 80, "event_id": "evt-3c3b5ce3044560d7898b975e", "src_port": 49595, "tcp_stream": 422, "udp_stream": null, "frame_number": 15581, "timestamp_epoch": "1575413428.857662000" }, { "kind": "http_request", "dst_ip": "8.208.24.139", "fields": { "http.host": "8.208.24.139", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/favicon.ico", "http.response_in": "15946", "http.request.method": "GET", "http.request.full_uri": "http://8.208.24.139/favicon.ico" }, "src_ip": "10.18.20.97", "dst_port": 80, "event_id": "evt-a0ba1969a7ca191047e1a4df", "src_port": 49594, "tcp_stream": 423, "udp_stream": null, "frame_number": 15944, "timestamp_epoch": "1575413432.842336000" }, { "kind": "http_request", "dst_ip": "8.208.24.139", "fields": { "http.host": "w8.wensa.at", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/api1/yHuijzBzQc46MJ8Hh_2B3To/h6eUe0SPQ_/2FyC9fDGgAdh4u0V0/Y_2F7w0Pe86d/_2FTkP74EP4/K1gu1U6e0AQB5l/cREXUjyc5L8u6LnRWbbL1/uRyhvKc_2FJntmF6/2AoYMEWtimRTV2a/PtgF_2F7ZN3svdTbI8/iP951uoBL/13G66amAYJslhDbJ9LRx/3TnU8ybVEHD70NlfPgK/H8jUEtFKAt07GB5iuDJECi/UWsRrR1g_2FwB/Fis0q36f/6B9w_2F9mwHOMRaRAywS_0A/_0DXkcCzh7/ICclVahOB309_2F/AEHAZk", "http.response_in": "15961", "http.request.method": "GET", "http.request.full_uri": "http://w8.wensa.at/api1/yHuijzBzQc46MJ8Hh_2B3To/h6eUe0SPQ_/2FyC9fDGgAdh4u0V0/Y_2F7w0Pe86d/_2FTkP74EP4/K1gu1U6e0AQB5l/cREXUjyc5L8u6LnRWbbL1/uRyhvKc_2FJntmF6/2AoYMEWtimRTV2a/PtgF_2F7ZN3svdTbI8/iP951uoBL/13G66amAYJslhDbJ9LRx/3TnU8ybVEHD70NlfPgK/H8jUEtFKAt07GB5iuDJECi/UWsRrR1g_2FwB/Fis0q36f/6B9w_2F9mwHOMRaRAywS_0A/_0DXkcCzh7/ICclVahOB309_2F/AEHAZk" }, "src_ip": "10.18.20.97", "dst_port": 80, "event_id": "evt-7cd13772cd68dc6883517d42", "src_port": 49596, "tcp_stream": 424, "udp_stream": null, "frame_number": 15956, "timestamp_epoch": "1575413434.456567000" }, { "kind": "http_request", "dst_ip": "8.208.24.139", "fields": { "http.host": "api2.casus.at", "http.request.uri": "/jvassets/xI/t64.dat", "http.response_in": "16124", "http.request.method": "GET", "http.request.full_uri": "http://api2.casus.at/jvassets/xI/t64.dat" }, "src_ip": "10.18.20.97", "dst_port": 80, "event_id": "evt-744a82deda41cdaf34447edc", "src_port": 49598, "tcp_stream": 426, "udp_stream": null, "frame_number": 15971, "timestamp_epoch": "1575413440.713801000" }, { "kind": "http_request", "dst_ip": "8.208.24.139", "fields": { "http.host": "h1.wensa.at", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0", "http.request.uri": "/api1/QgPIxa1ctWDK/QU9lAhPb2iw/5sIZr5uccWlTxZ/uU_2FqywknwxovxrWm_2F/ahch3EAUKYeQXCzA/Vynn0p13_2Bpxqw/tiWI5q5zVB6xDKKPsK/jd8RtPdHr/U9wvSAKUxuqoPqHyK80e/Pp9fwSrn2K6_2Fx6Jvq/O_2BxEc_2BAPBPnfun8is9/51Pm2zx2o6hHW/9lHHpa80/bTCwozeMJ4Mrk2q9WhpEAE3/l4oUJWp_2F/I_2FM41FL473zUEnL/2cD_2FdZ8qun/29km6_2F7t_/2BL_0A_0DoEVkm/rcBnMNBSpm5xuE8tfj0dd/xPdfTqFLXz5KI7CFdVm/7Z", "http.response_in": "16155", "http.request.method": "GET", "http.request.full_uri": "http://h1.wensa.at/api1/QgPIxa1ctWDK/QU9lAhPb2iw/5sIZr5uccWlTxZ/uU_2FqywknwxovxrWm_2F/ahch3EAUKYeQXCzA/Vynn0p13_2Bpxqw/tiWI5q5zVB6xDKKPsK/jd8RtPdHr/U9wvSAKUxuqoPqHyK80e/Pp9fwSrn2K6_2Fx6Jvq/O_2BxEc_2BAPBPnfun8is9/51Pm2zx2o6hHW/9lHHpa80/bTCwozeMJ4Mrk2q9WhpEAE3/l4oUJWp_2F/I_2FM41FL473zUEnL/2cD_2FdZ8qun/29km6_2F7t_/2BL_0A_0DoEVkm/rcBnMNBSpm5xuE8tfj0dd/xPdfTqFLXz5KI7CFdVm/7Z" }, "src_ip": "10.18.20.97", "dst_port": 80, "event_id": "evt-f29ae4f062ebc294702a8e51", "src_port": 49599, "tcp_stream": 427, "udp_stream": null, "frame_number": 16153, "timestamp_epoch": "1575413455.515761000" }, { "kind": "http_request", "dst_ip": "8.208.24.139", "fields": { "http.host": "h1.wensa.at", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0", "http.request.uri": "/api1/NdyKQBz2bkQyWRjW/DQxAC7LXQQhux0L/JG8Hy_2FKtggSPly52/OI_2Bww0d/GlhCZjLB1qzPFsZmpylg/Ms3wZA3Stl71Q46KRVb/iVLkW9gg4uKEOIATInV3zY/iLuKm_2BHFq5Q/sYBbWlUn/p_2BS4xgcBhCn0_2FVa5JBR/FwZ3dNRALU/50_2FvcGyN_2Bi_2F/gT8JmJY_2Frd/Lwf2Rf9oDBS/vn2noKvqMLt20R/8_2Fy946FBaM8_2F1ADOd/yK0bIHFjspZwtBHx/YHVqsuHv6P_0A_0/Dv9mhzaFuIXiIwIFNV/J7o6OM2pj/ergUZu91KSmAuKhCbtY2/Z7AlSzdNRd_2F_2BrH8/VYH_2BmX/E", "http.response_in": "16174", "http.content_length": "2", "http.request.method": "POST", "http.request.full_uri": "http://h1.wensa.at/api1/NdyKQBz2bkQyWRjW/DQxAC7LXQQhux0L/JG8Hy_2FKtggSPly52/OI_2Bww0d/GlhCZjLB1qzPFsZmpylg/Ms3wZA3Stl71Q46KRVb/iVLkW9gg4uKEOIATInV3zY/iLuKm_2BHFq5Q/sYBbWlUn/p_2BS4xgcBhCn0_2FVa5JBR/FwZ3dNRALU/50_2FvcGyN_2Bi_2F/gT8JmJY_2Frd/Lwf2Rf9oDBS/vn2noKvqMLt20R/8_2Fy946FBaM8_2F1ADOd/yK0bIHFjspZwtBHx/YHVqsuHv6P_0A_0/Dv9mhzaFuIXiIwIFNV/J7o6OM2pj/ergUZu91KSmAuKhCbtY2/Z7AlSzdNRd_2F_2BrH8/VYH_2BmX/E" }, "src_ip": "10.18.20.97", "dst_port": 80, "event_id": "evt-53f35966796b8ecf7a29dd60", "src_port": 49600, "tcp_stream": 428, "udp_stream": null, "body_sha256": "7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6", "frame_number": 16166, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 2, "timestamp_epoch": "1575413456.606844000" }, { "kind": "http_request", "dst_ip": "8.208.24.139", "fields": { "http.host": "h1.wensa.at", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0", "http.request.uri": "/api1/4G0Wr6wO0HVb0ZSY2qm1/K1Uti_2FLNMYqzVrRDZ/USwqUHH_2BR0sNak0R4hRv/pjmVHxq_2FHK7/gwr3QR_2/F95tBCofLSdp1GzKpWuUbPl/LkP69828Bg/sLa1g3aY92ruiOrwK/B6AOBbGIQkio/LQLsJMyJVoH/biNOzDGmPi2Uwb/4jTXSNpqxsQcNUBMrPQbG/5Z7IUjAPqkHv58af/nup7A2KuNKzkTI_/2B70soMb_2B1oRHobL/K3X5EHhbt/zI_2BkMzoLvAQQP8D5_0/A_0Dmg_2Baf6QCX7ZjI/7qKQ4rQKPPaCrEDkSgpBbL/ALG4SCtaG/5p6", "http.response_in": "16187", "http.content_length": "204", "http.request.method": "POST", "http.request.full_uri": "http://h1.wensa.at/api1/4G0Wr6wO0HVb0ZSY2qm1/K1Uti_2FLNMYqzVrRDZ/USwqUHH_2BR0sNak0R4hRv/pjmVHxq_2FHK7/gwr3QR_2/F95tBCofLSdp1GzKpWuUbPl/LkP69828Bg/sLa1g3aY92ruiOrwK/B6AOBbGIQkio/LQLsJMyJVoH/biNOzDGmPi2Uwb/4jTXSNpqxsQcNUBMrPQbG/5Z7IUjAPqkHv58af/nup7A2KuNKzkTI_/2B70soMb_2B1oRHobL/K3X5EHhbt/zI_2BkMzoLvAQQP8D5_0/A_0Dmg_2Baf6QCX7ZjI/7qKQ4rQKPPaCrEDkSgpBbL/ALG4SCtaG/5p6" }, "src_ip": "10.18.20.97", "dst_port": 80, "event_id": "evt-adfe4c3c5c8d7acf4a360982", "src_port": 49601, "tcp_stream": 429, "udp_stream": null, "body_sha256": "afb96043d1f8390179fe445d5063c434d4df10fa0194e7879ecadf4c9e8f9b78", "frame_number": 16185, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 204, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 204, "timestamp_epoch": "1575413457.706444000" }, { "kind": "http_request", "dst_ip": "8.208.24.139", "fields": { "http.host": "h1.wensa.at", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0", "http.request.uri": "/api1/vkxyxZ87Twi_2Fn1PHKp/03jApGbg_2BRhYkWe9k/esP6O8hbXHW6ZPgXl_2BSj/eoO9reGwFG5Nl/0Bl4MK9Y/Jd_2BNDeICtWFs2iHFgpCDs/67mGV1rAHa/zuH8BB7FghT4J2TNj/R4rOjkgHMzJa/gbTEXT5RJwF/2fmttnND48mMIW/wti0svI2LCBV161F0fEVF/14N3kRMB1SGN44Nm/X7RDPysDrd8saSl/jYZkFcj_2BzrVuVXSM/6kM52Gg2R/Qs_2FpbLz0jSKD_2Bh_0/A_0Decb6GJ_2BMAJGne/vVWWOh9xt4K0tz2TppftCo/JsWCPltqz/XLm", "http.response_in": "16204", "http.content_length": "433", "http.request.method": "POST", "http.request.full_uri": "http://h1.wensa.at/api1/vkxyxZ87Twi_2Fn1PHKp/03jApGbg_2BRhYkWe9k/esP6O8hbXHW6ZPgXl_2BSj/eoO9reGwFG5Nl/0Bl4MK9Y/Jd_2BNDeICtWFs2iHFgpCDs/67mGV1rAHa/zuH8BB7FghT4J2TNj/R4rOjkgHMzJa/gbTEXT5RJwF/2fmttnND48mMIW/wti0svI2LCBV161F0fEVF/14N3kRMB1SGN44Nm/X7RDPysDrd8saSl/jYZkFcj_2BzrVuVXSM/6kM52Gg2R/Qs_2FpbLz0jSKD_2Bh_0/A_0Decb6GJ_2BMAJGne/vVWWOh9xt4K0tz2TppftCo/JsWCPltqz/XLm" }, "src_ip": "10.18.20.97", "dst_port": 80, "event_id": "evt-a264e0f7a3437fc74a6b550a", "src_port": 49602, "tcp_stream": 430, "udp_stream": null, "body_sha256": "78f53c3a83a6e9d23f3903efc3a5635ea95fd21264ada13ebb8af23eb761fa40", "frame_number": 16202, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 433, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 433, "timestamp_epoch": "1575413468.944358000" }, { "kind": "http_request", "dst_ip": "8.208.24.139", "fields": { "http.host": "h1.wensa.at", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0", "http.request.uri": "/api1/Gwbw8tnew726Q/M9Skme3k/6AO19COaR1FoGUdhMsA4GKW/nGqco_2FRl/teGegEqJuVxOOJNjV/oZpTXdjy_2Bp/KEZa3DJBBka/I2gHb_2Bq8hRT4/_2FU7850yaD3XLl9pVrNr/89FBtPrqmkgqnOZV/PXktvK2crzgUudm/BPzuMDS8CVqNScB5ZQ/00ONmphj_/2FdZVyZcJs6fKopUr5Oe/CSefjjsmyKqDX1Ds8p1/KqNJ8ceLBLWrM0Po9Oc5ml/RarNO5_2BgMVz/Ull_0A_0/DZaejK2BA6dxD9vL3jkOsM9/vTC_2F84Pt/COJihOMT_2Fj/raR9XNN", "http.response_in": "16217", "http.content_length": "433", "http.request.method": "POST", "http.request.full_uri": "http://h1.wensa.at/api1/Gwbw8tnew726Q/M9Skme3k/6AO19COaR1FoGUdhMsA4GKW/nGqco_2FRl/teGegEqJuVxOOJNjV/oZpTXdjy_2Bp/KEZa3DJBBka/I2gHb_2Bq8hRT4/_2FU7850yaD3XLl9pVrNr/89FBtPrqmkgqnOZV/PXktvK2crzgUudm/BPzuMDS8CVqNScB5ZQ/00ONmphj_/2FdZVyZcJs6fKopUr5Oe/CSefjjsmyKqDX1Ds8p1/KqNJ8ceLBLWrM0Po9Oc5ml/RarNO5_2BgMVz/Ull_0A_0/DZaejK2BA6dxD9vL3jkOsM9/vTC_2F84Pt/COJihOMT_2Fj/raR9XNN" }, "src_ip": "10.18.20.97", "dst_port": 80, "event_id": "evt-282f8faa304d890e7e9c5dc1", "src_port": 49603, "tcp_stream": 431, "udp_stream": null, "body_sha256": "a08902c478721cb65ddbb075d5dea373db29f80c15d67cdb23f25ebfb6284fc7", "frame_number": 16215, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 433, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 433, "timestamp_epoch": "1575413469.987340000" }, { "kind": "http_request", "dst_ip": "8.208.24.139", "fields": { "http.host": "h1.wensa.at", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0", "http.request.uri": "/api1/hK7XkhVzoQriE0IxUMIa/1O_2BExsgz_2B4Zrthx/W5oi4sXavmJrJ9O9ZQLiPT/S8QFsqJE4sBmf/34lfHb1q/xuA6Q_2FUiM8Xysq1l2iGRB/xgXJph0O3I/GcewoFxd7uN_2BN_2/BH49MRgd_2Ba/fVlVyXE9he8/2q6kX1ls6vfx6p/QX_2FVWJj2W9fBbvgUrOF/bu5C9f_2F3aoPyMf/JYzTSWA0WG2WuW_/2Br4YaeG1faOQcxd0y/ygfOlk3GY/8vuCdPg8IQd_2B6RPUbY/0XEF_0A_0DKpaKUxoL5/qPjhVWhEzP_2FYH6lBq0L8/FoLLMkTwGyXhD/uKVOKORn/3_2Fucd9qVC/XqMxEWSL/V", "http.response_in": "16317", "http.content_length": "54", "http.request.method": "POST", "http.request.full_uri": "http://h1.wensa.at/api1/hK7XkhVzoQriE0IxUMIa/1O_2BExsgz_2B4Zrthx/W5oi4sXavmJrJ9O9ZQLiPT/S8QFsqJE4sBmf/34lfHb1q/xuA6Q_2FUiM8Xysq1l2iGRB/xgXJph0O3I/GcewoFxd7uN_2BN_2/BH49MRgd_2Ba/fVlVyXE9he8/2q6kX1ls6vfx6p/QX_2FVWJj2W9fBbvgUrOF/bu5C9f_2F3aoPyMf/JYzTSWA0WG2WuW_/2Br4YaeG1faOQcxd0y/ygfOlk3GY/8vuCdPg8IQd_2B6RPUbY/0XEF_0A_0DKpaKUxoL5/qPjhVWhEzP_2FYH6lBq0L8/FoLLMkTwGyXhD/uKVOKORn/3_2Fucd9qVC/XqMxEWSL/V" }, "src_ip": "10.18.20.97", "dst_port": 80, "event_id": "evt-47d65d239d9a71f07c956fd3", "src_port": 49606, "tcp_stream": 434, "udp_stream": null, "body_sha256": "52307c67a1d0d310baf70fb8c346eb51856b73c08f9cf67535720b900023ee5e", "frame_number": 16315, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 54, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 54, "timestamp_epoch": "1575413756.495982000" }, { "kind": "http_request", "dst_ip": "8.208.24.139", "fields": { "http.host": "h1.wensa.at", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0", "http.request.uri": "/api1/g_2Bx7tr9ZryzLouz/05_2FX84jbMj/yEgR5F11nXe/H5Q4RcMk_2FuwO/mHq2BQhJfdTL6FfQ5xauF/u3qTIj03n_2B6nCV/KDSsMyOE_2BTXhg/zxiQKteEk_2BtBzEfx/rnKqQyEpw/YTk34JFznNpQ2vXp7rlN/QFKcIBfT62Iy9KIGk6c/fu_2BuRsq5ahizZjA_2B09/ZtAtAlqztqIMv/z2icag6K/oe3n4nqKEufBvSpu_2BCr9K/xKyx8CbjTI/_2Bhj19DXUF0GS_2B/nXsuBYTFS_0A/_0DLPacLo8b/rzI_2BK0OE9TEL/FflWTWADAHUkyB4qUf8r4/9WN9Wa", "http.response_in": "16438", "http.request.method": "GET", "http.request.full_uri": "http://h1.wensa.at/api1/g_2Bx7tr9ZryzLouz/05_2FX84jbMj/yEgR5F11nXe/H5Q4RcMk_2FuwO/mHq2BQhJfdTL6FfQ5xauF/u3qTIj03n_2B6nCV/KDSsMyOE_2BTXhg/zxiQKteEk_2BtBzEfx/rnKqQyEpw/YTk34JFznNpQ2vXp7rlN/QFKcIBfT62Iy9KIGk6c/fu_2BuRsq5ahizZjA_2B09/ZtAtAlqztqIMv/z2icag6K/oe3n4nqKEufBvSpu_2BCr9K/xKyx8CbjTI/_2Bhj19DXUF0GS_2B/nXsuBYTFS_0A/_0DLPacLo8b/rzI_2BK0OE9TEL/FflWTWADAHUkyB4qUf8r4/9WN9Wa" }, "src_ip": "10.18.20.97", "dst_port": 80, "event_id": "evt-dca19d31bca2da5275d92640", "src_port": 49611, "tcp_stream": 439, "udp_stream": null, "frame_number": 16436, "timestamp_epoch": "1575414056.522987000" }, { "kind": "http_request", "dst_ip": "8.208.24.139", "fields": { "http.host": "h1.wensa.at", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0", "http.request.uri": "/api1/0H5UepzG6l8VMC2Pmj/sEZknMRGq/cYV1WzhM9pu8ZeXH_2FY/oc3TLTu7RSq8d2PoCnQ/WIHBDOGJ2GjfbSowy7j5_2/B0EOfL_2FpbXE/rJfdKuzL/_2BbCSo6csLXLP5vO8R_2B3/TMvCcGFAgV/Th0Hwc6reCySrBkAd/zlQ4OLgNqPb5/5W5WAQ0SxwW/yInFoimw547dUm/IVywwkc_2Bkxi4Udvkm3V/9UMNcvy_2B5tDJ4t/_2BE7_2BHXb_2FQ/BIG44mS62Qdr1DeRku/CSQbSS_0A/_0DsSVK_2Fymf4t8ngQi/oa2u69rQ2Fjk5_2BI7m/oQFncyREXFVbCQDDNqU92w/hsPYdmJIpMMIr/_2B", "http.response_in": "16451", "http.content_length": "2", "http.request.method": "POST", "http.request.full_uri": "http://h1.wensa.at/api1/0H5UepzG6l8VMC2Pmj/sEZknMRGq/cYV1WzhM9pu8ZeXH_2FY/oc3TLTu7RSq8d2PoCnQ/WIHBDOGJ2GjfbSowy7j5_2/B0EOfL_2FpbXE/rJfdKuzL/_2BbCSo6csLXLP5vO8R_2B3/TMvCcGFAgV/Th0Hwc6reCySrBkAd/zlQ4OLgNqPb5/5W5WAQ0SxwW/yInFoimw547dUm/IVywwkc_2Bkxi4Udvkm3V/9UMNcvy_2B5tDJ4t/_2BE7_2BHXb_2FQ/BIG44mS62Qdr1DeRku/CSQbSS_0A/_0DsSVK_2Fymf4t8ngQi/oa2u69rQ2Fjk5_2BI7m/oQFncyREXFVbCQDDNqU92w/hsPYdmJIpMMIr/_2B" }, "src_ip": "10.18.20.97", "dst_port": 80, "event_id": "evt-62b4d70fd31bf5fa5801def2", "src_port": 49612, "tcp_stream": 440, "udp_stream": null, "body_sha256": "7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6", "frame_number": 16449, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 2, "timestamp_epoch": "1575414057.593994000" }, { "kind": "http_request", "dst_ip": "8.208.24.139", "fields": { "http.host": "h1.wensa.at", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0", "http.request.uri": "/api1/rdEreIZkL4/wPcSNXzrRsehTfcyh/tMgQb3qP5lKV/3G4sKnE3XbK/elnGU0srM6zogs/s_2FESzfMOTYDC5_2FR44/j6_2Fv7HHm0FcoBK/_2FRt9xIa946PwM/7hRJM1qbSsws9VeljG/1J6wSRUaT/gmjRcK2wygucnEodYqLC/FbjG139p5ZDb5pyAufv/nJXkZEoWxFZH_2FooxgojE/tFU5IyJR00Riy/bazsDgly/BetpqgAXMYifOBIEdhrITDi/m2GTytY3XJ/JO4r_0A_0DsEyLom2/0DBGVv7B7iWo/qEglwzPAxGf/CnptaQBsxDNM3l/DWphGJyhAADQy1hbrnY_2/Faz2p", "http.response_in": "16495", "http.content_length": "2", "http.request.method": "POST", "http.request.full_uri": "http://h1.wensa.at/api1/rdEreIZkL4/wPcSNXzrRsehTfcyh/tMgQb3qP5lKV/3G4sKnE3XbK/elnGU0srM6zogs/s_2FESzfMOTYDC5_2FR44/j6_2Fv7HHm0FcoBK/_2FRt9xIa946PwM/7hRJM1qbSsws9VeljG/1J6wSRUaT/gmjRcK2wygucnEodYqLC/FbjG139p5ZDb5pyAufv/nJXkZEoWxFZH_2FooxgojE/tFU5IyJR00Riy/bazsDgly/BetpqgAXMYifOBIEdhrITDi/m2GTytY3XJ/JO4r_0A_0DsEyLom2/0DBGVv7B7iWo/qEglwzPAxGf/CnptaQBsxDNM3l/DWphGJyhAADQy1hbrnY_2/Faz2p" }, "src_ip": "10.18.20.97", "dst_port": 80, "event_id": "evt-834c4b9b6214248e30b4cdb4", "src_port": 49614, "tcp_stream": 442, "udp_stream": null, "body_sha256": "7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6", "frame_number": 16493, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 2, "timestamp_epoch": "1575414357.589472000" }, { "kind": "http_request", "dst_ip": "204.79.197.200", "fields": { "http.host": "www.bing.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/favicon.ico", "http.response_in": "17332", "http.request.method": "GET", "http.request.full_uri": "http://www.bing.com/favicon.ico" }, "src_ip": "10.18.20.97", "dst_port": 80, "event_id": "evt-37ff2a65fbe1c610b296c512", "src_port": 49621, "tcp_stream": 449, "udp_stream": null, "frame_number": 17330, "timestamp_epoch": "1575414488.801335000" }, { "kind": "http_request", "dst_ip": "8.208.24.139", "fields": { "http.host": "h1.wensa.at", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0", "http.request.uri": "/api1/hT5dOTbjmf2_2B4L0/1eaFf9lf3m_2/BEod_2FgUv1/bH2oww4ozdpST4/0acg3vqY7b7zbofHJ41fp/TCAo62pQ7IZa7G0M/iUe40TTaNAP_2BX/JAxRkvtqotcpimE8G2/_2BYg04t6/PW5wbGs_2F6zmB6DwT8h/4VDZ24p2WrGNrXRSmt3/KNVKNdr649JOjV0obrOZBq/g7R1FUFGlzI1u/2d_2BXpZ/0fFT4vAb57Og_2BcIwwM2S8/coL2_2BCyP/KeoRT2yn7nueL4fti/ZhMFL_0A_0DI/A_2FkWnMUpu/XWsMQEDNYGA6pd/N1mzHAcnvEFjdim2rLpxQ/LBIJYMSjpX_2FZT_/2F5V0kBIIM/A", "http.response_in": "21105", "http.request.method": "GET", "http.request.full_uri": "http://h1.wensa.at/api1/hT5dOTbjmf2_2B4L0/1eaFf9lf3m_2/BEod_2FgUv1/bH2oww4ozdpST4/0acg3vqY7b7zbofHJ41fp/TCAo62pQ7IZa7G0M/iUe40TTaNAP_2BX/JAxRkvtqotcpimE8G2/_2BYg04t6/PW5wbGs_2F6zmB6DwT8h/4VDZ24p2WrGNrXRSmt3/KNVKNdr649JOjV0obrOZBq/g7R1FUFGlzI1u/2d_2BXpZ/0fFT4vAb57Og_2BcIwwM2S8/coL2_2BCyP/KeoRT2yn7nueL4fti/ZhMFL_0A_0DI/A_2FkWnMUpu/XWsMQEDNYGA6pd/N1mzHAcnvEFjdim2rLpxQ/LBIJYMSjpX_2FZT_/2F5V0kBIIM/A" }, "src_ip": "10.18.20.97", "dst_port": 80, "event_id": "evt-68b15d54da60f96849859981", "src_port": 49659, "tcp_stream": 487, "udp_stream": null, "frame_number": 21103, "timestamp_epoch": "1575414657.626613000" }, { "kind": "http_request", "dst_ip": "8.208.24.139", "fields": { "http.host": "h1.wensa.at", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0", "http.request.uri": "/api1/WFavOHRQEMt1/znzQ6SK8Cgb/wxvOQ24UVpaQ7R/5E5zFgFb9RQEgPSly9itM/m_2ByKEgt9nvbpq5/rldfZ8lX1njJaA_/2FG7PamZ5_2FEsPiSc/AQx3zcvaB/qWSse9dj40jJCiIERQZn/nJ_2B7CfYvnMHI6bUv5/MZUbbZtoX0enD_2F3KhrS6/cy8A3KCQ9r1hu/Jh0amkRo/081_2FiOyZxp6B7n5bVAptk/IFzCpwyO5t/bkXCXwooW_2Bw550c/aOreQQMfX4Gl/BT7itc_0A_0/DjFoQkz2N1oAiX/qjaaLL_2BSO3VvsqA_2Bp/sT9LOZEV9wlPj7Bt/THj2ittoB/7CHZWVbOOz5/wV", "http.response_in": "21118", "http.content_length": "2", "http.request.method": "POST", "http.request.full_uri": "http://h1.wensa.at/api1/WFavOHRQEMt1/znzQ6SK8Cgb/wxvOQ24UVpaQ7R/5E5zFgFb9RQEgPSly9itM/m_2ByKEgt9nvbpq5/rldfZ8lX1njJaA_/2FG7PamZ5_2FEsPiSc/AQx3zcvaB/qWSse9dj40jJCiIERQZn/nJ_2B7CfYvnMHI6bUv5/MZUbbZtoX0enD_2F3KhrS6/cy8A3KCQ9r1hu/Jh0amkRo/081_2FiOyZxp6B7n5bVAptk/IFzCpwyO5t/bkXCXwooW_2Bw550c/aOreQQMfX4Gl/BT7itc_0A_0/DjFoQkz2N1oAiX/qjaaLL_2BSO3VvsqA_2Bp/sT9LOZEV9wlPj7Bt/THj2ittoB/7CHZWVbOOz5/wV" }, "src_ip": "10.18.20.97", "dst_port": 80, "event_id": "evt-8520a0f89027a9c01f15d6b8", "src_port": 49660, "tcp_stream": 488, "udp_stream": null, "body_sha256": "7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6", "frame_number": 21116, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 2, "timestamp_epoch": "1575414658.671978000" }, { "kind": "http_request", "dst_ip": "8.208.24.139", "fields": { "http.host": "h1.wensa.at", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0", "http.request.uri": "/api1/IDTB2Kcam0xK2fxd/vTEcLqZOh5c9NYp/NXe6hyoZ9mNQTlY3Y5/bLIdZtExd/d31qAYZtsuTQ9gbIrUSe/PGrhB_2B9yjB9bXOF7t/r1hhLrPtfktOcSFkbu6Ekq/618iNFb5nCo6k/sfFUnlf_/2FoJgVQXG_2FHnDq4o5FjDN/BXT35nGCWe/nyYlM4u5QciWlXTKn/Wm1_2FQtCZd6/aM_2FytaGFR/hYFsI2a6Zr8k4Q/_2BnAwEvBubUGKUloxotM/SLymtM9HHfANmR9n/_0A_0DC9isxkOv5/2K4_2BjxTOT0rBI_2B/_2FLRSSAS/8Qwfk0N2nq8/beBzLG", "http.response_in": "21161", "http.content_length": "23137", "http.request.method": "POST", "http.request.full_uri": "http://h1.wensa.at/api1/IDTB2Kcam0xK2fxd/vTEcLqZOh5c9NYp/NXe6hyoZ9mNQTlY3Y5/bLIdZtExd/d31qAYZtsuTQ9gbIrUSe/PGrhB_2B9yjB9bXOF7t/r1hhLrPtfktOcSFkbu6Ekq/618iNFb5nCo6k/sfFUnlf_/2FoJgVQXG_2FHnDq4o5FjDN/BXT35nGCWe/nyYlM4u5QciWlXTKn/Wm1_2FQtCZd6/aM_2FytaGFR/hYFsI2a6Zr8k4Q/_2BnAwEvBubUGKUloxotM/SLymtM9HHfANmR9n/_0A_0DC9isxkOv5/2K4_2BjxTOT0rBI_2B/_2FLRSSAS/8Qwfk0N2nq8/beBzLG" }, "src_ip": "10.18.20.97", "dst_port": 80, "event_id": "evt-3a4360bf081d22d01c18fb8f", "src_port": 49661, "tcp_stream": 489, "udp_stream": null, "body_sha256": "8bbbecf9c7b14eab33a19f0ab1529dd595dbd2ba51ef0dab65201aef80ce18b6", "frame_number": 21158, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 23137, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 23137, "timestamp_epoch": "1575414669.952174000" } ], "http_response": [ { "kind": "http_response", "dst_ip": "10.18.20.97", "fields": { "http.request_in": "281", "http.content_type": "text/html", "http.response.code": "301", "http.content_length": "303" }, "src_ip": "69.147.64.34", "dst_port": 49203, "event_id": "evt-c32fd3ec4493aa19de651c03", "src_port": 80, "tcp_stream": 22, "udp_stream": null, "body_sha256": "c65cb1829bda38e033f2c42d891e2f0cf9cb5bf2352a74a05ffc27049a98cb56", "frame_number": 283, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 303, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 303, "timestamp_epoch": "1575413156.023372000" }, { "kind": "http_response", "dst_ip": "10.18.20.97", "fields": { "http.request_in": "10625", "http.content_type": "application/x-x509-ca-cert", "http.response.code": "200", "http.content_length": "1403" }, "src_ip": "91.199.212.52", "dst_port": 49434, "event_id": "evt-edef11a0152fe59ff78e5fbc", "src_port": 80, "tcp_stream": 254, "udp_stream": null, "body_sha256": "1a5174980a294a528a110726d5855650266c48d9883bea692b67b6d726da98c5", "frame_number": 10693, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1403, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 1403, "timestamp_epoch": "1575413267.344813000" }, { "kind": "http_response", "dst_ip": "10.18.20.97", "fields": { "http.request_in": "10629", "http.content_type": "application/x-x509-ca-cert", "http.response.code": "200", "http.content_length": "1403" }, "src_ip": "91.199.212.52", "dst_port": 49433, "event_id": "evt-ef0624ecc240054ee9bb4815", "src_port": 80, "tcp_stream": 253, "udp_stream": null, "body_sha256": "1a5174980a294a528a110726d5855650266c48d9883bea692b67b6d726da98c5", "frame_number": 10698, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1403, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 1403, "timestamp_epoch": "1575413267.351533000" }, { "kind": "http_response", "dst_ip": "10.18.20.97", "fields": { "http.request_in": "10681", "http.content_type": "application/x-x509-ca-cert", "http.response.code": "200", "http.content_length": "867" }, "src_ip": "198.70.69.154", "dst_port": 49436, "event_id": "evt-f62ee9b85745ecbad218042d", "src_port": 80, "tcp_stream": 256, "udp_stream": null, "body_sha256": "cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b", "frame_number": 10735, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 867, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 867, "timestamp_epoch": "1575413267.555745000" }, { "kind": "http_response", "dst_ip": "10.18.20.97", "fields": { "http.request_in": "10684", "http.content_type": "application/x-x509-ca-cert", "http.response.code": "200", "http.content_length": "867" }, "src_ip": "198.70.69.154", "dst_port": 49437, "event_id": "evt-7cc998ae2032cc1319c75646", "src_port": 80, "tcp_stream": 257, "udp_stream": null, "body_sha256": "cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b", "frame_number": 10737, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 867, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 867, "timestamp_epoch": "1575413267.556050000" }, { "kind": "http_response", "dst_ip": "10.18.20.97", "fields": { "http.request_in": "10744", "http.content_type": "application/x-x509-ca-cert", "http.response.code": "200", "http.content_length": "867" }, "src_ip": "198.70.69.154", "dst_port": 49436, "event_id": "evt-b752c998217d3f81ed52d6f5", "src_port": 80, "tcp_stream": 256, "udp_stream": null, "body_sha256": "cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b", "frame_number": 10807, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 867, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 867, "timestamp_epoch": "1575413267.730057000" }, { "kind": "http_response", "dst_ip": "10.18.20.97", "fields": { "http.request_in": "10746", "http.content_type": "application/x-x509-ca-cert", "http.response.code": "200", "http.content_length": "867" }, "src_ip": "198.70.69.154", "dst_port": 49437, "event_id": "evt-6595a7da762c2aba9f0e88b7", "src_port": 80, "tcp_stream": 257, "udp_stream": null, "body_sha256": "cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b", "frame_number": 10808, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 867, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 867, "timestamp_epoch": "1575413267.740194000" }, { "kind": "http_response", "dst_ip": "10.18.20.97", "fields": { "http.request_in": "12951", "http.response.code": "302", "http.content_length": "0" }, "src_ip": "104.69.23.209", "dst_port": 49509, "event_id": "evt-92305dc8127c6ee8292e12a2", "src_port": 80, "tcp_stream": 329, "udp_stream": null, "frame_number": 12995, "timestamp_epoch": "1575413305.906819000" }, { "kind": "http_response", "dst_ip": "10.18.20.97", "fields": { "http.request_in": "15288", "http.content_type": "text/html; charset=UTF-8", "http.response.code": "200", "http.content_encoding": "gzip", "http.transfer_encoding": "chunked" }, "src_ip": "8.208.24.139", "dst_port": 49593, "event_id": "evt-4e03a9f96c09cc969c8c47e5", "src_port": 80, "tcp_stream": 420, "udp_stream": null, "body_sha256": "cf63a226cdfefcc50f0ebd036df2729d1a6493cac1a5b814eec81ce4eed0f948", "frame_number": 15565, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 260872, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 260872, "timestamp_epoch": "1575413427.756012000" }, { "kind": "http_response", "dst_ip": "10.18.20.97", "fields": { "http.request_in": "15569", "http.content_type": "text/html", "http.response.code": "503" }, "src_ip": "8.208.24.139", "dst_port": 49592, "event_id": "evt-7592fc0be959b359eba30614", "src_port": 80, "tcp_stream": 421, "udp_stream": null, "body_sha256": "839488ebc08446a096a893996ed23eac321ac166724cd8c5d9092057834d2d79", "frame_number": 15571, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 107, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 107, "timestamp_epoch": "1575413427.952035000" }, { "kind": "http_response", "dst_ip": "10.18.20.97", "fields": { "http.request_in": "15581", "http.content_type": "text/html; charset=UTF-8", "http.response.code": "200", "http.content_encoding": "gzip", "http.transfer_encoding": "chunked" }, "src_ip": "8.208.24.139", "dst_port": 49595, "event_id": "evt-654377d0f0960d94016f80f1", "src_port": 80, "tcp_stream": 422, "udp_stream": null, "body_sha256": "0b504e7f3cec848c7a1c25720cc40e7fd6919e217b4f56e50f645bda49259a39", "frame_number": 15940, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 327092, "timestamp_epoch": "1575413432.819653000" }, { "kind": "http_response", "dst_ip": "10.18.20.97", "fields": { "http.request_in": "15944", "http.content_type": "text/html", "http.response.code": "503" }, "src_ip": "8.208.24.139", "dst_port": 49594, "event_id": "evt-e95aef56c499b61e8370b143", "src_port": 80, "tcp_stream": 423, "udp_stream": null, "body_sha256": "839488ebc08446a096a893996ed23eac321ac166724cd8c5d9092057834d2d79", "frame_number": 15946, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 107, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 107, "timestamp_epoch": "1575413433.027454000" }, { "kind": "http_response", "dst_ip": "10.18.20.97", "fields": { "http.request_in": "15956", "http.content_type": "text/html; charset=UTF-8", "http.response.code": "200", "http.content_encoding": "gzip", "http.transfer_encoding": "chunked" }, "src_ip": "8.208.24.139", "dst_port": 49596, "event_id": "evt-144f27a9a3bb9475612f37ab", "src_port": 80, "tcp_stream": 424, "udp_stream": null, "body_sha256": "a2f75fb154555d2877b0648f52b549a947b9c82bcff786d7c81ba712e9c3f3f8", "frame_number": 15961, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2416, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 2416, "timestamp_epoch": "1575413435.074577000" }, { "kind": "http_response", "dst_ip": "10.18.20.97", "fields": { "http.request_in": "15971", "http.content_type": "application/octet-stream", "http.response.code": "200", "http.content_length": "138820" }, "src_ip": "8.208.24.139", "dst_port": 49598, "event_id": "evt-fccf53e41b0e069424d8d1bf", "src_port": 80, "tcp_stream": 426, "udp_stream": null, "body_sha256": "1f0bad278e2bf2f41979f2144a94cb85ac19d93abd041230b236463a992d9190", "frame_number": 16124, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 138820, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 138820, "timestamp_epoch": "1575413441.877000000" }, { "kind": "http_response", "dst_ip": "10.18.20.97", "fields": { "http.request_in": "16153", "http.content_type": "text/html; charset=UTF-8", "http.response.code": "200", "http.transfer_encoding": "chunked" }, "src_ip": "8.208.24.139", "dst_port": 49599, "event_id": "evt-73ea9771416103e3f18740a0", "src_port": 80, "tcp_stream": 427, "udp_stream": null, "frame_number": 16155, "timestamp_epoch": "1575413456.138842000" }, { "kind": "http_response", "dst_ip": "10.18.20.97", "fields": { "http.request_in": "16166", "http.content_type": "text/html; charset=UTF-8", "http.response.code": "200", "http.transfer_encoding": "chunked" }, "src_ip": "8.208.24.139", "dst_port": 49600, "event_id": "evt-56bb411ba3f17c65029973a8", "src_port": 80, "tcp_stream": 428, "udp_stream": null, "body_sha256": "6c0c18274fed35e973d1c060f2f4137bb91444a78fbafd3be6c5f6d2f3cc63b8", "frame_number": 16174, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 33, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 33, "timestamp_epoch": "1575413457.346663000" }, { "kind": "http_response", "dst_ip": "10.18.20.97", "fields": { "http.request_in": "16185", "http.content_type": "text/html; charset=UTF-8", "http.response.code": "200", "http.transfer_encoding": "chunked" }, "src_ip": "8.208.24.139", "dst_port": 49601, "event_id": "evt-4c707c5ba7eb975530ab9d1f", "src_port": 80, "tcp_stream": 429, "udp_stream": null, "frame_number": 16187, "timestamp_epoch": "1575413458.487919000" }, { "kind": "http_response", "dst_ip": "10.18.20.97", "fields": { "http.content_type": "text/html", "http.response.code": "408" }, "src_ip": "8.208.24.139", "dst_port": 49597, "event_id": "evt-812b13b3fac95461ab600b61", "src_port": 80, "tcp_stream": 425, "udp_stream": null, "body_sha256": "5b80b1566219a6c3321b14127ebae23f73a18fd50a0751d2179e42d461e9ad39", "frame_number": 16193, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 110, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 110, "timestamp_epoch": "1575413464.671303000" }, { "kind": "http_response", "dst_ip": "10.18.20.97", "fields": { "http.request_in": "16202", "http.content_type": "text/html; charset=UTF-8", "http.response.code": "200", "http.transfer_encoding": "chunked" }, "src_ip": "8.208.24.139", "dst_port": 49602, "event_id": "evt-f353153d1c9949654408e49a", "src_port": 80, "tcp_stream": 430, "udp_stream": null, "frame_number": 16204, "timestamp_epoch": "1575413469.614360000" }, { "kind": "http_response", "dst_ip": "10.18.20.97", "fields": { "http.request_in": "16215", "http.content_type": "text/html; charset=UTF-8", "http.response.code": "200", "http.transfer_encoding": "chunked" }, "src_ip": "8.208.24.139", "dst_port": 49603, "event_id": "evt-a1353edcd2c8874f69a7fd8b", "src_port": 80, "tcp_stream": 431, "udp_stream": null, "frame_number": 16217, "timestamp_epoch": "1575413470.632872000" }, { "kind": "http_response", "dst_ip": "10.18.20.97", "fields": { "http.request_in": "16315", "http.content_type": "text/html; charset=UTF-8", "http.response.code": "200", "http.transfer_encoding": "chunked" }, "src_ip": "8.208.24.139", "dst_port": 49606, "event_id": "evt-4933946f71f90f233db9694f", "src_port": 80, "tcp_stream": 434, "udp_stream": null, "frame_number": 16317, "timestamp_epoch": "1575413757.171748000" }, { "kind": "http_response", "dst_ip": "10.18.20.97", "fields": { "http.request_in": "16436", "http.content_type": "text/html; charset=UTF-8", "http.response.code": "200", "http.transfer_encoding": "chunked" }, "src_ip": "8.208.24.139", "dst_port": 49611, "event_id": "evt-aabd4fee705cebeae3eb1fa8", "src_port": 80, "tcp_stream": 439, "udp_stream": null, "frame_number": 16438, "timestamp_epoch": "1575414057.217935000" }, { "kind": "http_response", "dst_ip": "10.18.20.97", "fields": { "http.request_in": "16449", "http.content_type": "text/html; charset=UTF-8", "http.response.code": "200", "http.transfer_encoding": "chunked" }, "src_ip": "8.208.24.139", "dst_port": 49612, "event_id": "evt-7062702cc6c480e34a2d17c4", "src_port": 80, "tcp_stream": 440, "udp_stream": null, "frame_number": 16451, "timestamp_epoch": "1575414058.241437000" }, { "kind": "http_response", "dst_ip": "10.18.20.97", "fields": { "http.request_in": "16493", "http.content_type": "text/html; charset=UTF-8", "http.response.code": "200", "http.transfer_encoding": "chunked" }, "src_ip": "8.208.24.139", "dst_port": 49614, "event_id": "evt-9b4e9ae3456ad38402c1d94b", "src_port": 80, "tcp_stream": 442, "udp_stream": null, "frame_number": 16495, "timestamp_epoch": "1575414358.277411000" }, { "kind": "http_response", "dst_ip": "10.18.20.97", "fields": { "http.request_in": "17330", "http.content_type": "image/x-icon", "http.response.code": "200", "http.content_length": "237" }, "src_ip": "204.79.197.200", "dst_port": 49621, "event_id": "evt-aa88b1d185171c859a71be9d", "src_port": 80, "tcp_stream": 449, "udp_stream": null, "body_sha256": "6d8a01dc7647bc218d003b58fe04049e24a9359900b7e0cebae76edf85b8b914", "frame_number": 17332, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 237, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 237, "timestamp_epoch": "1575414488.914065000" }, { "kind": "http_response", "dst_ip": "10.18.20.97", "fields": { "http.request_in": "21103", "http.content_type": "text/html; charset=UTF-8", "http.response.code": "200", "http.transfer_encoding": "chunked" }, "src_ip": "8.208.24.139", "dst_port": 49659, "event_id": "evt-632e9ec33d92496e88984b67", "src_port": 80, "tcp_stream": 487, "udp_stream": null, "frame_number": 21105, "timestamp_epoch": "1575414658.307980000" }, { "kind": "http_response", "dst_ip": "10.18.20.97", "fields": { "http.request_in": "21116", "http.content_type": "text/html; charset=UTF-8", "http.response.code": "200", "http.transfer_encoding": "chunked" }, "src_ip": "8.208.24.139", "dst_port": 49660, "event_id": "evt-b222aebe2baeb26f1f06d286", "src_port": 80, "tcp_stream": 488, "udp_stream": null, "frame_number": 21118, "timestamp_epoch": "1575414659.434232000" }, { "kind": "http_response", "dst_ip": "10.18.20.97", "fields": { "http.request_in": "21158", "http.content_type": "text/html; charset=UTF-8", "http.response.code": "200", "http.transfer_encoding": "chunked" }, "src_ip": "8.208.24.139", "dst_port": 49661, "event_id": "evt-84d87776df5994aacf6e9fcb", "src_port": 80, "tcp_stream": 489, "udp_stream": null, "frame_number": 21161, "timestamp_epoch": "1575414671.927931000" } ], "tls_client_hello": [ { "kind": "tls_client_hello", "dst_ip": "69.147.64.34", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "mail.aol.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-6b7f8e20ff85280d7c0805ea", "src_port": 49204, "tcp_stream": 23, "udp_stream": null, "frame_number": 288, "timestamp_epoch": "1575413156.177305000" }, { "kind": "tls_client_hello", "dst_ip": "67.195.204.151", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "oidc.mail.aol.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-a49a733e06ddd3d964ac3562", "src_port": 49205, "tcp_stream": 24, "udp_stream": null, "frame_number": 313, "timestamp_epoch": "1575413156.844944000" }, { "kind": "tls_client_hello", "dst_ip": "67.195.204.151", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "oidc.mail.aol.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-f3c9dc6f8c71912eae77e946", "src_port": 49206, "tcp_stream": 25, "udp_stream": null, "frame_number": 317, "timestamp_epoch": "1575413156.862203000" }, { "kind": "tls_client_hello", "dst_ip": "98.137.156.136", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "api.login.aol.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-d230ddf5ea8078cff3d6beb2", "src_port": 49207, "tcp_stream": 26, "udp_stream": null, "frame_number": 358, "timestamp_epoch": "1575413157.370538000" }, { "kind": "tls_client_hello", "dst_ip": "98.137.156.136", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "api.login.aol.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-24bdb73c427e8a169d3f7108", "src_port": 49208, "tcp_stream": 27, "udp_stream": null, "frame_number": 362, "timestamp_epoch": "1575413157.375597000" }, { "kind": "tls_client_hello", "dst_ip": "67.195.204.151", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "login.aol.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-a6574c4a1c03b970f919ede6", "src_port": 49210, "tcp_stream": 28, "udp_stream": null, "frame_number": 406, "timestamp_epoch": "1575413157.957301000" }, { "kind": "tls_client_hello", "dst_ip": "67.195.204.151", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "login.aol.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-07ea6eec8edb27747e121470", "src_port": 49209, "tcp_stream": 29, "udp_stream": null, "frame_number": 408, "timestamp_epoch": "1575413157.957372000" }, { "kind": "tls_client_hello", "dst_ip": "69.147.64.34", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "s.yimg.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-58dd30bc936c2badb7de723e", "src_port": 49211, "tcp_stream": 31, "udp_stream": null, "frame_number": 524, "timestamp_epoch": "1575413159.150193000" }, { "kind": "tls_client_hello", "dst_ip": "69.147.64.34", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "s.yimg.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-52b1bfd6ac996133bd586ddb", "src_port": 49212, "tcp_stream": 32, "udp_stream": null, "frame_number": 526, "timestamp_epoch": "1575413159.150917000" }, { "kind": "tls_client_hello", "dst_ip": "69.147.64.34", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "s.yimg.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-63a3ef73f0f81aa407cbff66", "src_port": 49213, "tcp_stream": 33, "udp_stream": null, "frame_number": 535, "timestamp_epoch": "1575413159.388361000" }, { "kind": "tls_client_hello", "dst_ip": "66.218.84.42", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "udc.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-1264740c6385bc3e97d2ecf3", "src_port": 49214, "tcp_stream": 34, "udp_stream": null, "frame_number": 658, "timestamp_epoch": "1575413160.625245000" }, { "kind": "tls_client_hello", "dst_ip": "69.147.64.34", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "fc.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-00c1a0b6ac5e31810a5d2398", "src_port": 49217, "tcp_stream": 37, "udp_stream": null, "frame_number": 662, "timestamp_epoch": "1575413160.952787000" }, { "kind": "tls_client_hello", "dst_ip": "69.147.64.34", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "fc.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-065f94c14aff1d4a1bc552b2", "src_port": 49215, "tcp_stream": 35, "udp_stream": null, "frame_number": 675, "timestamp_epoch": "1575413160.953563000" }, { "kind": "tls_client_hello", "dst_ip": "98.137.156.137", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "geo.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-03e07521fab4ecb93032e108", "src_port": 49216, "tcp_stream": 36, "udp_stream": null, "frame_number": 678, "timestamp_epoch": "1575413160.953856000" }, { "kind": "tls_client_hello", "dst_ip": "98.137.156.137", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "geo.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-3444cb3ff6045087aae491a2", "src_port": 49218, "tcp_stream": 38, "udp_stream": null, "frame_number": 680, "timestamp_epoch": "1575413160.953961000" }, { "kind": "tls_client_hello", "dst_ip": "152.195.32.163", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tag.sp.advertising.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-f4aa114b4e484d166d6afb70", "src_port": 49219, "tcp_stream": 39, "udp_stream": null, "frame_number": 958, "timestamp_epoch": "1575413162.970253000" }, { "kind": "tls_client_hello", "dst_ip": "152.199.24.48", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "opus.analytics.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-34dd048b9ae893a3dd84c379", "src_port": 49222, "tcp_stream": 42, "udp_stream": null, "frame_number": 962, "timestamp_epoch": "1575413162.990597000" }, { "kind": "tls_client_hello", "dst_ip": "152.195.32.163", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tag.sp.advertising.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-9f23401883173203f5731137", "src_port": 49221, "tcp_stream": 41, "udp_stream": null, "frame_number": 970, "timestamp_epoch": "1575413162.992961000" }, { "kind": "tls_client_hello", "dst_ip": "152.199.24.48", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "opus.analytics.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-e66fab6502cb2be2048ad24f", "src_port": 49220, "tcp_stream": 40, "udp_stream": null, "frame_number": 972, "timestamp_epoch": "1575413162.993109000" }, { "kind": "tls_client_hello", "dst_ip": "152.199.6.14", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "us.y.atwola.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-b4b216e8af329f1fe139de19", "src_port": 49223, "tcp_stream": 43, "udp_stream": null, "frame_number": 974, "timestamp_epoch": "1575413162.993239000" }, { "kind": "tls_client_hello", "dst_ip": "152.199.6.14", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "us.y.atwola.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-3960692abd9d7d2c7aed40ee", "src_port": 49224, "tcp_stream": 44, "udp_stream": null, "frame_number": 978, "timestamp_epoch": "1575413162.998330000" }, { "kind": "tls_client_hello", "dst_ip": "152.199.6.11", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "aka-cdn.adtechus.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-8c696f8e946b3f2bf854ec01", "src_port": 49227, "tcp_stream": 47, "udp_stream": null, "frame_number": 1081, "timestamp_epoch": "1575413163.327080000" }, { "kind": "tls_client_hello", "dst_ip": "152.199.6.11", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "aka-cdn.adtechus.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-5f3c8d8a493372eab2a3b6df", "src_port": 49228, "tcp_stream": 48, "udp_stream": null, "frame_number": 1083, "timestamp_epoch": "1575413163.327186000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.14.166", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ad.doubleclick.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-43937de467b21ff124d37b77", "src_port": 49226, "tcp_stream": 46, "udp_stream": null, "frame_number": 1088, "timestamp_epoch": "1575413163.327415000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.14.166", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ad.doubleclick.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-37f6d91fc96550505caee4aa", "src_port": 49225, "tcp_stream": 45, "udp_stream": null, "frame_number": 1101, "timestamp_epoch": "1575413163.331669000" }, { "kind": "tls_client_hello", "dst_ip": "152.195.14.41", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tag.idsync.analytics.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-039f9d2abf34c8091eafd3cc", "src_port": 49229, "tcp_stream": 49, "udp_stream": null, "frame_number": 1227, "timestamp_epoch": "1575413163.806683000" }, { "kind": "tls_client_hello", "dst_ip": "152.195.14.41", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tag.idsync.analytics.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-2d8ae4fbb4478fbc69e9b52f", "src_port": 49230, "tcp_stream": 50, "udp_stream": null, "frame_number": 1264, "timestamp_epoch": "1575413163.881841000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.12.38", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "s0.2mdn.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-e05eef4253cbbd542fbaeca4", "src_port": 49231, "tcp_stream": 51, "udp_stream": null, "frame_number": 2333, "timestamp_epoch": "1575413166.025194000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.12.38", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "s0.2mdn.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-2c636f540e42878c3ac1c696", "src_port": 49232, "tcp_stream": 52, "udp_stream": null, "frame_number": 2352, "timestamp_epoch": "1575413166.046867000" }, { "kind": "tls_client_hello", "dst_ip": "34.232.64.168", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "apx.moatads.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-9d6fc3ab9a95275b2d975c22", "src_port": 49233, "tcp_stream": 53, "udp_stream": null, "frame_number": 2447, "timestamp_epoch": "1575413166.362415000" }, { "kind": "tls_client_hello", "dst_ip": "34.232.64.168", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "apx.moatads.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-bf014be31b7dc5d7ba19afc2", "src_port": 49234, "tcp_stream": 54, "udp_stream": null, "frame_number": 2453, "timestamp_epoch": "1575413166.367591000" }, { "kind": "tls_client_hello", "dst_ip": "98.137.155.9", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cms.analytics.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-fa325128a6befd190cbde35b", "src_port": 49235, "tcp_stream": 55, "udp_stream": null, "frame_number": 2455, "timestamp_epoch": "1575413166.367879000" }, { "kind": "tls_client_hello", "dst_ip": "3.136.40.187", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "geo.moatads.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-394159b5f822833c78d7357f", "src_port": 49237, "tcp_stream": 57, "udp_stream": null, "frame_number": 2472, "timestamp_epoch": "1575413166.399229000" }, { "kind": "tls_client_hello", "dst_ip": "3.136.40.187", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "geo.moatads.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-cedeb425aaa5d0d978d3ef7e", "src_port": 49238, "tcp_stream": 58, "udp_stream": null, "frame_number": 2474, "timestamp_epoch": "1575413166.399383000" }, { "kind": "tls_client_hello", "dst_ip": "98.137.155.9", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cms.analytics.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-664ed6b10c4a26b238b22dc9", "src_port": 49240, "tcp_stream": 60, "udp_stream": null, "frame_number": 2480, "timestamp_epoch": "1575413166.410412000" }, { "kind": "tls_client_hello", "dst_ip": "98.137.155.9", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cms.analytics.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-ba2e693c3e9349c642d59861", "src_port": 49241, "tcp_stream": 61, "udp_stream": null, "frame_number": 2484, "timestamp_epoch": "1575413166.410679000" }, { "kind": "tls_client_hello", "dst_ip": "98.137.155.9", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cms.analytics.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-0d097d6245b87762085355f2", "src_port": 49236, "tcp_stream": 56, "udp_stream": null, "frame_number": 2488, "timestamp_epoch": "1575413166.411517000" }, { "kind": "tls_client_hello", "dst_ip": "98.137.155.9", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cms.analytics.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-1ce53e62dc25155ad8019e43", "src_port": 49239, "tcp_stream": 59, "udp_stream": null, "frame_number": 2492, "timestamp_epoch": "1575413166.413832000" }, { "kind": "tls_client_hello", "dst_ip": "3.220.227.225", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "service.idsync.analytics.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-448d4719a3116fb2929b5517", "src_port": 49242, "tcp_stream": 62, "udp_stream": null, "frame_number": 2615, "timestamp_epoch": "1575413166.956048000" }, { "kind": "tls_client_hello", "dst_ip": "3.220.227.225", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "service.idsync.analytics.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-eab30f2006be8dfb15ee2213", "src_port": 49243, "tcp_stream": 63, "udp_stream": null, "frame_number": 2621, "timestamp_epoch": "1575413166.958828000" }, { "kind": "tls_client_hello", "dst_ip": "156.154.202.36", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "aa.agkn.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-18e9327486115aeb7bc943af", "src_port": 49244, "tcp_stream": 64, "udp_stream": null, "frame_number": 2681, "timestamp_epoch": "1575413167.297012000" }, { "kind": "tls_client_hello", "dst_ip": "96.6.83.178", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tags.bluekai.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-1bd6ecf03f748808bc9cadc8", "src_port": 49249, "tcp_stream": 69, "udp_stream": null, "frame_number": 2688, "timestamp_epoch": "1575413167.302056000" }, { "kind": "tls_client_hello", "dst_ip": "96.6.83.178", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tags.bluekai.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-7380fd75f35ccf9a93625fa7", "src_port": 49248, "tcp_stream": 68, "udp_stream": null, "frame_number": 2691, "timestamp_epoch": "1575413167.302925000" }, { "kind": "tls_client_hello", "dst_ip": "156.154.202.36", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "aa.agkn.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-68274f73bd854d5c387ea6d2", "src_port": 49245, "tcp_stream": 65, "udp_stream": null, "frame_number": 2695, "timestamp_epoch": "1575413167.305025000" }, { "kind": "tls_client_hello", "dst_ip": "99.86.77.108", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "audex.userreport.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-699991110b87e8d0ab106e18", "src_port": 49247, "tcp_stream": 67, "udp_stream": null, "frame_number": 2699, "timestamp_epoch": "1575413167.307424000" }, { "kind": "tls_client_hello", "dst_ip": "99.86.77.108", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "audex.userreport.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-8087883f795daf2449f809d9", "src_port": 49246, "tcp_stream": 66, "udp_stream": null, "frame_number": 2700, "timestamp_epoch": "1575413167.307490000" }, { "kind": "tls_client_hello", "dst_ip": "54.186.165.46", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "dpm.demdex.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-c5fde1f5f6c4c695e86d7b4a", "src_port": 49250, "tcp_stream": 70, "udp_stream": null, "frame_number": 2763, "timestamp_epoch": "1575413167.452950000" }, { "kind": "tls_client_hello", "dst_ip": "54.186.165.46", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "dpm.demdex.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-c49f5bdfa30eb6bb4c373015", "src_port": 49251, "tcp_stream": 71, "udp_stream": null, "frame_number": 2777, "timestamp_epoch": "1575413167.476096000" }, { "kind": "tls_client_hello", "dst_ip": "98.137.156.137", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "geo.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-0a15a94508cd22781bc810bb", "src_port": 49252, "tcp_stream": 72, "udp_stream": null, "frame_number": 2896, "timestamp_epoch": "1575413185.224964000" }, { "kind": "tls_client_hello", "dst_ip": "98.137.156.137", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "geo.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-16c2ed727948f1e0b5f6e404", "src_port": 49253, "tcp_stream": 73, "udp_stream": null, "frame_number": 2900, "timestamp_epoch": "1575413185.235960000" }, { "kind": "tls_client_hello", "dst_ip": "72.21.81.200", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "iecvlist.microsoft.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-73992008940f496677899243", "src_port": 49254, "tcp_stream": 74, "udp_stream": null, "frame_number": 2909, "timestamp_epoch": "1575413185.320300000" }, { "kind": "tls_client_hello", "dst_ip": "72.21.81.200", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "r20swj13mr.microsoft.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-b60dfeb23c8ea42468c60175", "src_port": 49255, "tcp_stream": 75, "udp_stream": null, "frame_number": 2921, "timestamp_epoch": "1575413185.333679000" }, { "kind": "tls_client_hello", "dst_ip": "72.21.81.200", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "r20swj13mr.microsoft.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-2a2c656f380391b65108d307", "src_port": 49256, "tcp_stream": 76, "udp_stream": null, "frame_number": 2937, "timestamp_epoch": "1575413185.386287000" }, { "kind": "tls_client_hello", "dst_ip": "72.21.81.200", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "iecvlist.microsoft.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-1588d74519baeadd23d5baa0", "src_port": 49257, "tcp_stream": 77, "udp_stream": null, "frame_number": 3030, "timestamp_epoch": "1575413185.747908000" }, { "kind": "tls_client_hello", "dst_ip": "72.21.81.200", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "iecvlist.microsoft.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-548af54750d7b82c5008c315", "src_port": 49258, "tcp_stream": 78, "udp_stream": null, "frame_number": 3032, "timestamp_epoch": "1575413185.748739000" }, { "kind": "tls_client_hello", "dst_ip": "67.195.204.151", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "login.aol.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-61f60b00ddbd96b29208f4ae", "src_port": 49262, "tcp_stream": 82, "udp_stream": null, "frame_number": 3212, "timestamp_epoch": "1575413209.121309000" }, { "kind": "tls_client_hello", "dst_ip": "67.195.204.151", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "login.aol.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-815e64c9546327c44ddeaef1", "src_port": 49261, "tcp_stream": 81, "udp_stream": null, "frame_number": 3216, "timestamp_epoch": "1575413209.125896000" }, { "kind": "tls_client_hello", "dst_ip": "98.137.155.9", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cms.analytics.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-d8e1635529d6783f4422badb", "src_port": 49263, "tcp_stream": 83, "udp_stream": null, "frame_number": 3537, "timestamp_epoch": "1575413212.376817000" }, { "kind": "tls_client_hello", "dst_ip": "98.137.155.9", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cms.analytics.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-43d103c2b05386cf69611e1b", "src_port": 49264, "tcp_stream": 84, "udp_stream": null, "frame_number": 3541, "timestamp_epoch": "1575413212.385880000" }, { "kind": "tls_client_hello", "dst_ip": "50.57.31.206", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "uipus.semasio.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-b7ece2f060f9277e7e3fad39", "src_port": 49265, "tcp_stream": 85, "udp_stream": null, "frame_number": 3578, "timestamp_epoch": "1575413212.926880000" }, { "kind": "tls_client_hello", "dst_ip": "50.57.31.206", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "uipus.semasio.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-c5b4df5bfb0a6b3a46a5660e", "src_port": 49266, "tcp_stream": 86, "udp_stream": null, "frame_number": 3582, "timestamp_epoch": "1575413212.935659000" }, { "kind": "tls_client_hello", "dst_ip": "98.137.156.137", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "geo.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-8255b7ac29b35c18bd186201", "src_port": 49267, "tcp_stream": 87, "udp_stream": null, "frame_number": 3613, "timestamp_epoch": "1575413213.214158000" }, { "kind": "tls_client_hello", "dst_ip": "37.157.6.246", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "track.adform.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-7465a649adf00f572c46d1ad", "src_port": 49268, "tcp_stream": 88, "udp_stream": null, "frame_number": 3640, "timestamp_epoch": "1575413213.661480000" }, { "kind": "tls_client_hello", "dst_ip": "37.157.6.246", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "track.adform.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-af20075d3a88b0a44088fe11", "src_port": 49269, "tcp_stream": 89, "udp_stream": null, "frame_number": 3644, "timestamp_epoch": "1575413213.662436000" }, { "kind": "tls_client_hello", "dst_ip": "98.137.156.137", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "geo.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-0f52f276c389114ff8599c70", "src_port": 49271, "tcp_stream": 90, "udp_stream": null, "frame_number": 3754, "timestamp_epoch": "1575413237.455051000" }, { "kind": "tls_client_hello", "dst_ip": "98.137.156.137", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "geo.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-16642357b45e13209444883b", "src_port": 49270, "tcp_stream": 91, "udp_stream": null, "frame_number": 3758, "timestamp_epoch": "1575413237.465842000" }, { "kind": "tls_client_hello", "dst_ip": "107.23.73.96", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "guce.aol.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-f5194edebb68ac3e08f000c1", "src_port": 49272, "tcp_stream": 92, "udp_stream": null, "frame_number": 3800, "timestamp_epoch": "1575413237.982876000" }, { "kind": "tls_client_hello", "dst_ip": "107.23.73.96", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "guce.aol.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-d7623e080dd0c4e0dd6d819e", "src_port": 49273, "tcp_stream": 93, "udp_stream": null, "frame_number": 3804, "timestamp_epoch": "1575413237.989740000" }, { "kind": "tls_client_hello", "dst_ip": "54.236.178.170", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "guce.advertising.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-5f8a0d1af392dc1ba1e7ee0e", "src_port": 49274, "tcp_stream": 94, "udp_stream": null, "frame_number": 3844, "timestamp_epoch": "1575413238.657727000" }, { "kind": "tls_client_hello", "dst_ip": "54.236.178.170", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "guce.advertising.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-6a32f6f2e51810f230cbe991", "src_port": 49275, "tcp_stream": 95, "udp_stream": null, "frame_number": 3845, "timestamp_epoch": "1575413238.657823000" }, { "kind": "tls_client_hello", "dst_ip": "98.137.156.136", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "api.login.aol.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-af697d88f045d961654f84f9", "src_port": 49276, "tcp_stream": 97, "udp_stream": null, "frame_number": 3896, "timestamp_epoch": "1575413239.592707000" }, { "kind": "tls_client_hello", "dst_ip": "98.137.156.136", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "api.login.aol.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-73f834a64e5a9ae218eef9ae", "src_port": 49277, "tcp_stream": 96, "udp_stream": null, "frame_number": 3900, "timestamp_epoch": "1575413239.596757000" }, { "kind": "tls_client_hello", "dst_ip": "67.195.204.151", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "oidc.mail.aol.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-3cec3f78696ac6cbcaf2868f", "src_port": 49278, "tcp_stream": 98, "udp_stream": null, "frame_number": 3980, "timestamp_epoch": "1575413241.586415000" }, { "kind": "tls_client_hello", "dst_ip": "67.195.204.151", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "oidc.mail.aol.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-39f4a0c2faec70a8434e8e1c", "src_port": 49279, "tcp_stream": 99, "udp_stream": null, "frame_number": 3984, "timestamp_epoch": "1575413241.595025000" }, { "kind": "tls_client_hello", "dst_ip": "69.147.64.34", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "mail.aol.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-4fc5308b4eb0bed96dc744da", "src_port": 49280, "tcp_stream": 100, "udp_stream": null, "frame_number": 4036, "timestamp_epoch": "1575413242.848243000" }, { "kind": "tls_client_hello", "dst_ip": "69.147.64.34", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "mail.aol.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-2edb02b59cca68b5f032d19a", "src_port": 49281, "tcp_stream": 101, "udp_stream": null, "frame_number": 4044, "timestamp_epoch": "1575413242.859580000" }, { "kind": "tls_client_hello", "dst_ip": "152.195.55.192", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "consent.cmp.oath.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-bc2b6ec8b20adcce81b087be", "src_port": 49285, "tcp_stream": 105, "udp_stream": null, "frame_number": 4198, "timestamp_epoch": "1575413244.664431000" }, { "kind": "tls_client_hello", "dst_ip": "152.195.55.192", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "consent.cmp.oath.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-7d29fd55fefbbf954b5357af", "src_port": 49284, "tcp_stream": 104, "udp_stream": null, "frame_number": 4199, "timestamp_epoch": "1575413244.664515000" }, { "kind": "tls_client_hello", "dst_ip": "192.229.211.36", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "s.aolcdn.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-50f84ff9fc6eb3896d60e9c8", "src_port": 49283, "tcp_stream": 103, "udp_stream": null, "frame_number": 4202, "timestamp_epoch": "1575413244.664685000" }, { "kind": "tls_client_hello", "dst_ip": "192.229.211.36", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "s.aolcdn.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-c70da9bcae5016380e8ee07a", "src_port": 49282, "tcp_stream": 102, "udp_stream": null, "frame_number": 4204, "timestamp_epoch": "1575413244.665010000" }, { "kind": "tls_client_hello", "dst_ip": "192.229.211.36", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "s.aolcdn.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-456f9bb976f80d6cf915dfc2", "src_port": 49286, "tcp_stream": 106, "udp_stream": null, "frame_number": 4902, "timestamp_epoch": "1575413246.318317000" }, { "kind": "tls_client_hello", "dst_ip": "192.229.211.36", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "s.aolcdn.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-01ad5d9c3bf32b133470d9e6", "src_port": 49287, "tcp_stream": 107, "udp_stream": null, "frame_number": 4912, "timestamp_epoch": "1575413246.341642000" }, { "kind": "tls_client_hello", "dst_ip": "192.229.211.36", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "s.aolcdn.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-58d00fbb4531e5cf8cb2b7f6", "src_port": 49288, "tcp_stream": 108, "udp_stream": null, "frame_number": 4918, "timestamp_epoch": "1575413246.393099000" }, { "kind": "tls_client_hello", "dst_ip": "3.218.16.73", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "gxp2.mail.aol.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-b69be61c0d725f488313d3e5", "src_port": 49290, "tcp_stream": 110, "udp_stream": null, "frame_number": 4947, "timestamp_epoch": "1575413246.523761000" }, { "kind": "tls_client_hello", "dst_ip": "3.218.16.73", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "gxp2.mail.aol.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-7182e8e525735637aecdfa66", "src_port": 49289, "tcp_stream": 109, "udp_stream": null, "frame_number": 4949, "timestamp_epoch": "1575413246.524008000" }, { "kind": "tls_client_hello", "dst_ip": "66.218.87.13", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.aol.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-1a2f32bc77ed0e7bc2740f67", "src_port": 49291, "tcp_stream": 111, "udp_stream": null, "frame_number": 4971, "timestamp_epoch": "1575413246.594631000" }, { "kind": "tls_client_hello", "dst_ip": "66.218.87.13", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.aol.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-ad9549f70cdb645534e8437a", "src_port": 49292, "tcp_stream": 112, "udp_stream": null, "frame_number": 4972, "timestamp_epoch": "1575413246.594703000" }, { "kind": "tls_client_hello", "dst_ip": "184.86.155.127", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sb.scorecardresearch.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-241e81277f2262a696477749", "src_port": 49293, "tcp_stream": 113, "udp_stream": null, "frame_number": 5108, "timestamp_epoch": "1575413247.249279000" }, { "kind": "tls_client_hello", "dst_ip": "184.86.155.127", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sb.scorecardresearch.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-b311745e327d10f261f4e07f", "src_port": 49294, "tcp_stream": 114, "udp_stream": null, "frame_number": 5112, "timestamp_epoch": "1575413247.250557000" }, { "kind": "tls_client_hello", "dst_ip": "192.229.211.36", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "s.aolcdn.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-31a5d0236dd865922a581b79", "src_port": 49295, "tcp_stream": 115, "udp_stream": null, "frame_number": 5290, "timestamp_epoch": "1575413248.076689000" }, { "kind": "tls_client_hello", "dst_ip": "192.229.210.141", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "s.blogsmithmedia.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-01dbc5b2041ae42193ec91fc", "src_port": 49297, "tcp_stream": 117, "udp_stream": null, "frame_number": 5359, "timestamp_epoch": "1575413248.204550000" }, { "kind": "tls_client_hello", "dst_ip": "192.229.210.141", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "s.blogsmithmedia.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-1f1226f24a5ff0dab9aa738a", "src_port": 49296, "tcp_stream": 116, "udp_stream": null, "frame_number": 5361, "timestamp_epoch": "1575413248.206180000" }, { "kind": "tls_client_hello", "dst_ip": "192.229.211.36", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "o.aolcdn.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-5a0218bdb0113f2aadca24bb", "src_port": 49299, "tcp_stream": 118, "udp_stream": null, "frame_number": 5569, "timestamp_epoch": "1575413248.615528000" }, { "kind": "tls_client_hello", "dst_ip": "192.229.211.36", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "o.aolcdn.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-cf206f4ba081911636b7fe82", "src_port": 49298, "tcp_stream": 119, "udp_stream": null, "frame_number": 5577, "timestamp_epoch": "1575413248.637510000" }, { "kind": "tls_client_hello", "dst_ip": "152.199.6.14", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "at.atwola.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-b08a2c61fe567f234329f8f3", "src_port": 49301, "tcp_stream": 121, "udp_stream": null, "frame_number": 6054, "timestamp_epoch": "1575413249.284537000" }, { "kind": "tls_client_hello", "dst_ip": "152.199.6.14", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "at.atwola.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-cadf723c6ab41765ec8b7980", "src_port": 49300, "tcp_stream": 120, "udp_stream": null, "frame_number": 6055, "timestamp_epoch": "1575413249.284637000" }, { "kind": "tls_client_hello", "dst_ip": "192.229.211.36", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "o.aolcdn.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-23f4671101bc94e31cfdcd0c", "src_port": 49305, "tcp_stream": 125, "udp_stream": null, "frame_number": 6389, "timestamp_epoch": "1575413249.886098000" }, { "kind": "tls_client_hello", "dst_ip": "192.229.211.36", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "o.aolcdn.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-b945d1fc2006df03f931e25e", "src_port": 49304, "tcp_stream": 124, "udp_stream": null, "frame_number": 6392, "timestamp_epoch": "1575413249.886410000" }, { "kind": "tls_client_hello", "dst_ip": "192.229.211.36", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "o.aolcdn.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-6df69f1ea9480c9ac81730ee", "src_port": 49302, "tcp_stream": 122, "udp_stream": null, "frame_number": 6394, "timestamp_epoch": "1575413249.886633000" }, { "kind": "tls_client_hello", "dst_ip": "192.229.211.36", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "o.aolcdn.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-93272f0929c333c54826de21", "src_port": 49303, "tcp_stream": 123, "udp_stream": null, "frame_number": 6396, "timestamp_epoch": "1575413249.887009000" }, { "kind": "tls_client_hello", "dst_ip": "192.229.211.36", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "o.aolcdn.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-4c545b734b584ceeec92b475", "src_port": 49307, "tcp_stream": 127, "udp_stream": null, "frame_number": 6416, "timestamp_epoch": "1575413250.007581000" }, { "kind": "tls_client_hello", "dst_ip": "192.229.211.36", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "o.aolcdn.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-ee8568a7caa7b4c7e9bd1b74", "src_port": 49306, "tcp_stream": 126, "udp_stream": null, "frame_number": 6418, "timestamp_epoch": "1575413250.007765000" }, { "kind": "tls_client_hello", "dst_ip": "98.137.156.137", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "geo.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-abbc5d071a13a8a0819a680e", "src_port": 49308, "tcp_stream": 128, "udp_stream": null, "frame_number": 6544, "timestamp_epoch": "1575413250.119831000" }, { "kind": "tls_client_hello", "dst_ip": "98.136.96.149", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ads.yap.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-cdfeeb680d3a86097b2cf822", "src_port": 49310, "tcp_stream": 130, "udp_stream": null, "frame_number": 6596, "timestamp_epoch": "1575413250.317154000" }, { "kind": "tls_client_hello", "dst_ip": "98.136.96.149", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ads.yap.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-b33a90fd7bf2d4e74aa376d4", "src_port": 49309, "tcp_stream": 129, "udp_stream": null, "frame_number": 6598, "timestamp_epoch": "1575413250.317352000" }, { "kind": "tls_client_hello", "dst_ip": "192.229.211.36", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "o.aolcdn.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-45824877774e1e9e28eb21d3", "src_port": 49311, "tcp_stream": 131, "udp_stream": null, "frame_number": 6711, "timestamp_epoch": "1575413250.560233000" }, { "kind": "tls_client_hello", "dst_ip": "192.229.211.36", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "o.aolcdn.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-b544449f7abc5a2c33bcd927", "src_port": 49312, "tcp_stream": 132, "udp_stream": null, "frame_number": 6714, "timestamp_epoch": "1575413250.560521000" }, { "kind": "tls_client_hello", "dst_ip": "152.199.6.24", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "adserver.adtech.advertising.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-021f11c51c4ac2e1c72f8aad", "src_port": 49314, "tcp_stream": 133, "udp_stream": null, "frame_number": 6930, "timestamp_epoch": "1575413251.162091000" }, { "kind": "tls_client_hello", "dst_ip": "152.199.6.24", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "adserver.adtech.advertising.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-e002744e2fe0178440b21aa3", "src_port": 49313, "tcp_stream": 134, "udp_stream": null, "frame_number": 6934, "timestamp_epoch": "1575413251.164564000" }, { "kind": "tls_client_hello", "dst_ip": "152.199.6.14", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "at.atwola.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-caa845693e6d9d1b0375bce9", "src_port": 49315, "tcp_stream": 135, "udp_stream": null, "frame_number": 7074, "timestamp_epoch": "1575413252.276342000" }, { "kind": "tls_client_hello", "dst_ip": "74.6.138.72", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "beap.gemini.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-b23d3359310c7bd5b9702589", "src_port": 49316, "tcp_stream": 137, "udp_stream": null, "frame_number": 7185, "timestamp_epoch": "1575413253.027999000" }, { "kind": "tls_client_hello", "dst_ip": "74.6.138.72", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "beap.gemini.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-0fe1b8aeae2c89853b26d70b", "src_port": 49317, "tcp_stream": 136, "udp_stream": null, "frame_number": 7201, "timestamp_epoch": "1575413253.176098000" }, { "kind": "tls_client_hello", "dst_ip": "34.231.235.125", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "oao-js-tag.onemobile.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-7fc6653b8211c7fb0296bda7", "src_port": 49318, "tcp_stream": 138, "udp_stream": null, "frame_number": 7386, "timestamp_epoch": "1575413253.561508000" }, { "kind": "tls_client_hello", "dst_ip": "34.231.235.125", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "oao-js-tag.onemobile.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-3b29f1d4d083123f9302fad6", "src_port": 49319, "tcp_stream": 139, "udp_stream": null, "frame_number": 7401, "timestamp_epoch": "1575413253.562698000" }, { "kind": "tls_client_hello", "dst_ip": "23.11.218.15", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "z.moatads.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-67ffca5a6de5428b25ea0a79", "src_port": 49320, "tcp_stream": 140, "udp_stream": null, "frame_number": 7501, "timestamp_epoch": "1575413254.454880000" }, { "kind": "tls_client_hello", "dst_ip": "23.11.218.15", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "z.moatads.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-68b9d3c8b4f115f372e8070a", "src_port": 49321, "tcp_stream": 141, "udp_stream": null, "frame_number": 7505, "timestamp_epoch": "1575413254.478688000" }, { "kind": "tls_client_hello", "dst_ip": "23.11.218.15", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "px.moatads.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-1bfd8833204b207f67e8aea4", "src_port": 49322, "tcp_stream": 142, "udp_stream": null, "frame_number": 7663, "timestamp_epoch": "1575413255.152653000" }, { "kind": "tls_client_hello", "dst_ip": "23.11.218.15", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "px.moatads.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-3811b7fd9e5ecbb7c3d19f65", "src_port": 49323, "tcp_stream": 143, "udp_stream": null, "frame_number": 7667, "timestamp_epoch": "1575413255.157961000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.1.130", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.googletagservices.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-03b1b918adefd17ede193cec", "src_port": 49327, "tcp_stream": 147, "udp_stream": null, "frame_number": 7673, "timestamp_epoch": "1575413255.177741000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.1.130", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.googletagservices.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-bf2059a6b7f47a5ac6587c45", "src_port": 49326, "tcp_stream": 146, "udp_stream": null, "frame_number": 7675, "timestamp_epoch": "1575413255.177936000" }, { "kind": "tls_client_hello", "dst_ip": "35.171.168.180", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "prod-m-node-1111.ssp.advertising.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-0fd16cee4d9e5b38c0d1e67a", "src_port": 49325, "tcp_stream": 145, "udp_stream": null, "frame_number": 7681, "timestamp_epoch": "1575413255.191849000" }, { "kind": "tls_client_hello", "dst_ip": "35.171.168.180", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "prod-m-node-1111.ssp.advertising.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-90d377080e1c3a051c753830", "src_port": 49324, "tcp_stream": 144, "udp_stream": null, "frame_number": 7683, "timestamp_epoch": "1575413255.192007000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.12.38", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "s0.2mdn.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-90f967837a508b6961ea9667", "src_port": 49329, "tcp_stream": 149, "udp_stream": null, "frame_number": 7819, "timestamp_epoch": "1575413255.911366000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.12.38", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "s0.2mdn.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-7f8fe2bdcde47b287eca66cd", "src_port": 49328, "tcp_stream": 148, "udp_stream": null, "frame_number": 7821, "timestamp_epoch": "1575413255.911536000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.12.65", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tpc.googlesyndication.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-4a88b07aa5731041483761e9", "src_port": 49330, "tcp_stream": 150, "udp_stream": null, "frame_number": 7834, "timestamp_epoch": "1575413256.285928000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.12.65", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tpc.googlesyndication.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-efb7d78dda58e488773ea7b9", "src_port": 49331, "tcp_stream": 151, "udp_stream": null, "frame_number": 7842, "timestamp_epoch": "1575413256.290477000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.1.130", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pagead2.googlesyndication.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-62262ee95f770065e93161da", "src_port": 49332, "tcp_stream": 152, "udp_stream": null, "frame_number": 7977, "timestamp_epoch": "1575413257.092361000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.1.130", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pagead2.googlesyndication.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-8c34e52237695dc3642e2366", "src_port": 49333, "tcp_stream": 153, "udp_stream": null, "frame_number": 7981, "timestamp_epoch": "1575413257.101753000" }, { "kind": "tls_client_hello", "dst_ip": "34.204.232.247", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "bm.adentifi.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-361e52e8b69c02d3bce499ab", "src_port": 49334, "tcp_stream": 154, "udp_stream": null, "frame_number": 8028, "timestamp_epoch": "1575413257.408110000" }, { "kind": "tls_client_hello", "dst_ip": "34.204.232.247", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "bm.adentifi.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-40447473b8bfa1d4f12e7f54", "src_port": 49335, "tcp_stream": 155, "udp_stream": null, "frame_number": 8032, "timestamp_epoch": "1575413257.416303000" }, { "kind": "tls_client_hello", "dst_ip": "23.67.118.68", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tags.bkrtx.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-0f797f49633f996d839af1c9", "src_port": 49339, "tcp_stream": 159, "udp_stream": null, "frame_number": 8096, "timestamp_epoch": "1575413258.085108000" }, { "kind": "tls_client_hello", "dst_ip": "23.67.118.68", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tags.bkrtx.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-a6e6d8c6e6fbacc4b5cea7cd", "src_port": 49338, "tcp_stream": 158, "udp_stream": null, "frame_number": 8100, "timestamp_epoch": "1575413258.092454000" }, { "kind": "tls_client_hello", "dst_ip": "52.54.122.125", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rtb.adentifi.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-69a0af9949535752a13be214", "src_port": 49337, "tcp_stream": 157, "udp_stream": null, "frame_number": 8104, "timestamp_epoch": "1575413258.098025000" }, { "kind": "tls_client_hello", "dst_ip": "52.54.122.125", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rtb.adentifi.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-bb8f0fa2b66ab6d083c2cd41", "src_port": 49336, "tcp_stream": 156, "udp_stream": null, "frame_number": 8108, "timestamp_epoch": "1575413258.099351000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.193.130", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "googleads4.g.doubleclick.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-436498b21dcf61f2715d3aa7", "src_port": 49341, "tcp_stream": 161, "udp_stream": null, "frame_number": 8224, "timestamp_epoch": "1575413258.484254000" }, { "kind": "tls_client_hello", "dst_ip": "13.249.22.83", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "d.agkn.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-5bc1257c2ccafcb39eb2cd93", "src_port": 49342, "tcp_stream": 162, "udp_stream": null, "frame_number": 8232, "timestamp_epoch": "1575413258.496034000" }, { "kind": "tls_client_hello", "dst_ip": "13.249.22.83", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "d.agkn.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-ccdcbb0583416ca1febb6d5d", "src_port": 49343, "tcp_stream": 163, "udp_stream": null, "frame_number": 8234, "timestamp_epoch": "1575413258.496358000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.193.130", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "googleads4.g.doubleclick.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-fd3f10885ea8982465ee80d3", "src_port": 49340, "tcp_stream": 160, "udp_stream": null, "frame_number": 8236, "timestamp_epoch": "1575413258.496522000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.12.38", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "s0.2mdn.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-5b00f9c2adeb86b83d320345", "src_port": 49344, "tcp_stream": 164, "udp_stream": null, "frame_number": 8328, "timestamp_epoch": "1575413258.869116000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.12.38", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "s0.2mdn.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-e7ca3b394e2b6c7f5ad3b841", "src_port": 49346, "tcp_stream": 166, "udp_stream": null, "frame_number": 8338, "timestamp_epoch": "1575413258.874067000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.12.38", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "s0.2mdn.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-5a86ac193306494ab16ae4c2", "src_port": 49345, "tcp_stream": 165, "udp_stream": null, "frame_number": 8339, "timestamp_epoch": "1575413258.874115000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.12.38", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "s0.2mdn.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-6e73eb32118dd1be4e8258d2", "src_port": 49347, "tcp_stream": 167, "udp_stream": null, "frame_number": 8348, "timestamp_epoch": "1575413258.878255000" }, { "kind": "tls_client_hello", "dst_ip": "52.54.122.125", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rtb.adentifi.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-8ffa23bb89dff00ebd517187", "src_port": 49348, "tcp_stream": 168, "udp_stream": null, "frame_number": 8352, "timestamp_epoch": "1575413258.899477000" }, { "kind": "tls_client_hello", "dst_ip": "52.54.122.125", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rtb.adentifi.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-be1b829b9d19ee6dbf773179", "src_port": 49350, "tcp_stream": 170, "udp_stream": null, "frame_number": 8360, "timestamp_epoch": "1575413258.899980000" }, { "kind": "tls_client_hello", "dst_ip": "52.54.122.125", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rtb.adentifi.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-8ee8cd5be37124f0f0b6c447", "src_port": 49351, "tcp_stream": 171, "udp_stream": null, "frame_number": 8366, "timestamp_epoch": "1575413258.908848000" }, { "kind": "tls_client_hello", "dst_ip": "52.54.122.125", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rtb.adentifi.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-9c627e868ed1fc0dec90ffd2", "src_port": 49349, "tcp_stream": 169, "udp_stream": null, "frame_number": 8368, "timestamp_epoch": "1575413258.909021000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.194.106", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "fonts.googleapis.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-7bcd27e71705f637d5cfb0c4", "src_port": 49353, "tcp_stream": 173, "udp_stream": null, "frame_number": 8390, "timestamp_epoch": "1575413259.082074000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.194.106", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "fonts.googleapis.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-d773bfe14608790ab7963d0c", "src_port": 49352, "tcp_stream": 172, "udp_stream": null, "frame_number": 8392, "timestamp_epoch": "1575413259.082670000" }, { "kind": "tls_client_hello", "dst_ip": "35.190.72.161", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "c.fqtag.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-26a140cad9468687beb12aee", "src_port": 49354, "tcp_stream": 174, "udp_stream": null, "frame_number": 8416, "timestamp_epoch": "1575413259.192038000" }, { "kind": "tls_client_hello", "dst_ip": "35.190.72.161", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "c.fqtag.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-005e02b801fac4cb50aa5898", "src_port": 49355, "tcp_stream": 175, "udp_stream": null, "frame_number": 8422, "timestamp_epoch": "1575413259.194025000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.12.38", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "s0.2mdn.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-dd14839dd20e2c7d62972aa6", "src_port": 49357, "tcp_stream": 176, "udp_stream": null, "frame_number": 8480, "timestamp_epoch": "1575413259.415505000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.12.38", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "s0.2mdn.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-842daf0c985f33df1e31b282", "src_port": 49356, "tcp_stream": 177, "udp_stream": null, "frame_number": 8481, "timestamp_epoch": "1575413259.415564000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.12.67", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "fonts.gstatic.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-51bdc51e700792fed4c70858", "src_port": 49360, "tcp_stream": 180, "udp_stream": null, "frame_number": 8659, "timestamp_epoch": "1575413260.503407000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.12.67", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "fonts.gstatic.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-9ae52f10d1cb6c89dfbc2da9", "src_port": 49358, "tcp_stream": 178, "udp_stream": null, "frame_number": 8660, "timestamp_epoch": "1575413260.503755000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.12.67", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "fonts.gstatic.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-655487da002edd885969e892", "src_port": 49361, "tcp_stream": 181, "udp_stream": null, "frame_number": 8663, "timestamp_epoch": "1575413260.504466000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.12.67", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "fonts.gstatic.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-3b1697dd69bd420add7f55f6", "src_port": 49359, "tcp_stream": 179, "udp_stream": null, "frame_number": 8665, "timestamp_epoch": "1575413260.504684000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.12.67", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "fonts.gstatic.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-ffabb35bc57f37541da945da", "src_port": 49362, "tcp_stream": 182, "udp_stream": null, "frame_number": 8669, "timestamp_epoch": "1575413260.507679000" }, { "kind": "tls_client_hello", "dst_ip": "35.190.36.172", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdn.fqtag.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-509cb9cd9a3182a4a59cadc3", "src_port": 49364, "tcp_stream": 183, "udp_stream": null, "frame_number": 8673, "timestamp_epoch": "1575413260.523537000" }, { "kind": "tls_client_hello", "dst_ip": "35.190.36.172", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cdn.fqtag.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-fa3ae3212f6e6a6a6a9cdb2b", "src_port": 49363, "tcp_stream": 184, "udp_stream": null, "frame_number": 8677, "timestamp_epoch": "1575413260.524660000" }, { "kind": "tls_client_hello", "dst_ip": "76.13.32.137", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ads.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-3472b75b63456ad1c86123a4", "src_port": 49365, "tcp_stream": 185, "udp_stream": null, "frame_number": 8681, "timestamp_epoch": "1575413260.570908000" }, { "kind": "tls_client_hello", "dst_ip": "76.13.32.137", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ads.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-f304869ae6e4f68cef218ad9", "src_port": 49366, "tcp_stream": 186, "udp_stream": null, "frame_number": 8685, "timestamp_epoch": "1575413260.585331000" }, { "kind": "tls_client_hello", "dst_ip": "152.199.24.48", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "opus.analytics.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-0f29eb0f53ff68b5d0127b78", "src_port": 49368, "tcp_stream": 188, "udp_stream": null, "frame_number": 9048, "timestamp_epoch": "1575413261.210715000" }, { "kind": "tls_client_hello", "dst_ip": "152.199.24.48", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "opus.analytics.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-338206188eb855da560bb302", "src_port": 49367, "tcp_stream": 187, "udp_stream": null, "frame_number": 9049, "timestamp_epoch": "1575413261.210773000" }, { "kind": "tls_client_hello", "dst_ip": "18.210.147.153", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "t.myvisualiq.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-09b85ca3816edffcd5d627cd", "src_port": 49369, "tcp_stream": 189, "udp_stream": null, "frame_number": 9161, "timestamp_epoch": "1575413262.345766000" }, { "kind": "tls_client_hello", "dst_ip": "18.210.147.153", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "t.myvisualiq.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-c4cc89154bcd18ae164877cd", "src_port": 49370, "tcp_stream": 190, "udp_stream": null, "frame_number": 9165, "timestamp_epoch": "1575413262.358195000" }, { "kind": "tls_client_hello", "dst_ip": "152.195.14.41", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tag.idsync.analytics.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-38eebe724ee71e74593f78da", "src_port": 49372, "tcp_stream": 192, "udp_stream": null, "frame_number": 9171, "timestamp_epoch": "1575413262.403917000" }, { "kind": "tls_client_hello", "dst_ip": "152.195.14.41", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "tag.idsync.analytics.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-cf15fa96984399639c183354", "src_port": 49371, "tcp_stream": 191, "udp_stream": null, "frame_number": 9175, "timestamp_epoch": "1575413262.406188000" }, { "kind": "tls_client_hello", "dst_ip": "34.204.4.212", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "us-east-1.onemobile.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-54f2b827fb31b60ac6a58287", "src_port": 49374, "tcp_stream": 194, "udp_stream": null, "frame_number": 9223, "timestamp_epoch": "1575413262.518154000" }, { "kind": "tls_client_hello", "dst_ip": "34.204.4.212", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "us-east-1.onemobile.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-246faec727743f55d4832187", "src_port": 49373, "tcp_stream": 193, "udp_stream": null, "frame_number": 9230, "timestamp_epoch": "1575413262.519436000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.1.130", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "googleads.g.doubleclick.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-0d6b566d1edf5ae8c61a5985", "src_port": 49375, "tcp_stream": 195, "udp_stream": null, "frame_number": 9367, "timestamp_epoch": "1575413262.720347000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.193.130", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cm.g.doubleclick.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-bc03886eaed96e73c21af928", "src_port": 49380, "tcp_stream": 201, "udp_stream": null, "frame_number": 9377, "timestamp_epoch": "1575413262.735404000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.193.130", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cm.g.doubleclick.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-7e338e60fc750498ac9e20ef", "src_port": 49381, "tcp_stream": 200, "udp_stream": null, "frame_number": 9378, "timestamp_epoch": "1575413262.735505000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.1.130", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "googleads.g.doubleclick.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-7416dbd7f20072897ce2a150", "src_port": 49377, "tcp_stream": 197, "udp_stream": null, "frame_number": 9379, "timestamp_epoch": "1575413262.735724000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.193.130", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cm.g.doubleclick.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-da428141319e154b9ce28804", "src_port": 49382, "tcp_stream": 202, "udp_stream": null, "frame_number": 9380, "timestamp_epoch": "1575413262.735796000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.193.130", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cm.g.doubleclick.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-4d1001daa618f993e4897c84", "src_port": 49379, "tcp_stream": 199, "udp_stream": null, "frame_number": 9387, "timestamp_epoch": "1575413262.740925000" }, { "kind": "tls_client_hello", "dst_ip": "216.200.232.221", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.mathtag.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-1e2ad7f75e43bb822c03bc9f", "src_port": 49378, "tcp_stream": 198, "udp_stream": null, "frame_number": 9393, "timestamp_epoch": "1575413262.754707000" }, { "kind": "tls_client_hello", "dst_ip": "216.200.232.221", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.mathtag.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-9a89c2cba46ec1ac629f7d46", "src_port": 49376, "tcp_stream": 196, "udp_stream": null, "frame_number": 9394, "timestamp_epoch": "1575413262.754778000" }, { "kind": "tls_client_hello", "dst_ip": "23.11.217.71", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ssum-sec.casalemedia.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-43c63f3a7052b58b7901b947", "src_port": 49387, "tcp_stream": 207, "udp_stream": null, "frame_number": 9403, "timestamp_epoch": "1575413262.791698000" }, { "kind": "tls_client_hello", "dst_ip": "54.84.47.220", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "match.adsrvr.org" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-1b1a87e72d7894be7d689673", "src_port": 49383, "tcp_stream": 203, "udp_stream": null, "frame_number": 9409, "timestamp_epoch": "1575413262.794307000" }, { "kind": "tls_client_hello", "dst_ip": "54.84.47.220", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "match.adsrvr.org" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-accebdca9559b65a474800de", "src_port": 49384, "tcp_stream": 204, "udp_stream": null, "frame_number": 9411, "timestamp_epoch": "1575413262.794440000" }, { "kind": "tls_client_hello", "dst_ip": "23.11.217.11", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ads.pubmatic.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-9a4dc4faace10cf40f9137cd", "src_port": 49389, "tcp_stream": 209, "udp_stream": null, "frame_number": 9419, "timestamp_epoch": "1575413262.804160000" }, { "kind": "tls_client_hello", "dst_ip": "23.11.217.71", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ssum-sec.casalemedia.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-89793d1744b1e1c3eb72052b", "src_port": 49388, "tcp_stream": 208, "udp_stream": null, "frame_number": 9420, "timestamp_epoch": "1575413262.804217000" }, { "kind": "tls_client_hello", "dst_ip": "54.158.57.141", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.advertising.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-4200f999eee6796f2093201d", "src_port": 49385, "tcp_stream": 205, "udp_stream": null, "frame_number": 9423, "timestamp_epoch": "1575413262.804456000" }, { "kind": "tls_client_hello", "dst_ip": "54.158.57.141", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.advertising.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-bf8a10b3a81e63aeb6767935", "src_port": 49386, "tcp_stream": 206, "udp_stream": null, "frame_number": 9429, "timestamp_epoch": "1575413262.820301000" }, { "kind": "tls_client_hello", "dst_ip": "23.11.217.11", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ads.pubmatic.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-4eb8da5fc3ea31969ecae817", "src_port": 49390, "tcp_stream": 210, "udp_stream": null, "frame_number": 9430, "timestamp_epoch": "1575413262.820376000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.149.101", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ib.adnxs.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-7115ba8cae0821812dbb66e7", "src_port": 49391, "tcp_stream": 211, "udp_stream": null, "frame_number": 9439, "timestamp_epoch": "1575413262.854389000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.149.101", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ib.adnxs.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-b11ff40f15bcb869b685743e", "src_port": 49392, "tcp_stream": 212, "udp_stream": null, "frame_number": 9445, "timestamp_epoch": "1575413262.859437000" }, { "kind": "tls_client_hello", "dst_ip": "35.211.144.153", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "x.bidswitch.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-45a873a8c8b893605ed4d48d", "src_port": 49393, "tcp_stream": 213, "udp_stream": null, "frame_number": 9446, "timestamp_epoch": "1575413262.859490000" }, { "kind": "tls_client_hello", "dst_ip": "50.116.194.21", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ad.turn.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-032f48228df5a2652c72c9b6", "src_port": 49396, "tcp_stream": 216, "udp_stream": null, "frame_number": 9451, "timestamp_epoch": "1575413262.860441000" }, { "kind": "tls_client_hello", "dst_ip": "50.116.194.21", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ad.turn.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-c5823729de6c0fe1e9b7d220", "src_port": 49395, "tcp_stream": 215, "udp_stream": null, "frame_number": 9457, "timestamp_epoch": "1575413262.864668000" }, { "kind": "tls_client_hello", "dst_ip": "35.211.144.153", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "x.bidswitch.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-3e6e3880871942b9de2b0952", "src_port": 49394, "tcp_stream": 214, "udp_stream": null, "frame_number": 9463, "timestamp_epoch": "1575413262.866931000" }, { "kind": "tls_client_hello", "dst_ip": "192.184.69.225", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.quantserve.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-af1905ab623045c4bb11cdd5", "src_port": 49397, "tcp_stream": 217, "udp_stream": null, "frame_number": 9477, "timestamp_epoch": "1575413262.891237000" }, { "kind": "tls_client_hello", "dst_ip": "192.184.69.225", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.quantserve.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-39861047f1c83c17b13365df", "src_port": 49398, "tcp_stream": 218, "udp_stream": null, "frame_number": 9489, "timestamp_epoch": "1575413262.912758000" }, { "kind": "tls_client_hello", "dst_ip": "54.158.57.141", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.advertising.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-1177b5e463172fa974ff7328", "src_port": 49400, "tcp_stream": 220, "udp_stream": null, "frame_number": 9826, "timestamp_epoch": "1575413264.158665000" }, { "kind": "tls_client_hello", "dst_ip": "54.158.57.141", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.advertising.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-c85cff4da25a7392029f6e85", "src_port": 49399, "tcp_stream": 219, "udp_stream": null, "frame_number": 9831, "timestamp_epoch": "1575413264.161621000" }, { "kind": "tls_client_hello", "dst_ip": "54.158.57.141", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.advertising.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-1fa9425ad592bd04a4def4ee", "src_port": 49401, "tcp_stream": 221, "udp_stream": null, "frame_number": 9839, "timestamp_epoch": "1575413264.190485000" }, { "kind": "tls_client_hello", "dst_ip": "54.158.57.141", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.advertising.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-4b2374a4829ada67d51844a4", "src_port": 49402, "tcp_stream": 222, "udp_stream": null, "frame_number": 9903, "timestamp_epoch": "1575413264.551307000" }, { "kind": "tls_client_hello", "dst_ip": "74.6.138.75", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pr-bh.ybp.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-01fcbe4f39e3efcc21e2f255", "src_port": 49404, "tcp_stream": 224, "udp_stream": null, "frame_number": 9917, "timestamp_epoch": "1575413264.686859000" }, { "kind": "tls_client_hello", "dst_ip": "74.6.138.75", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pr-bh.ybp.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-8cd6c2cc81b7eccd1d762c8a", "src_port": 49403, "tcp_stream": 223, "udp_stream": null, "frame_number": 9928, "timestamp_epoch": "1575413264.710393000" }, { "kind": "tls_client_hello", "dst_ip": "34.193.46.35", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ups.analytics.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-7dd38fcd09bef53cfd3f512b", "src_port": 49406, "tcp_stream": 226, "udp_stream": null, "frame_number": 9945, "timestamp_epoch": "1575413264.761913000" }, { "kind": "tls_client_hello", "dst_ip": "34.193.46.35", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ups.analytics.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-782a7a7181eb34697506a23d", "src_port": 49405, "tcp_stream": 225, "udp_stream": null, "frame_number": 9949, "timestamp_epoch": "1575413264.767142000" }, { "kind": "tls_client_hello", "dst_ip": "34.193.46.35", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ups.analytics.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-17e93fdcf37cb1ad45b2ea4f", "src_port": 49407, "tcp_stream": 227, "udp_stream": null, "frame_number": 9958, "timestamp_epoch": "1575413264.781322000" }, { "kind": "tls_client_hello", "dst_ip": "34.193.46.35", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ups.analytics.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-42a796ad2a6ab22b38449d1b", "src_port": 49408, "tcp_stream": 228, "udp_stream": null, "frame_number": 9967, "timestamp_epoch": "1575413264.809328000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.23", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "image6.pubmatic.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-cbe75efa6fb15d807649a3fe", "src_port": 49410, "tcp_stream": 230, "udp_stream": null, "frame_number": 10022, "timestamp_epoch": "1575413265.023163000" }, { "kind": "tls_client_hello", "dst_ip": "35.186.239.238", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cm.eyereturn.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-152c15f1cbd2aed12a0d9f0f", "src_port": 49415, "tcp_stream": 235, "udp_stream": null, "frame_number": 10045, "timestamp_epoch": "1575413265.135568000" }, { "kind": "tls_client_hello", "dst_ip": "34.193.46.35", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ups.analytics.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-925addc9b3b2cb4b850fd77f", "src_port": 49411, "tcp_stream": 231, "udp_stream": null, "frame_number": 10046, "timestamp_epoch": "1575413265.135652000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.23", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "image6.pubmatic.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-1222e56896e9e08613a69b0d", "src_port": 49409, "tcp_stream": 229, "udp_stream": null, "frame_number": 10047, "timestamp_epoch": "1575413265.135752000" }, { "kind": "tls_client_hello", "dst_ip": "35.186.239.238", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cm.eyereturn.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-ad2be9f550bd785042954f7a", "src_port": 49416, "tcp_stream": 236, "udp_stream": null, "frame_number": 10048, "timestamp_epoch": "1575413265.135802000" }, { "kind": "tls_client_hello", "dst_ip": "34.193.46.35", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ups.analytics.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-b99a941e71fa1c30c4ec5b49", "src_port": 49412, "tcp_stream": 232, "udp_stream": null, "frame_number": 10075, "timestamp_epoch": "1575413265.180626000" }, { "kind": "tls_client_hello", "dst_ip": "52.7.147.140", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pm.w55c.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-aad05a217f236e9a7ba2105c", "src_port": 49413, "tcp_stream": 233, "udp_stream": null, "frame_number": 10076, "timestamp_epoch": "1575413265.180775000" }, { "kind": "tls_client_hello", "dst_ip": "52.7.147.140", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pm.w55c.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-a437604711022f4040e4ffe6", "src_port": 49414, "tcp_stream": 234, "udp_stream": null, "frame_number": 10107, "timestamp_epoch": "1575413265.187818000" }, { "kind": "tls_client_hello", "dst_ip": "198.8.70.128", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "p.rfihub.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-7eca8752b217e699449b580a", "src_port": 49418, "tcp_stream": 237, "udp_stream": null, "frame_number": 10108, "timestamp_epoch": "1575413265.188012000" }, { "kind": "tls_client_hello", "dst_ip": "198.8.70.128", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "p.rfihub.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-eecbc21991090c032f1df52d", "src_port": 49419, "tcp_stream": 238, "udp_stream": null, "frame_number": 10109, "timestamp_epoch": "1575413265.188160000" }, { "kind": "tls_client_hello", "dst_ip": "35.169.207.73", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "match.prod.bidr.io" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-48db03e1782a81823e4ebc32", "src_port": 49417, "tcp_stream": 239, "udp_stream": null, "frame_number": 10110, "timestamp_epoch": "1575413265.188216000" }, { "kind": "tls_client_hello", "dst_ip": "35.169.207.73", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "match.prod.bidr.io" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-d7d926f2d6173619cc7f6d57", "src_port": 49420, "tcp_stream": 240, "udp_stream": null, "frame_number": 10111, "timestamp_epoch": "1575413265.188358000" }, { "kind": "tls_client_hello", "dst_ip": "173.231.184.20", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cm.adgrx.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-2e1ec388fbc8e632093b392a", "src_port": 49421, "tcp_stream": 241, "udp_stream": null, "frame_number": 10127, "timestamp_epoch": "1575413265.191748000" }, { "kind": "tls_client_hello", "dst_ip": "185.167.164.42", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "c1.adform.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-c878986a83c6d44de842ad7b", "src_port": 49424, "tcp_stream": 244, "udp_stream": null, "frame_number": 10128, "timestamp_epoch": "1575413265.191805000" }, { "kind": "tls_client_hello", "dst_ip": "185.167.164.42", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "c1.adform.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-27b315aa52cca8b900de2fc8", "src_port": 49423, "tcp_stream": 243, "udp_stream": null, "frame_number": 10129, "timestamp_epoch": "1575413265.191850000" }, { "kind": "tls_client_hello", "dst_ip": "173.231.184.20", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cm.adgrx.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-130748620b67d03a211f8d64", "src_port": 49422, "tcp_stream": 242, "udp_stream": null, "frame_number": 10131, "timestamp_epoch": "1575413265.191985000" }, { "kind": "tls_client_hello", "dst_ip": "205.180.86.172", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "casale-match.dotomi.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-88f3a37d0e8b7b59eee7b3e4", "src_port": 49426, "tcp_stream": 246, "udp_stream": null, "frame_number": 10141, "timestamp_epoch": "1575413265.311628000" }, { "kind": "tls_client_hello", "dst_ip": "205.180.86.172", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "casale-match.dotomi.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-a5143361bd141da215c4d965", "src_port": 49425, "tcp_stream": 245, "udp_stream": null, "frame_number": 10145, "timestamp_epoch": "1575413265.320884000" }, { "kind": "tls_client_hello", "dst_ip": "23.11.217.71", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "dsum-sec.casalemedia.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-ad039ce8a95c9a4fdc3f8cd9", "src_port": 49427, "tcp_stream": 247, "udp_stream": null, "frame_number": 10196, "timestamp_epoch": "1575413265.403229000" }, { "kind": "tls_client_hello", "dst_ip": "23.11.217.71", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "dsum-sec.casalemedia.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-e26b890585659ca07e725eb6", "src_port": 49428, "tcp_stream": 248, "udp_stream": null, "frame_number": 10197, "timestamp_epoch": "1575413265.403332000" }, { "kind": "tls_client_hello", "dst_ip": "23.11.217.71", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "dsum-sec.casalemedia.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-6e37bd8f7a0577ed9d289c70", "src_port": 49429, "tcp_stream": 249, "udp_stream": null, "frame_number": 10198, "timestamp_epoch": "1575413265.403378000" }, { "kind": "tls_client_hello", "dst_ip": "74.6.138.72", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "beap.gemini.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-07333d955d31c3c586ab8041", "src_port": 49431, "tcp_stream": 251, "udp_stream": null, "frame_number": 10489, "timestamp_epoch": "1575413266.137026000" }, { "kind": "tls_client_hello", "dst_ip": "74.6.138.72", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "beap.gemini.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-2060dd25a52ee23d2c5d913e", "src_port": 49430, "tcp_stream": 250, "udp_stream": null, "frame_number": 10491, "timestamp_epoch": "1575413266.137584000" }, { "kind": "tls_client_hello", "dst_ip": "23.11.217.71", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "dsum-sec.casalemedia.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-4be1097489e5466bf5737268", "src_port": 49432, "tcp_stream": 252, "udp_stream": null, "frame_number": 10597, "timestamp_epoch": "1575413266.750929000" }, { "kind": "tls_client_hello", "dst_ip": "23.11.217.71", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "dsum-sec.casalemedia.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-0c51590081cd12220bf970d1", "src_port": 49435, "tcp_stream": 255, "udp_stream": null, "frame_number": 10656, "timestamp_epoch": "1575413267.132409000" }, { "kind": "tls_client_hello", "dst_ip": "52.72.249.172", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "p.adsymptotic.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-4716f1fc0877d1cae60bd0d6", "src_port": 49438, "tcp_stream": 258, "udp_stream": null, "frame_number": 10915, "timestamp_epoch": "1575413268.263420000" }, { "kind": "tls_client_hello", "dst_ip": "52.72.249.172", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "p.adsymptotic.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-e3517b1bf11d0e099d3c1d21", "src_port": 49439, "tcp_stream": 259, "udp_stream": null, "frame_number": 10929, "timestamp_epoch": "1575413268.275131000" }, { "kind": "tls_client_hello", "dst_ip": "151.101.2.49", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync-tm.everesttech.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-1275b1a48fa7a9881e6b4938", "src_port": 49441, "tcp_stream": 261, "udp_stream": null, "frame_number": 10940, "timestamp_epoch": "1575413268.281017000" }, { "kind": "tls_client_hello", "dst_ip": "151.101.2.49", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync-tm.everesttech.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-3863161179308a8a283e5be1", "src_port": 49440, "tcp_stream": 260, "udp_stream": null, "frame_number": 10941, "timestamp_epoch": "1575413268.281065000" }, { "kind": "tls_client_hello", "dst_ip": "74.119.118.138", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "dis.criteo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-e8a58b79c82b483669928919", "src_port": 49443, "tcp_stream": 263, "udp_stream": null, "frame_number": 10948, "timestamp_epoch": "1575413268.290123000" }, { "kind": "tls_client_hello", "dst_ip": "74.119.118.138", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "dis.criteo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-e177bdac1b7c4a6d7f785811", "src_port": 49442, "tcp_stream": 262, "udp_stream": null, "frame_number": 10949, "timestamp_epoch": "1575413268.290174000" }, { "kind": "tls_client_hello", "dst_ip": "169.62.192.207", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "um.simpli.fi" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-4db05aa0768db05989d81c25", "src_port": 49446, "tcp_stream": 266, "udp_stream": null, "frame_number": 10956, "timestamp_epoch": "1575413268.297506000" }, { "kind": "tls_client_hello", "dst_ip": "169.62.192.207", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "um.simpli.fi" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-a1990710c8f7a3f31ec02e7c", "src_port": 49447, "tcp_stream": 267, "udp_stream": null, "frame_number": 10958, "timestamp_epoch": "1575413268.297953000" }, { "kind": "tls_client_hello", "dst_ip": "38.67.14.233", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pmp.mxptint.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-ff48d7c884f919735da44974", "src_port": 49448, "tcp_stream": 268, "udp_stream": null, "frame_number": 10964, "timestamp_epoch": "1575413268.302484000" }, { "kind": "tls_client_hello", "dst_ip": "38.67.14.233", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pmp.mxptint.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-dd39d3dea7c2892888465498", "src_port": 49449, "tcp_stream": 269, "udp_stream": null, "frame_number": 10965, "timestamp_epoch": "1575413268.302562000" }, { "kind": "tls_client_hello", "dst_ip": "209.15.36.35", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel-sync.sitescout.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-b7db5685302be14a675d7343", "src_port": 49445, "tcp_stream": 265, "udp_stream": null, "frame_number": 10972, "timestamp_epoch": "1575413268.314920000" }, { "kind": "tls_client_hello", "dst_ip": "209.15.36.35", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel-sync.sitescout.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-9ea4ef79aacfc7d9a667e4ad", "src_port": 49444, "tcp_stream": 264, "udp_stream": null, "frame_number": 10976, "timestamp_epoch": "1575413268.333871000" }, { "kind": "tls_client_hello", "dst_ip": "34.235.45.38", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.ipredictive.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-886a8710d6aa8f249def1ef1", "src_port": 49453, "tcp_stream": 273, "udp_stream": null, "frame_number": 10986, "timestamp_epoch": "1575413268.346940000" }, { "kind": "tls_client_hello", "dst_ip": "34.235.45.38", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.ipredictive.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-a5ce70aacb443a11f27ec144", "src_port": 49452, "tcp_stream": 272, "udp_stream": null, "frame_number": 10987, "timestamp_epoch": "1575413268.347073000" }, { "kind": "tls_client_hello", "dst_ip": "205.180.86.172", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pubmatic-match.dotomi.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-ad5456b742631f555a3ec899", "src_port": 49450, "tcp_stream": 270, "udp_stream": null, "frame_number": 10988, "timestamp_epoch": "1575413268.347144000" }, { "kind": "tls_client_hello", "dst_ip": "205.180.86.172", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pubmatic-match.dotomi.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-eb77c0713ca1c15bc598d4cf", "src_port": 49451, "tcp_stream": 271, "udp_stream": null, "frame_number": 10998, "timestamp_epoch": "1575413268.361812000" }, { "kind": "tls_client_hello", "dst_ip": "54.85.102.186", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "match.rundsp.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-f00f3152c52e653f34ebbbc5", "src_port": 49455, "tcp_stream": 275, "udp_stream": null, "frame_number": 11004, "timestamp_epoch": "1575413268.385846000" }, { "kind": "tls_client_hello", "dst_ip": "54.85.102.186", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "match.rundsp.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-d6b18ecbafb0fc3fad4b5925", "src_port": 49454, "tcp_stream": 274, "udp_stream": null, "frame_number": 11010, "timestamp_epoch": "1575413268.393109000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.17", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "image2.pubmatic.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-f053520af77de24a37e86b4b", "src_port": 49456, "tcp_stream": 276, "udp_stream": null, "frame_number": 11032, "timestamp_epoch": "1575413268.463232000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.17", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "image2.pubmatic.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-69ebe62f2ea7e7a4fea2e763", "src_port": 49457, "tcp_stream": 277, "udp_stream": null, "frame_number": 11048, "timestamp_epoch": "1575413268.492173000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.24", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "image4.pubmatic.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-1054f34b01b3ba37546e9fcc", "src_port": 49459, "tcp_stream": 279, "udp_stream": null, "frame_number": 11050, "timestamp_epoch": "1575413268.492357000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.17", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "image2.pubmatic.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-bf23e9fb9f9a08075f4b6aca", "src_port": 49458, "tcp_stream": 278, "udp_stream": null, "frame_number": 11051, "timestamp_epoch": "1575413268.492523000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.24", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "image4.pubmatic.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-60a69b5feac2a210e5090f8d", "src_port": 49460, "tcp_stream": 280, "udp_stream": null, "frame_number": 11065, "timestamp_epoch": "1575413268.498230000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.17", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "simage2.pubmatic.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-2747acece4e76c908e575b71", "src_port": 49462, "tcp_stream": 282, "udp_stream": null, "frame_number": 11076, "timestamp_epoch": "1575413268.504574000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.17", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "simage2.pubmatic.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-643a5db177f87031fcba17c0", "src_port": 49461, "tcp_stream": 281, "udp_stream": null, "frame_number": 11091, "timestamp_epoch": "1575413268.514941000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.17", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "simage2.pubmatic.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-af72a1df9b53d8d06c147e38", "src_port": 49464, "tcp_stream": 284, "udp_stream": null, "frame_number": 11101, "timestamp_epoch": "1575413268.526883000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.17", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "simage2.pubmatic.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-3fb7013e319755133b9dd5c6", "src_port": 49463, "tcp_stream": 283, "udp_stream": null, "frame_number": 11112, "timestamp_epoch": "1575413268.540611000" }, { "kind": "tls_client_hello", "dst_ip": "54.175.88.188", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.srv.stackadapt.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-324eca23dc6ffb751c2a48a2", "src_port": 49466, "tcp_stream": 286, "udp_stream": null, "frame_number": 11186, "timestamp_epoch": "1575413268.632096000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.17", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "image2.pubmatic.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-527a6f402dffd0b852ffdc97", "src_port": 49465, "tcp_stream": 285, "udp_stream": null, "frame_number": 11192, "timestamp_epoch": "1575413268.636080000" }, { "kind": "tls_client_hello", "dst_ip": "54.175.88.188", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.srv.stackadapt.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-e9feb4e3b54bd6d452ebfcaf", "src_port": 49467, "tcp_stream": 287, "udp_stream": null, "frame_number": 11194, "timestamp_epoch": "1575413268.636240000" }, { "kind": "tls_client_hello", "dst_ip": "23.11.217.71", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "dsum.casalemedia.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-c77a1a31fb7ae6460a10ae65", "src_port": 49469, "tcp_stream": 289, "udp_stream": null, "frame_number": 11388, "timestamp_epoch": "1575413269.029328000" }, { "kind": "tls_client_hello", "dst_ip": "23.11.217.71", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "dsum.casalemedia.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-43dea8ec071cc2c41154c033", "src_port": 49468, "tcp_stream": 288, "udp_stream": null, "frame_number": 11389, "timestamp_epoch": "1575413269.029388000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.17", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "simage2.pubmatic.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-2b98e63f5b0ec463527c7767", "src_port": 49470, "tcp_stream": 290, "udp_stream": null, "frame_number": 11505, "timestamp_epoch": "1575413269.468173000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.17", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "image2.pubmatic.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-a36266494cd4782973c413f2", "src_port": 49471, "tcp_stream": 291, "udp_stream": null, "frame_number": 11515, "timestamp_epoch": "1575413269.531034000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.17", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "simage2.pubmatic.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-30a4dec8462f22a9c2c2cdf2", "src_port": 49472, "tcp_stream": 292, "udp_stream": null, "frame_number": 11521, "timestamp_epoch": "1575413269.551960000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.17", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "image2.pubmatic.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-de016979434cc7b3a61ad568", "src_port": 49473, "tcp_stream": 293, "udp_stream": null, "frame_number": 11558, "timestamp_epoch": "1575413269.719299000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.17", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "simage2.pubmatic.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-8fd3a47006180380d9aa80c7", "src_port": 49474, "tcp_stream": 294, "udp_stream": null, "frame_number": 11616, "timestamp_epoch": "1575413269.902094000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.24", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "simage4.pubmatic.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-393fb2223754252af55a482c", "src_port": 49475, "tcp_stream": 295, "udp_stream": null, "frame_number": 11628, "timestamp_epoch": "1575413269.978848000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.24", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "simage4.pubmatic.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-09f2a5ce1f9d21179754697e", "src_port": 49476, "tcp_stream": 296, "udp_stream": null, "frame_number": 11632, "timestamp_epoch": "1575413269.996746000" }, { "kind": "tls_client_hello", "dst_ip": "152.199.6.14", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "at.atwola.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-aa05bcf64357db050f0b0142", "src_port": 49478, "tcp_stream": 298, "udp_stream": null, "frame_number": 12490, "timestamp_epoch": "1575413303.010327000" }, { "kind": "tls_client_hello", "dst_ip": "152.199.6.14", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "at.atwola.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-f71c40f4d6144f136340193b", "src_port": 49477, "tcp_stream": 297, "udp_stream": null, "frame_number": 12494, "timestamp_epoch": "1575413303.013351000" }, { "kind": "tls_client_hello", "dst_ip": "34.231.235.125", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "oao-js-tag.onemobile.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-ce8badbb5eb98b323e675e77", "src_port": 49480, "tcp_stream": 300, "udp_stream": null, "frame_number": 12546, "timestamp_epoch": "1575413304.110176000" }, { "kind": "tls_client_hello", "dst_ip": "34.231.235.125", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "oao-js-tag.onemobile.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-04833f66fd060cffce2ccf9f", "src_port": 49479, "tcp_stream": 299, "udp_stream": null, "frame_number": 12547, "timestamp_epoch": "1575413304.110245000" }, { "kind": "tls_client_hello", "dst_ip": "34.204.4.212", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "us-east-1.onemobile.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-564e47e440605f4614d5ebac", "src_port": 49482, "tcp_stream": 302, "udp_stream": null, "frame_number": 12576, "timestamp_epoch": "1575413304.669487000" }, { "kind": "tls_client_hello", "dst_ip": "34.204.4.212", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "us-east-1.onemobile.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-1f13a1bceca48870688b04c2", "src_port": 49481, "tcp_stream": 301, "udp_stream": null, "frame_number": 12577, "timestamp_epoch": "1575413304.669548000" }, { "kind": "tls_client_hello", "dst_ip": "76.13.32.137", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ads.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-b212762a64ee6e4b5c2904fb", "src_port": 49483, "tcp_stream": 303, "udp_stream": null, "frame_number": 12582, "timestamp_epoch": "1575413304.669901000" }, { "kind": "tls_client_hello", "dst_ip": "76.13.32.137", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ads.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-8cc66b2e98db245d326ed440", "src_port": 49484, "tcp_stream": 304, "udp_stream": null, "frame_number": 12584, "timestamp_epoch": "1575413304.670144000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.193.130", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cm.g.doubleclick.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-fa03b3e0bb0fb96e8e8ebd61", "src_port": 49485, "tcp_stream": 305, "udp_stream": null, "frame_number": 12660, "timestamp_epoch": "1575413305.241743000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.1.130", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "googleads.g.doubleclick.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-59d5af7f04833b8608560145", "src_port": 49489, "tcp_stream": 309, "udp_stream": null, "frame_number": 12668, "timestamp_epoch": "1575413305.253173000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.193.130", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cm.g.doubleclick.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-d3c969b8cf7732ef496a1bb6", "src_port": 49486, "tcp_stream": 306, "udp_stream": null, "frame_number": 12669, "timestamp_epoch": "1575413305.253240000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.1.130", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "googleads.g.doubleclick.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-026937eaea93853687adf0aa", "src_port": 49490, "tcp_stream": 310, "udp_stream": null, "frame_number": 12677, "timestamp_epoch": "1575413305.256655000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.193.130", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cm.g.doubleclick.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-988fac7b73a48767ebd89ccc", "src_port": 49491, "tcp_stream": 311, "udp_stream": null, "frame_number": 12680, "timestamp_epoch": "1575413305.257120000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.193.130", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cm.g.doubleclick.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-517dab9eded1cc4d9043987a", "src_port": 49492, "tcp_stream": 312, "udp_stream": null, "frame_number": 12682, "timestamp_epoch": "1575413305.257257000" }, { "kind": "tls_client_hello", "dst_ip": "23.11.217.71", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ssum-sec.casalemedia.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-e43461b0ae59799ace2a4320", "src_port": 49495, "tcp_stream": 315, "udp_stream": null, "frame_number": 12686, "timestamp_epoch": "1575413305.265959000" }, { "kind": "tls_client_hello", "dst_ip": "54.158.57.141", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.advertising.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-73f2b1a7b6fa401935b601b9", "src_port": 49487, "tcp_stream": 307, "udp_stream": null, "frame_number": 12692, "timestamp_epoch": "1575413305.278668000" }, { "kind": "tls_client_hello", "dst_ip": "23.11.217.71", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ssum-sec.casalemedia.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-c1bb673704ef50d7e7e49ebc", "src_port": 49496, "tcp_stream": 316, "udp_stream": null, "frame_number": 12694, "timestamp_epoch": "1575413305.278976000" }, { "kind": "tls_client_hello", "dst_ip": "54.158.57.141", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.advertising.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-5930ab8b58f1e7758c5cb6e0", "src_port": 49488, "tcp_stream": 308, "udp_stream": null, "frame_number": 12698, "timestamp_epoch": "1575413305.285416000" }, { "kind": "tls_client_hello", "dst_ip": "50.116.194.21", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ad.turn.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-7f5febfc8d25f37bb5aff122", "src_port": 49499, "tcp_stream": 319, "udp_stream": null, "frame_number": 12703, "timestamp_epoch": "1575413305.286681000" }, { "kind": "tls_client_hello", "dst_ip": "50.116.194.21", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ad.turn.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-f549ed8f9ab4b88ada56516e", "src_port": 49500, "tcp_stream": 320, "udp_stream": null, "frame_number": 12709, "timestamp_epoch": "1575413305.291034000" }, { "kind": "tls_client_hello", "dst_ip": "54.84.47.220", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "match.adsrvr.org" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-e3eae57e0299068e42ec213a", "src_port": 49494, "tcp_stream": 314, "udp_stream": null, "frame_number": 12711, "timestamp_epoch": "1575413305.291195000" }, { "kind": "tls_client_hello", "dst_ip": "216.200.232.221", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.mathtag.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-c5deabc902638cd376670cca", "src_port": 49498, "tcp_stream": 318, "udp_stream": null, "frame_number": 12715, "timestamp_epoch": "1575413305.294515000" }, { "kind": "tls_client_hello", "dst_ip": "54.84.47.220", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "match.adsrvr.org" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-6f20d6a19ce2940d81d0a86b", "src_port": 49493, "tcp_stream": 313, "udp_stream": null, "frame_number": 12719, "timestamp_epoch": "1575413305.295194000" }, { "kind": "tls_client_hello", "dst_ip": "216.200.232.221", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.mathtag.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-3fb7e794a964844d7112bb0c", "src_port": 49497, "tcp_stream": 317, "udp_stream": null, "frame_number": 12723, "timestamp_epoch": "1575413305.297035000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.149.101", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ib.adnxs.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-4a5b2d1bee0be5e624438bed", "src_port": 49504, "tcp_stream": 324, "udp_stream": null, "frame_number": 12745, "timestamp_epoch": "1575413305.323450000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.149.101", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ib.adnxs.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-580ac2eae92e67ad4c48e06b", "src_port": 49503, "tcp_stream": 323, "udp_stream": null, "frame_number": 12747, "timestamp_epoch": "1575413305.323625000" }, { "kind": "tls_client_hello", "dst_ip": "35.211.144.153", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "x.bidswitch.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-af327bb61c845a8a10dcb70f", "src_port": 49501, "tcp_stream": 321, "udp_stream": null, "frame_number": 12748, "timestamp_epoch": "1575413305.323686000" }, { "kind": "tls_client_hello", "dst_ip": "35.211.144.153", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "x.bidswitch.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-b6861af272d1258d2db02f77", "src_port": 49502, "tcp_stream": 322, "udp_stream": null, "frame_number": 12750, "timestamp_epoch": "1575413305.323733000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.23", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "image6.pubmatic.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-732f9400e302e4d6d83ab7b6", "src_port": 49507, "tcp_stream": 327, "udp_stream": null, "frame_number": 12757, "timestamp_epoch": "1575413305.324132000" }, { "kind": "tls_client_hello", "dst_ip": "192.184.69.225", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.quantserve.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-4ca8ec6808010274d0e394af", "src_port": 49505, "tcp_stream": 325, "udp_stream": null, "frame_number": 12761, "timestamp_epoch": "1575413305.324462000" }, { "kind": "tls_client_hello", "dst_ip": "192.184.69.225", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.quantserve.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-a0405d9a13a37c72cf70c66b", "src_port": 49506, "tcp_stream": 326, "udp_stream": null, "frame_number": 12763, "timestamp_epoch": "1575413305.324617000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.23", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "image6.pubmatic.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-f234d55d5b241fedeabf229c", "src_port": 49508, "tcp_stream": 328, "udp_stream": null, "frame_number": 12777, "timestamp_epoch": "1575413305.343252000" }, { "kind": "tls_client_hello", "dst_ip": "54.158.57.141", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.advertising.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-a114c4787103ce8f1e4c51d8", "src_port": 49511, "tcp_stream": 331, "udp_stream": null, "frame_number": 12987, "timestamp_epoch": "1575413305.850256000" }, { "kind": "tls_client_hello", "dst_ip": "74.6.138.75", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pr-bh.ybp.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-c29203f061517f84749860a6", "src_port": 49512, "tcp_stream": 332, "udp_stream": null, "frame_number": 13017, "timestamp_epoch": "1575413305.959219000" }, { "kind": "tls_client_hello", "dst_ip": "74.6.138.75", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pr-bh.ybp.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-b5c115ad7692ffeb01406227", "src_port": 49513, "tcp_stream": 333, "udp_stream": null, "frame_number": 13029, "timestamp_epoch": "1575413305.965354000" }, { "kind": "tls_client_hello", "dst_ip": "54.158.57.141", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.advertising.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-fceefb3e03ac502e9df8cdfb", "src_port": 49514, "tcp_stream": 334, "udp_stream": null, "frame_number": 13033, "timestamp_epoch": "1575413305.970868000" }, { "kind": "tls_client_hello", "dst_ip": "204.79.197.200", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.bing.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-4dbb554754dad34f84892a3e", "src_port": 49517, "tcp_stream": 337, "udp_stream": null, "frame_number": 13043, "timestamp_epoch": "1575413306.021793000" }, { "kind": "tls_client_hello", "dst_ip": "204.79.197.200", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.bing.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-6bb281246529c83d09f12711", "src_port": 49518, "tcp_stream": 338, "udp_stream": null, "frame_number": 13049, "timestamp_epoch": "1575413306.025331000" }, { "kind": "tls_client_hello", "dst_ip": "54.158.57.141", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.advertising.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-61d93122af8fed994c884108", "src_port": 49515, "tcp_stream": 335, "udp_stream": null, "frame_number": 13068, "timestamp_epoch": "1575413306.051550000" }, { "kind": "tls_client_hello", "dst_ip": "54.158.57.141", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.advertising.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-a1e11c1c3fc02db04e59cf40", "src_port": 49516, "tcp_stream": 336, "udp_stream": null, "frame_number": 13072, "timestamp_epoch": "1575413306.055922000" }, { "kind": "tls_client_hello", "dst_ip": "34.193.46.35", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ups.analytics.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-1dc0236e72bd6ed7790fedd7", "src_port": 49519, "tcp_stream": 339, "udp_stream": null, "frame_number": 13088, "timestamp_epoch": "1575413306.076614000" }, { "kind": "tls_client_hello", "dst_ip": "34.193.46.35", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ups.analytics.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-f3a70e55720b1bea2aae787e", "src_port": 49520, "tcp_stream": 340, "udp_stream": null, "frame_number": 13090, "timestamp_epoch": "1575413306.076939000" }, { "kind": "tls_client_hello", "dst_ip": "52.7.147.140", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pm.w55c.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-8ff001cda8b3fa8fe13f85e8", "src_port": 49521, "tcp_stream": 341, "udp_stream": null, "frame_number": 13107, "timestamp_epoch": "1575413306.090359000" }, { "kind": "tls_client_hello", "dst_ip": "52.7.147.140", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pm.w55c.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-a59213600f7845681c652756", "src_port": 49522, "tcp_stream": 342, "udp_stream": null, "frame_number": 13125, "timestamp_epoch": "1575413306.124143000" }, { "kind": "tls_client_hello", "dst_ip": "185.167.164.42", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "c1.adform.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-9110b40628d6cd055fb7957a", "src_port": 49523, "tcp_stream": 343, "udp_stream": null, "frame_number": 13144, "timestamp_epoch": "1575413306.126314000" }, { "kind": "tls_client_hello", "dst_ip": "173.231.184.20", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cm.adgrx.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-12ad0f2d798536b4b8b80539", "src_port": 49526, "tcp_stream": 346, "udp_stream": null, "frame_number": 13147, "timestamp_epoch": "1575413306.126851000" }, { "kind": "tls_client_hello", "dst_ip": "185.167.164.42", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "c1.adform.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-b81e76b9edd6b85193228f7e", "src_port": 49524, "tcp_stream": 344, "udp_stream": null, "frame_number": 13150, "timestamp_epoch": "1575413306.127107000" }, { "kind": "tls_client_hello", "dst_ip": "173.231.184.20", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cm.adgrx.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-ead2f897565858cedacfcedd", "src_port": 49525, "tcp_stream": 345, "udp_stream": null, "frame_number": 13155, "timestamp_epoch": "1575413306.127361000" }, { "kind": "tls_client_hello", "dst_ip": "104.193.80.60", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "csm2waycm-atl.netmng.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-dea0376bfca0349c74a28c6d", "src_port": 49528, "tcp_stream": 348, "udp_stream": null, "frame_number": 13206, "timestamp_epoch": "1575413306.180173000" }, { "kind": "tls_client_hello", "dst_ip": "34.193.46.35", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ups.analytics.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-0b38ea4e926fa13584c3c3e8", "src_port": 49527, "tcp_stream": 347, "udp_stream": null, "frame_number": 13212, "timestamp_epoch": "1575413306.180845000" }, { "kind": "tls_client_hello", "dst_ip": "104.193.80.60", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "csm2waycm-atl.netmng.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-c56215a03119e17b0d5b46dd", "src_port": 49529, "tcp_stream": 349, "udp_stream": null, "frame_number": 13219, "timestamp_epoch": "1575413306.186794000" }, { "kind": "tls_client_hello", "dst_ip": "34.193.46.35", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ups.analytics.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-975f1949e71ea51e19c51763", "src_port": 49530, "tcp_stream": 350, "udp_stream": null, "frame_number": 13240, "timestamp_epoch": "1575413306.232839000" }, { "kind": "tls_client_hello", "dst_ip": "54.82.194.252", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "d.adroll.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-b72eaa9c60c52b3afcc7c9de", "src_port": 49531, "tcp_stream": 351, "udp_stream": null, "frame_number": 13252, "timestamp_epoch": "1575413306.241473000" }, { "kind": "tls_client_hello", "dst_ip": "54.82.194.252", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "d.adroll.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-1049a39ee92900efbc523f53", "src_port": 49532, "tcp_stream": 352, "udp_stream": null, "frame_number": 13258, "timestamp_epoch": "1575413306.242423000" }, { "kind": "tls_client_hello", "dst_ip": "35.207.24.140", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rtb.mfadsrvr.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-26760fe2882498c8f0908d0e", "src_port": 49533, "tcp_stream": 353, "udp_stream": null, "frame_number": 13281, "timestamp_epoch": "1575413306.266962000" }, { "kind": "tls_client_hello", "dst_ip": "35.186.239.238", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cm.eyereturn.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-451bd9983adb54cda9f7c7c3", "src_port": 49535, "tcp_stream": 355, "udp_stream": null, "frame_number": 13296, "timestamp_epoch": "1575413306.272502000" }, { "kind": "tls_client_hello", "dst_ip": "35.186.239.238", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cm.eyereturn.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-236a33863d977f6d702c367f", "src_port": 49536, "tcp_stream": 356, "udp_stream": null, "frame_number": 13304, "timestamp_epoch": "1575413306.274331000" }, { "kind": "tls_client_hello", "dst_ip": "35.207.24.140", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rtb.mfadsrvr.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-9758aba262e11477115cc32d", "src_port": 49534, "tcp_stream": 354, "udp_stream": null, "frame_number": 13315, "timestamp_epoch": "1575413306.290358000" }, { "kind": "tls_client_hello", "dst_ip": "52.54.122.125", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rtb.adentifi.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-44acb54cd24918b0d2df4a65", "src_port": 49538, "tcp_stream": 358, "udp_stream": null, "frame_number": 13333, "timestamp_epoch": "1575413306.294208000" }, { "kind": "tls_client_hello", "dst_ip": "52.54.122.125", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rtb.adentifi.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-07007dbfe07ef65f3e2c1b22", "src_port": 49537, "tcp_stream": 357, "udp_stream": null, "frame_number": 13342, "timestamp_epoch": "1575413306.296982000" }, { "kind": "tls_client_hello", "dst_ip": "52.72.249.172", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "p.adsymptotic.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-6912f138410065cc0cd68bfd", "src_port": 49541, "tcp_stream": 361, "udp_stream": null, "frame_number": 13349, "timestamp_epoch": "1575413306.301316000" }, { "kind": "tls_client_hello", "dst_ip": "52.72.249.172", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "p.adsymptotic.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-d969d5e2466506e7dc1eedbb", "src_port": 49542, "tcp_stream": 362, "udp_stream": null, "frame_number": 13355, "timestamp_epoch": "1575413306.306691000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.17", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "simage2.pubmatic.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-09860c4d20c4cf0d5446236c", "src_port": 49540, "tcp_stream": 360, "udp_stream": null, "frame_number": 13362, "timestamp_epoch": "1575413306.310531000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.17", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "simage2.pubmatic.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-998a33023ae57efe5a078229", "src_port": 49539, "tcp_stream": 359, "udp_stream": null, "frame_number": 13368, "timestamp_epoch": "1575413306.324693000" }, { "kind": "tls_client_hello", "dst_ip": "34.193.46.35", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ups.analytics.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-2c71a77033f5f6a5f8b33191", "src_port": 49543, "tcp_stream": 363, "udp_stream": null, "frame_number": 13384, "timestamp_epoch": "1575413306.357452000" }, { "kind": "tls_client_hello", "dst_ip": "23.67.120.135", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "px.owneriq.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-678257dadcd320408015d2da", "src_port": 49545, "tcp_stream": 365, "udp_stream": null, "frame_number": 13415, "timestamp_epoch": "1575413306.390056000" }, { "kind": "tls_client_hello", "dst_ip": "34.193.46.35", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "ups.analytics.yahoo.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-23b8545d4a8c8f9c81cc7f3e", "src_port": 49544, "tcp_stream": 364, "udp_stream": null, "frame_number": 13421, "timestamp_epoch": "1575413306.394494000" }, { "kind": "tls_client_hello", "dst_ip": "23.67.120.135", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "px.owneriq.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-2891c310cb34b39159c3e889", "src_port": 49546, "tcp_stream": 366, "udp_stream": null, "frame_number": 13422, "timestamp_epoch": "1575413306.394547000" }, { "kind": "tls_client_hello", "dst_ip": "104.17.119.107", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cookie.brealtime.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-a8f4fc4dea06149d6107e98a", "src_port": 49552, "tcp_stream": 372, "udp_stream": null, "frame_number": 13448, "timestamp_epoch": "1575413306.423610000" }, { "kind": "tls_client_hello", "dst_ip": "104.17.119.107", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "cookie.brealtime.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-10fc0c11ee9ed30aafaea643", "src_port": 49551, "tcp_stream": 371, "udp_stream": null, "frame_number": 13449, "timestamp_epoch": "1575413306.423688000" }, { "kind": "tls_client_hello", "dst_ip": "70.42.32.63", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "b1sync.zemanta.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-c96ef861f0d2c604145abec8", "src_port": 49547, "tcp_stream": 367, "udp_stream": null, "frame_number": 13501, "timestamp_epoch": "1575413306.454402000" }, { "kind": "tls_client_hello", "dst_ip": "151.101.2.2", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "trc.taboola.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-b70ee959982010429f8df300", "src_port": 49553, "tcp_stream": 374, "udp_stream": null, "frame_number": 13502, "timestamp_epoch": "1575413306.454455000" }, { "kind": "tls_client_hello", "dst_ip": "70.42.32.63", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "b1sync.zemanta.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-cfb11d56cb958ebe3da70d05", "src_port": 49548, "tcp_stream": 368, "udp_stream": null, "frame_number": 13504, "timestamp_epoch": "1575413306.454572000" }, { "kind": "tls_client_hello", "dst_ip": "151.101.2.2", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "trc.taboola.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-c3846b8bd365af8f1f3008c1", "src_port": 49556, "tcp_stream": 376, "udp_stream": null, "frame_number": 13506, "timestamp_epoch": "1575413306.454720000" }, { "kind": "tls_client_hello", "dst_ip": "8.41.222.150", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.1rx.io" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-9f1301b13ebccfba809b49a8", "src_port": 49550, "tcp_stream": 370, "udp_stream": null, "frame_number": 13508, "timestamp_epoch": "1575413306.454776000" }, { "kind": "tls_client_hello", "dst_ip": "8.41.222.150", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sync.1rx.io" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-a8421a0a2f262deda5abcc85", "src_port": 49549, "tcp_stream": 369, "udp_stream": null, "frame_number": 13510, "timestamp_epoch": "1575413306.454882000" }, { "kind": "tls_client_hello", "dst_ip": "104.193.80.60", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pubmatic2waycm-atl.netmng.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-21c154c95d4737dccc2f2ba0", "src_port": 49554, "tcp_stream": 373, "udp_stream": null, "frame_number": 13530, "timestamp_epoch": "1575413306.471385000" }, { "kind": "tls_client_hello", "dst_ip": "104.193.80.60", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pubmatic2waycm-atl.netmng.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-0969d393e260d8b304da3233", "src_port": 49555, "tcp_stream": 375, "udp_stream": null, "frame_number": 13532, "timestamp_epoch": "1575413306.471738000" }, { "kind": "tls_client_hello", "dst_ip": "151.101.0.166", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "bh.contextweb.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-6cba88db30619d4b7c8d8257", "src_port": 49560, "tcp_stream": 380, "udp_stream": null, "frame_number": 13547, "timestamp_epoch": "1575413306.483362000" }, { "kind": "tls_client_hello", "dst_ip": "151.101.0.166", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "bh.contextweb.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-ede1dbb36d0de5180f9cb129", "src_port": 49559, "tcp_stream": 379, "udp_stream": null, "frame_number": 13553, "timestamp_epoch": "1575413306.487291000" }, { "kind": "tls_client_hello", "dst_ip": "23.7.93.115", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "a.tribalfusion.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-b97a8342f80facce14c4657b", "src_port": 49563, "tcp_stream": 383, "udp_stream": null, "frame_number": 13559, "timestamp_epoch": "1575413306.504817000" }, { "kind": "tls_client_hello", "dst_ip": "23.7.93.115", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "a.tribalfusion.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-b22296093105ac941ba751fb", "src_port": 49564, "tcp_stream": 384, "udp_stream": null, "frame_number": 13561, "timestamp_epoch": "1575413306.505030000" }, { "kind": "tls_client_hello", "dst_ip": "134.209.129.254", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "e.serverbid.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-6796fa960a20e35b7b94ab9e", "src_port": 49562, "tcp_stream": 382, "udp_stream": null, "frame_number": 13579, "timestamp_epoch": "1575413306.525415000" }, { "kind": "tls_client_hello", "dst_ip": "134.209.129.254", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "e.serverbid.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-cd6b4379724df713e43fa538", "src_port": 49561, "tcp_stream": 381, "udp_stream": null, "frame_number": 13580, "timestamp_epoch": "1575413306.525493000" }, { "kind": "tls_client_hello", "dst_ip": "204.74.252.20", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "px.adhigh.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-4c238c37804597cb5e23366a", "src_port": 49565, "tcp_stream": 385, "udp_stream": null, "frame_number": 13609, "timestamp_epoch": "1575413306.599021000" }, { "kind": "tls_client_hello", "dst_ip": "204.74.252.20", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "px.adhigh.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-0564f0a2e821afe11a939bb2", "src_port": 49566, "tcp_stream": 386, "udp_stream": null, "frame_number": 13610, "timestamp_epoch": "1575413306.599079000" }, { "kind": "tls_client_hello", "dst_ip": "23.11.217.71", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "dsum-sec.casalemedia.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-6fadc1d9612b909c486f8d0b", "src_port": 49567, "tcp_stream": 387, "udp_stream": null, "frame_number": 13888, "timestamp_epoch": "1575413306.996081000" }, { "kind": "tls_client_hello", "dst_ip": "23.11.217.71", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "dsum-sec.casalemedia.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-5c090b9e068cd125699cfb2e", "src_port": 49568, "tcp_stream": 388, "udp_stream": null, "frame_number": 13896, "timestamp_epoch": "1575413307.000043000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.17", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "image2.pubmatic.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-baec4095e0b5465437cfe8c6", "src_port": 49569, "tcp_stream": 389, "udp_stream": null, "frame_number": 13985, "timestamp_epoch": "1575413307.174430000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.17", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "image2.pubmatic.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-061483b16b51e4195faed9aa", "src_port": 49570, "tcp_stream": 390, "udp_stream": null, "frame_number": 13988, "timestamp_epoch": "1575413307.174741000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.17", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "simage2.pubmatic.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-619b08b89c34ea2b93ec652a", "src_port": 49571, "tcp_stream": 393, "udp_stream": null, "frame_number": 14117, "timestamp_epoch": "1575413307.507969000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.17", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "simage2.pubmatic.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-af9186dba0026775518eaa15", "src_port": 49572, "tcp_stream": 394, "udp_stream": null, "frame_number": 14124, "timestamp_epoch": "1575413307.520512000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.148.196", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "secure.adnxs.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-cdd7057bdc6392cd7b810826", "src_port": 49575, "tcp_stream": 397, "udp_stream": null, "frame_number": 14131, "timestamp_epoch": "1575413307.537978000" }, { "kind": "tls_client_hello", "dst_ip": "104.254.148.196", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "secure.adnxs.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-c5b11f32671f562c6303cd60", "src_port": 49574, "tcp_stream": 396, "udp_stream": null, "frame_number": 14137, "timestamp_epoch": "1575413307.541121000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.17", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "simage2.pubmatic.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-87d6fdcbeb0439e52bb607d8", "src_port": 49573, "tcp_stream": 395, "udp_stream": null, "frame_number": 14141, "timestamp_epoch": "1575413307.560586000" }, { "kind": "tls_client_hello", "dst_ip": "107.178.246.49", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.tapad.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-f45036af7b2d4b2cc6205b84", "src_port": 49577, "tcp_stream": 399, "udp_stream": null, "frame_number": 14145, "timestamp_epoch": "1575413307.595452000" }, { "kind": "tls_client_hello", "dst_ip": "107.178.246.49", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "pixel.tapad.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-a984e031ba99ce13b37b93ea", "src_port": 49576, "tcp_stream": 398, "udp_stream": null, "frame_number": 14149, "timestamp_epoch": "1575413307.596410000" }, { "kind": "tls_client_hello", "dst_ip": "151.101.2.49", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "match.taboola.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-51703303b47dac7b4b955516", "src_port": 49579, "tcp_stream": 401, "udp_stream": null, "frame_number": 14155, "timestamp_epoch": "1575413307.601114000" }, { "kind": "tls_client_hello", "dst_ip": "151.101.2.49", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "match.taboola.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-770ecb81d3bb196c90b175ab", "src_port": 49578, "tcp_stream": 400, "udp_stream": null, "frame_number": 14156, "timestamp_epoch": "1575413307.601203000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.17", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "simage2.pubmatic.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-4983a45bf393fec84db9c964", "src_port": 49580, "tcp_stream": 402, "udp_stream": null, "frame_number": 14167, "timestamp_epoch": "1575413307.686141000" }, { "kind": "tls_client_hello", "dst_ip": "151.101.66.49", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "match.zorosrv.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-dec693eeb10c5bd06ddae934", "src_port": 49583, "tcp_stream": 407, "udp_stream": null, "frame_number": 14334, "timestamp_epoch": "1575413308.175469000" }, { "kind": "tls_client_hello", "dst_ip": "151.101.66.49", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "match.zorosrv.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-3324b6324aec2957666339b9", "src_port": 49584, "tcp_stream": 408, "udp_stream": null, "frame_number": 14338, "timestamp_epoch": "1575413308.187872000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.24", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "simage4.pubmatic.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-bcf056bbb8883ba80514140d", "src_port": 49586, "tcp_stream": 410, "udp_stream": null, "frame_number": 14362, "timestamp_epoch": "1575413308.270866000" }, { "kind": "tls_client_hello", "dst_ip": "104.36.113.24", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "simage4.pubmatic.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-2cfc2fcd48e76522f0639742", "src_port": 49585, "tcp_stream": 409, "udp_stream": null, "frame_number": 14368, "timestamp_epoch": "1575413308.278250000" }, { "kind": "tls_client_hello", "dst_ip": "162.125.8.1", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.dropbox.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-261d21645b3a131cba550d82", "src_port": 49587, "tcp_stream": 415, "udp_stream": null, "frame_number": 14424, "timestamp_epoch": "1575413311.393541000" }, { "kind": "tls_client_hello", "dst_ip": "162.125.8.1", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.dropbox.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-8ebdbdea5d63477f9fda9a71", "src_port": 49588, "tcp_stream": 416, "udp_stream": null, "frame_number": 14428, "timestamp_epoch": "1575413311.400103000" }, { "kind": "tls_client_hello", "dst_ip": "162.125.8.6", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "uca20a5adbe8d64fd0c7a816e1ec.dl.dropboxusercontent.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-692ce3f46e949a9a57debca1", "src_port": 49589, "tcp_stream": 417, "udp_stream": null, "frame_number": 14472, "timestamp_epoch": "1575413312.544103000" }, { "kind": "tls_client_hello", "dst_ip": "162.125.8.6", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "uca20a5adbe8d64fd0c7a816e1ec.dl.dropboxusercontent.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-4e7dd2bc8a10c4c14fddf5d1", "src_port": 49590, "tcp_stream": 418, "udp_stream": null, "frame_number": 14476, "timestamp_epoch": "1575413312.558850000" }, { "kind": "tls_client_hello", "dst_ip": "69.147.64.34", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "mail.aol.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-3b4f0543801298b9fbfe7bae", "src_port": 49591, "tcp_stream": 419, "udp_stream": null, "frame_number": 14824, "timestamp_epoch": "1575413366.025506000" }, { "kind": "tls_client_hello", "dst_ip": "69.147.64.34", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "mail.aol.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-40a6bceb17e5e1e7f6b9b95b", "src_port": 49604, "tcp_stream": 432, "udp_stream": null, "frame_number": 16227, "timestamp_epoch": "1575413486.057022000" }, { "kind": "tls_client_hello", "dst_ip": "69.147.64.34", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "mail.aol.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-bb152676786d2df4ba8af78b", "src_port": 49605, "tcp_stream": 433, "udp_stream": null, "frame_number": 16287, "timestamp_epoch": "1575413726.073713000" }, { "kind": "tls_client_hello", "dst_ip": "69.147.64.34", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "mail.aol.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-41e582055cceba8eada9508a", "src_port": 49608, "tcp_stream": 435, "udp_stream": null, "frame_number": 16334, "timestamp_epoch": "1575413845.995219000" }, { "kind": "tls_client_hello", "dst_ip": "69.147.64.34", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "mail.aol.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-aedf5fe8f88ae79f77785d35", "src_port": 49607, "tcp_stream": 436, "udp_stream": null, "frame_number": 16338, "timestamp_epoch": "1575413846.003112000" }, { "kind": "tls_client_hello", "dst_ip": "69.147.64.34", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "mail.aol.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-2999b57cf59754c963890a6c", "src_port": 49609, "tcp_stream": 437, "udp_stream": null, "frame_number": 16342, "timestamp_epoch": "1575413846.029786000" }, { "kind": "tls_client_hello", "dst_ip": "171.161.198.200", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "secure.bankofamerica.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-1d3028eaff9eea40b967ee79", "src_port": 49616, "tcp_stream": 443, "udp_stream": null, "frame_number": 16513, "timestamp_epoch": "1575414483.886699000" }, { "kind": "tls_client_hello", "dst_ip": "171.161.198.200", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "secure.bankofamerica.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-bd53be970182258125ee650f", "src_port": 49617, "tcp_stream": 444, "udp_stream": null, "frame_number": 16561, "timestamp_epoch": "1575414484.898618000" }, { "kind": "tls_client_hello", "dst_ip": "171.161.198.200", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "secure.bankofamerica.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-7fa46e71d0c3a7ba85ed5d51", "src_port": 49618, "tcp_stream": 445, "udp_stream": null, "frame_number": 16597, "timestamp_epoch": "1575414484.907482000" }, { "kind": "tls_client_hello", "dst_ip": "171.161.198.200", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "secure.bankofamerica.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-66e4d310f75532d03747e963", "src_port": 49619, "tcp_stream": 446, "udp_stream": null, "frame_number": 16599, "timestamp_epoch": "1575414484.908213000" }, { "kind": "tls_client_hello", "dst_ip": "171.161.198.200", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "secure.bankofamerica.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-fc6d5192ad14a23b295a9aee", "src_port": 49620, "tcp_stream": 447, "udp_stream": null, "frame_number": 16601, "timestamp_epoch": "1575414484.908685000" }, { "kind": "tls_client_hello", "dst_ip": "171.161.198.200", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "secure.bankofamerica.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-8a32b8e3736cd96103bc5a4e", "src_port": 49615, "tcp_stream": 448, "udp_stream": null, "frame_number": 17143, "timestamp_epoch": "1575414487.178444000" }, { "kind": "tls_client_hello", "dst_ip": "66.235.147.244", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "bankofamerica.tt.omtrdc.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-6ef91948b8b352834a9db4fe", "src_port": 49623, "tcp_stream": 451, "udp_stream": null, "frame_number": 17357, "timestamp_epoch": "1575414489.303501000" }, { "kind": "tls_client_hello", "dst_ip": "66.235.147.244", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "bankofamerica.tt.omtrdc.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-6a7787c528e06ba6007e2692", "src_port": 49624, "tcp_stream": 452, "udp_stream": null, "frame_number": 17371, "timestamp_epoch": "1575414489.358157000" }, { "kind": "tls_client_hello", "dst_ip": "3.83.197.207", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "dull.bankofamerica.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-7107ec82da7a48fc2e41059a", "src_port": 49626, "tcp_stream": 454, "udp_stream": null, "frame_number": 17501, "timestamp_epoch": "1575414489.707149000" }, { "kind": "tls_client_hello", "dst_ip": "3.83.197.207", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "dull.bankofamerica.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-53d5a02000e7eb1d272b2fdb", "src_port": 49625, "tcp_stream": 453, "udp_stream": null, "frame_number": 17503, "timestamp_epoch": "1575414489.707359000" }, { "kind": "tls_client_hello", "dst_ip": "52.202.55.102", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "aero.bankofamerica.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-dfa3a786adc3dfed0d0f61e6", "src_port": 49631, "tcp_stream": 459, "udp_stream": null, "frame_number": 17521, "timestamp_epoch": "1575414489.714009000" }, { "kind": "tls_client_hello", "dst_ip": "54.175.7.235", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "boss.bankofamerica.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-f4864e1a53a4e6172fee7e27", "src_port": 49629, "tcp_stream": 457, "udp_stream": null, "frame_number": 17523, "timestamp_epoch": "1575414489.714291000" }, { "kind": "tls_client_hello", "dst_ip": "171.161.198.200", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "secure.bankofamerica.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-a21a7afbde1b82997541c49d", "src_port": 49627, "tcp_stream": 455, "udp_stream": null, "frame_number": 17525, "timestamp_epoch": "1575414489.714375000" }, { "kind": "tls_client_hello", "dst_ip": "52.202.55.102", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "aero.bankofamerica.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-aa2ac3725523912cbbea8a44", "src_port": 49630, "tcp_stream": 458, "udp_stream": null, "frame_number": 17527, "timestamp_epoch": "1575414489.714501000" }, { "kind": "tls_client_hello", "dst_ip": "54.175.7.235", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "boss.bankofamerica.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-e3c403dfc6729eb75c96fdcb", "src_port": 49628, "tcp_stream": 456, "udp_stream": null, "frame_number": 17529, "timestamp_epoch": "1575414489.714649000" }, { "kind": "tls_client_hello", "dst_ip": "199.255.32.89", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sofa.bankofamerica.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-9b81a428e6089b3ba0db5b76", "src_port": 49636, "tcp_stream": 464, "udp_stream": null, "frame_number": 17654, "timestamp_epoch": "1575414489.980469000" }, { "kind": "tls_client_hello", "dst_ip": "18.214.122.84", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rail.bankofamerica.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-de2726138bb42567eda7a944", "src_port": 49633, "tcp_stream": 461, "udp_stream": null, "frame_number": 17656, "timestamp_epoch": "1575414489.980687000" }, { "kind": "tls_client_hello", "dst_ip": "18.214.122.84", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "rail.bankofamerica.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-26cdb406818a553631563fdc", "src_port": 49634, "tcp_stream": 462, "udp_stream": null, "frame_number": 17658, "timestamp_epoch": "1575414489.980891000" }, { "kind": "tls_client_hello", "dst_ip": "199.255.32.89", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "sofa.bankofamerica.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-749bb5d620b69a2e6999c442", "src_port": 49635, "tcp_stream": 463, "udp_stream": null, "frame_number": 17660, "timestamp_epoch": "1575414489.980961000" }, { "kind": "tls_client_hello", "dst_ip": "171.161.198.200", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "secure.bankofamerica.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-652c1b8c74a3e985973a66a3", "src_port": 49632, "tcp_stream": 460, "udp_stream": null, "frame_number": 17662, "timestamp_epoch": "1575414489.981171000" }, { "kind": "tls_client_hello", "dst_ip": "129.33.138.31", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "data.coremetrics.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-e409592878d777f7e9e1523d", "src_port": 49637, "tcp_stream": 465, "udp_stream": null, "frame_number": 18073, "timestamp_epoch": "1575414490.719140000" }, { "kind": "tls_client_hello", "dst_ip": "129.33.138.31", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "data.coremetrics.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-0adec5749a2543a20132fcc3", "src_port": 49638, "tcp_stream": 466, "udp_stream": null, "frame_number": 18077, "timestamp_epoch": "1575414490.735364000" }, { "kind": "tls_client_hello", "dst_ip": "54.175.7.235", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "boss.bankofamerica.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-1633ee2ba427da6a230a90b1", "src_port": 49641, "tcp_stream": 469, "udp_stream": null, "frame_number": 18379, "timestamp_epoch": "1575414491.316577000" }, { "kind": "tls_client_hello", "dst_ip": "54.175.7.235", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "boss.bankofamerica.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-cc5a6f891cdc8cc43a3898d7", "src_port": 49639, "tcp_stream": 467, "udp_stream": null, "frame_number": 18426, "timestamp_epoch": "1575414491.356015000" }, { "kind": "tls_client_hello", "dst_ip": "52.202.55.102", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "aero.bankofamerica.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-7f7f83ad77e1bf0522c93fef", "src_port": 49640, "tcp_stream": 468, "udp_stream": null, "frame_number": 18434, "timestamp_epoch": "1575414491.357363000" }, { "kind": "tls_client_hello", "dst_ip": "52.202.55.102", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "aero.bankofamerica.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-7b896be9f40f8e40edc943fa", "src_port": 49642, "tcp_stream": 470, "udp_stream": null, "frame_number": 18446, "timestamp_epoch": "1575414491.364631000" }, { "kind": "tls_client_hello", "dst_ip": "171.161.202.100", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.bankofamerica.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-3f62c9d3a49ab5fadd62dee2", "src_port": 49643, "tcp_stream": 471, "udp_stream": null, "frame_number": 18673, "timestamp_epoch": "1575414491.901387000" }, { "kind": "tls_client_hello", "dst_ip": "171.161.202.100", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.bankofamerica.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-3886c49c648c410ff98374fa", "src_port": 49644, "tcp_stream": 472, "udp_stream": null, "frame_number": 18675, "timestamp_epoch": "1575414491.901956000" }, { "kind": "tls_client_hello", "dst_ip": "54.175.7.235", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "boss.bankofamerica.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-da807e08c580bc138d005851", "src_port": 49645, "tcp_stream": 473, "udp_stream": null, "frame_number": 18871, "timestamp_epoch": "1575414493.185956000" }, { "kind": "tls_client_hello", "dst_ip": "54.175.7.235", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "boss.bankofamerica.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-911eadd7d48681781e70093a", "src_port": 49646, "tcp_stream": 474, "udp_stream": null, "frame_number": 18918, "timestamp_epoch": "1575414494.140958000" }, { "kind": "tls_client_hello", "dst_ip": "52.71.154.85", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "awuseb.advanced-web-analytics.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-a47bcf1e942575615f3a90c6", "src_port": 49648, "tcp_stream": 476, "udp_stream": null, "frame_number": 18928, "timestamp_epoch": "1575414494.321804000" }, { "kind": "tls_client_hello", "dst_ip": "52.71.154.85", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "awuseb.advanced-web-analytics.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-fb69477e0bd986b0fed2717c", "src_port": 49647, "tcp_stream": 475, "udp_stream": null, "frame_number": 18932, "timestamp_epoch": "1575414494.325959000" }, { "kind": "tls_client_hello", "dst_ip": "72.21.81.200", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "iecvlist.microsoft.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-c06d676eaf9deac62efb8aec", "src_port": 49649, "tcp_stream": 477, "udp_stream": null, "frame_number": 19408, "timestamp_epoch": "1575414513.780707000" }, { "kind": "tls_client_hello", "dst_ip": "72.21.81.200", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "iecvlist.microsoft.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-4cf2b0f6dcf8057296da077a", "src_port": 49650, "tcp_stream": 478, "udp_stream": null, "frame_number": 19410, "timestamp_epoch": "1575414513.781170000" }, { "kind": "tls_client_hello", "dst_ip": "66.235.147.244", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "bankofamerica.tt.omtrdc.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-a74fcb15901b4771ff9f4565", "src_port": 49652, "tcp_stream": 480, "udp_stream": null, "frame_number": 19717, "timestamp_epoch": "1575414520.904583000" }, { "kind": "tls_client_hello", "dst_ip": "66.235.147.244", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "bankofamerica.tt.omtrdc.net" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-95c9fa1a6d7bd40acda768a1", "src_port": 49651, "tcp_stream": 479, "udp_stream": null, "frame_number": 19719, "timestamp_epoch": "1575414520.904656000" }, { "kind": "tls_client_hello", "dst_ip": "52.202.55.102", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "aero.bankofamerica.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-be08a770fb6c6e96545257fa", "src_port": 49653, "tcp_stream": 481, "udp_stream": null, "frame_number": 20233, "timestamp_epoch": "1575414522.730039000" }, { "kind": "tls_client_hello", "dst_ip": "54.175.7.235", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "boss.bankofamerica.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-60aed4e6d35a9c6d35137520", "src_port": 49654, "tcp_stream": 482, "udp_stream": null, "frame_number": 20344, "timestamp_epoch": "1575414522.899753000" }, { "kind": "tls_client_hello", "dst_ip": "54.175.7.235", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "boss.bankofamerica.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-0953fe29c9b38d1d48b2f969", "src_port": 49655, "tcp_stream": 483, "udp_stream": null, "frame_number": 20371, "timestamp_epoch": "1575414523.032260000" }, { "kind": "tls_client_hello", "dst_ip": "54.175.7.235", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "boss.bankofamerica.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-82ce42646b29eb4973f05b13", "src_port": 49656, "tcp_stream": 484, "udp_stream": null, "frame_number": 20377, "timestamp_epoch": "1575414523.032855000" }, { "kind": "tls_client_hello", "dst_ip": "54.175.7.235", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "boss.bankofamerica.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-ecf837c4198bf4d18c0d1634", "src_port": 49657, "tcp_stream": 485, "udp_stream": null, "frame_number": 20564, "timestamp_epoch": "1575414523.405133000" }, { "kind": "tls_client_hello", "dst_ip": "52.202.55.102", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "aero.bankofamerica.com" }, "src_ip": "10.18.20.97", "dst_port": 443, "event_id": "evt-567df6ac3281d0a2888e4878", "src_port": 49658, "tcp_stream": 486, "udp_stream": null, "frame_number": 20567, "timestamp_epoch": "1575414523.405641000" } ], "unclassified_tcp": [ { "kind": "unclassified_tcp", "dst_ip": "10.18.20.97", "fields": { "tcp.payload": "00" }, "src_ip": "10.18.20.8", "dst_port": 49195, "event_id": "evt-02ca25efb971d61aa9b626bc", "src_port": 445, "tcp_stream": 15, "udp_stream": null, "frame_number": 12812, "timestamp_epoch": "1575413305.431008000" }, { "kind": "unclassified_tcp", "dst_ip": "10.18.20.97", "fields": { "tcp.payload": "00" }, "src_ip": "10.18.20.8", "dst_port": 49195, "event_id": "evt-78a4c640b3dd905a4607c608", "src_port": 445, "tcp_stream": 15, "udp_stream": null, "frame_number": 15282, "timestamp_epoch": "1575413425.443442000" }, { "kind": "unclassified_tcp", "dst_ip": "10.18.20.97", "fields": { "tcp.payload": "00" }, "src_ip": "10.18.20.8", "dst_port": 49195, "event_id": "evt-939f43bc19c3c37730d96041", "src_port": 445, "tcp_stream": 15, "udp_stream": null, "frame_number": 16254, "timestamp_epoch": "1575413545.455137000" }, { "kind": "unclassified_tcp", "dst_ip": "10.18.20.97", "fields": { "tcp.payload": "00" }, "src_ip": "10.18.20.8", "dst_port": 49195, "event_id": "evt-99e7a635c76e7a5a3628dfd5", "src_port": 445, "tcp_stream": 15, "udp_stream": null, "frame_number": 16277, "timestamp_epoch": "1575413665.466998000" }, { "kind": "unclassified_tcp", "dst_ip": "10.18.20.97", "fields": { "tcp.payload": "00" }, "src_ip": "10.18.20.8", "dst_port": 49195, "event_id": "evt-d1270af8f2013d6ce1b83a23", "src_port": 445, "tcp_stream": 15, "udp_stream": null, "frame_number": 16321, "timestamp_epoch": "1575413785.462556000" }, { "kind": "unclassified_tcp", "dst_ip": "10.18.20.97", "fields": { "tcp.payload": "00" }, "src_ip": "10.18.20.8", "dst_port": 49195, "event_id": "evt-fcca8f32bb455235ea628b7c", "src_port": 445, "tcp_stream": 15, "udp_stream": null, "frame_number": 16393, "timestamp_epoch": "1575413905.474940000" }, { "kind": "unclassified_tcp", "dst_ip": "10.18.20.97", "fields": { "tcp.payload": "00" }, "src_ip": "10.18.20.8", "dst_port": 49195, "event_id": "evt-a30f457d5e98977749407003", "src_port": 445, "tcp_stream": 15, "udp_stream": null, "frame_number": 16429, "timestamp_epoch": "1575414025.485965000" }, { "kind": "unclassified_tcp", "dst_ip": "10.18.20.97", "fields": { "tcp.payload": "00" }, "src_ip": "10.18.20.8", "dst_port": 49613, "event_id": "evt-547a463827365808586551a9", "src_port": 445, "tcp_stream": 441, "udp_stream": null, "frame_number": 16484, "timestamp_epoch": "1575414319.427163000" }, { "kind": "unclassified_tcp", "dst_ip": "10.18.20.97", "fields": { "tcp.payload": "00" }, "src_ip": "10.18.20.8", "dst_port": 49613, "event_id": "evt-fe7f469c7af67f671564e717", "src_port": 445, "tcp_stream": 441, "udp_stream": null, "frame_number": 16499, "timestamp_epoch": "1575414439.439432000" }, { "kind": "unclassified_tcp", "dst_ip": "10.18.20.97", "fields": { "tcp.payload": "00" }, "src_ip": "10.18.20.8", "dst_port": 49613, "event_id": "evt-ea65f8db59b753fbda0ca99d", "src_port": 445, "tcp_stream": 441, "udp_stream": null, "frame_number": 21096, "timestamp_epoch": "1575414559.451149000" }, { "kind": "unclassified_tcp", "dst_ip": "10.18.20.97", "fields": { "tcp.payload": "00" }, "src_ip": "10.18.20.8", "dst_port": 49613, "event_id": "evt-abb03cf5733d8e2cb34d5c7b", "src_port": 445, "tcp_stream": 441, "udp_stream": null, "frame_number": 21165, "timestamp_epoch": "1575414679.463953000" }, { "kind": "unclassified_tcp", "dst_ip": "10.18.20.97", "fields": { "tcp.payload": "00" }, "src_ip": "10.18.20.8", "dst_port": 49613, "event_id": "evt-e020da198f49e10062a38264", "src_port": 445, "tcp_stream": 441, "udp_stream": null, "frame_number": 21170, "timestamp_epoch": "1575414808.258457000" } ], "directory_service": [ { "kind": "directory_service", "dst_ip": "10.18.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-94f630ec5f9ad52db8d8e98d", "src_port": null, "tcp_stream": 0, "udp_stream": null, "frame_number": 4, "timestamp_epoch": "1575413096.036328000" }, { "kind": "directory_service", "dst_ip": "10.18.20.97", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-e12d5dc7d7dc90b3e2876ba0", "src_port": null, "tcp_stream": 0, "udp_stream": null, "frame_number": 6, "timestamp_epoch": "1575413096.036586000" }, { "kind": "directory_service", "dst_ip": "10.18.20.8", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-cf598a8be958486cabccbd71", "src_port": null, "tcp_stream": 0, "udp_stream": null, "frame_number": 9, "timestamp_epoch": "1575413096.038065000" }, { "kind": "directory_service", "dst_ip": "10.18.20.97", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-9b539d902de8b23c97e54f1e", "src_port": null, "tcp_stream": 0, "udp_stream": null, "frame_number": 11, "timestamp_epoch": "1575413096.038592000" }, { "kind": "directory_service", "dst_ip": "10.18.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-c76413869a8b61e4773efbee", "src_port": null, "tcp_stream": 0, "udp_stream": null, "frame_number": 12, "timestamp_epoch": "1575413096.039960000" }, { "kind": "directory_service", "dst_ip": "10.18.20.97", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-17d71cb1427dfeb7f69875d4", "src_port": null, "tcp_stream": 0, "udp_stream": null, "frame_number": 13, "timestamp_epoch": "1575413096.040103000" }, { "kind": "directory_service", "dst_ip": "10.18.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-a0aa00473fed401fe0c4ebda", "src_port": null, "tcp_stream": 0, "udp_stream": null, "frame_number": 14, "timestamp_epoch": "1575413096.040327000" }, { "kind": "directory_service", "dst_ip": "10.18.20.97", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-f1bc91235d1b498a40f8b0c8", "src_port": null, "tcp_stream": 0, "udp_stream": null, "frame_number": 15, "timestamp_epoch": "1575413096.040508000" }, { "kind": "directory_service", "dst_ip": "10.18.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=NTDS Settings,CN=ICEMAIDEN-DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=icemaiden,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-911b8c4077651cb4c92edeca", "src_port": null, "tcp_stream": 0, "udp_stream": null, "frame_number": 16, "timestamp_epoch": "1575413096.040717000" }, { "kind": "directory_service", "dst_ip": "10.18.20.97", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-8e3b0b44aead73a543ac8919", "src_port": null, "tcp_stream": 0, "udp_stream": null, "frame_number": 17, "timestamp_epoch": "1575413096.040930000" }, { "kind": "directory_service", "dst_ip": "10.18.20.8", "fields": { "ldap.filter": "3", "ldap.baseObject": "CN=Public Key Services,CN=Services,CN=Configuration,DC=icemaiden,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-c85b4f38b2dc4b1fba96e7ab", "src_port": null, "tcp_stream": 0, "udp_stream": null, "frame_number": 18, "timestamp_epoch": "1575413096.041143000" }, { "kind": "directory_service", "dst_ip": "10.18.20.97", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-e43e7a9aab0a24679632cc11", "src_port": null, "tcp_stream": 0, "udp_stream": null, "frame_number": 19, "timestamp_epoch": "1575413096.041757000" }, { "kind": "directory_service", "dst_ip": "10.18.20.8", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-2bced1bad4dd0432e4e94014", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 24, "timestamp_epoch": "1575413096.050082000" }, { "kind": "directory_service", "dst_ip": "10.18.20.97", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-b062555b4962bf67301f9c9d", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 26, "timestamp_epoch": "1575413096.050558000" }, { "kind": "directory_service", "dst_ip": "10.18.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-5f7ec09bb99441ddd788dd3d", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 27, "timestamp_epoch": "1575413096.050946000" }, { "kind": "directory_service", "dst_ip": "10.18.20.97", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-5b19b45ca74109ca7365745a", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 28, "timestamp_epoch": "1575413096.051063000" }, { "kind": "directory_service", "dst_ip": "10.18.20.8", "fields": { "ldap.filter": "3", "ldap.baseObject": "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=icemaiden,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-38fcb4c2c88bb5fc0db5712a", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 59, "timestamp_epoch": "1575413096.073224000" }, { "kind": "directory_service", "dst_ip": "10.18.20.97", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-bda03b23abe1dd4cfd961892", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 60, "timestamp_epoch": "1575413096.073860000" }, { "kind": "directory_service", "dst_ip": "10.18.20.8", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-6248556330be55af78cb56bc", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 61, "timestamp_epoch": "1575413096.074071000" }, { "kind": "directory_service", "dst_ip": "10.18.20.8", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-0ff89ecd0afe0be6cba017ab", "src_port": null, "tcp_stream": 0, "udp_stream": null, "frame_number": 63, "timestamp_epoch": "1575413096.074355000" }, { "kind": "directory_service", "dst_ip": "10.18.20.8", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-e920ea37a63166bd8ffb3506", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 141, "timestamp_epoch": "1575413122.244997000" }, { "kind": "directory_service", "dst_ip": "10.18.20.97", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-a1be79d4dbcf5066c2d951ea", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 142, "timestamp_epoch": "1575413122.245387000" }, { "kind": "directory_service", "dst_ip": "10.18.20.8", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-8ddcc1987a17d24ff1a51907", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 143, "timestamp_epoch": "1575413122.247853000" }, { "kind": "directory_service", "dst_ip": "10.18.20.97", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-db07357f1c6802b08fd3c2cc", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 144, "timestamp_epoch": "1575413122.248744000" }, { "kind": "directory_service", "dst_ip": "10.18.20.8", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-2456563366f6631c95487991", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 145, "timestamp_epoch": "1575413122.249629000" }, { "kind": "directory_service", "dst_ip": "10.18.20.97", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-6a0da94ed029678362458064", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 146, "timestamp_epoch": "1575413122.250152000" }, { "kind": "directory_service", "dst_ip": "10.18.20.8", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-a6d911c327203a7f5350408a", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 147, "timestamp_epoch": "1575413122.250377000" }, { "kind": "directory_service", "dst_ip": "10.18.20.97", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-4b5450f16be11f21f15b9240", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 148, "timestamp_epoch": "1575413122.250622000" }, { "kind": "directory_service", "dst_ip": "10.18.20.8", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-ef89f5d963fcd4e672acf0ad", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 215, "timestamp_epoch": "1575413122.769613000" }, { "kind": "directory_service", "dst_ip": "10.18.20.97", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-405c3955ac02aee814b7f12c", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 217, "timestamp_epoch": "1575413122.770131000" }, { "kind": "directory_service", "dst_ip": "10.18.20.8", "fields": { "ldap.filter": "1", "ldap.baseObject": "DC=icemaiden,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-b614ac6514e863deb3b1233a", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 218, "timestamp_epoch": "1575413122.772225000" }, { "kind": "directory_service", "dst_ip": "10.18.20.97", "fields": { "ldap.protocolOp": "4,19,19,19,5" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-075137a11615c9b75cdeef91", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 219, "timestamp_epoch": "1575413122.772469000" }, { "kind": "directory_service", "dst_ip": "10.18.20.8", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-74db6615cd314d471817768b", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 224, "timestamp_epoch": "1575413122.776163000" }, { "kind": "directory_service", "dst_ip": "10.18.20.97", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-cf116b76655d46d018814a7d", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 226, "timestamp_epoch": "1575413122.776674000" }, { "kind": "directory_service", "dst_ip": "10.18.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-653fe8ecbdcf147d5e2c8af1", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 227, "timestamp_epoch": "1575413122.777076000" }, { "kind": "directory_service", "dst_ip": "10.18.20.97", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-e575f0e5986156e49d428d5c", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 228, "timestamp_epoch": "1575413122.777238000" }, { "kind": "directory_service", "dst_ip": "10.18.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=icemaiden,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-87c47822450b4b8e25870c98", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 229, "timestamp_epoch": "1575413122.777432000" }, { "kind": "directory_service", "dst_ip": "10.18.20.97", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-0d0b855f6b49003dec2e7372", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 230, "timestamp_epoch": "1575413122.777674000" }, { "kind": "directory_service", "dst_ip": "10.18.20.8", "fields": { "ldap.filter": "1", "ldap.baseObject": "cn=policies,cn=system,DC=icemaiden,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-f6a7a6eb5d29b1da786c6a6c", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 231, "timestamp_epoch": "1575413122.777880000" }, { "kind": "directory_service", "dst_ip": "10.18.20.97", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.18.20.8", "dst_port": null, "event_id": "evt-9e801d534c5d7d638e3f56a3", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 232, "timestamp_epoch": "1575413122.778173000" }, { "kind": "directory_service", "dst_ip": "10.18.20.8", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-4d95cdef0e7616b83c2e473b", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 249, "timestamp_epoch": "1575413122.785033000" }, { "kind": "directory_service", "dst_ip": "10.18.20.8", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.18.20.97", "dst_port": null, "event_id": "evt-5824f73a773bcc0235fff91d", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 254, "timestamp_epoch": "1575413123.294324000" } ] }, "capture": { "format": "pcap-le-microsecond", "packet_count": 21171, "interface_ids": [], "source_sha256": "01da378585edbbc7d97e9cd91418a50cc506468d615ff0002b7f4bc34e0cbe0a", "captured_bytes": 10713573, "protocol_counts": { "ip": 21171, "dns": 379, "eth": 21171, "ntp": 2, "png": 1, "smb": 2, "tcp": 20763, "tls": 5781, "udp": 406, "data": 23, "dhcp": 2, "http": 55, "igmp": 4, "ldap": 35, "nbns": 15, "nbss": 82, "smb2": 80, "ssdp": 6, "llmnr": 2, "media": 6, "dcerpc": 24, "pkcs-1": 58, "spnego": 26, "x509ce": 5569, "gss-api": 42, "x509sat": 6749, "kerberos": 20, "ethertype": 21171, "spnego-krb5": 61, "pkix1explicit": 617, "pkix1implicit": 754, "mime_multipart": 4, "data-text-lines": 8 }, "duration_seconds": 1712.223434, "last_packet_epoch": "1575414808.259047", "source_size_bytes": 11052333, "first_packet_epoch": "1575413096.035613", "encapsulation_types": [ 1 ] }, "summary": "Decoded 21171 packets across 123 IP endpoints and 683 transport flows. Observed 379 DNS events, 33 HTTP requests, 423 TLS ClientHello events, and 18 recovered file/message object(s). Deterministic rules produced 4 finding(s): 0 high, 0 medium, and 4 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "coverage": { "warnings": [], "limitations": [ "Encrypted application contents are not decrypted", "Protocol decoding and heuristic findings do not establish malware family or attribution", "No endpoint execution, persistence, or credential-theft proof without corresponding evidence" ], "event_limits": { "dns": { "returned": 379, "truncated": false }, "dhcp": { "returned": 2, "truncated": false }, "smtp": { "returned": 0, "truncated": false }, "identity": { "returned": 128, "truncated": false }, "http_request": { "returned": 33, "truncated": false }, "http_response": { "returned": 28, "truncated": false }, "tls_client_hello": { "returned": 423, "truncated": false }, "unclassified_tcp": { "returned": 12, "truncated": false }, "directory_service": { "returned": 42, "truncated": false } }, "http_objects": { "complete": true, "selection": "content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index", "hashed_bytes": 760640, "export_status": "completed", "unique_hashes": 18, "hashed_objects": 36, "compact_objects": 0, "detailed_objects": 18, "exported_objects": 36, "unhashed_objects": 0, "compact_hash_index": [], "omitted_unique_hashes": 0, "returned_unique_hashes": 18 }, "name_resolution": false, "supplemental_objects": { "scope": "bounded IMF, inert embedded base64 and complete contiguous HTTP response recovery", "returned": 0 }, "complete_within_profile": true, "encrypted_payload_visibility": "metadata-only" }, "findings": [ { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.18.20.8", "protocol": "drsuapi", "destination": "10.18.20.97", "event_count": 4, "operation_numbers": [ "0", "1", "12" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 14, "frame_number": 142, "display_filter": "frame.number == 142", "timestamp_epoch": "1575413122.245387000" }, { "tcp_stream": 14, "frame_number": 144, "display_filter": "frame.number == 144", "timestamp_epoch": "1575413122.248744000" }, { "tcp_stream": 14, "frame_number": 146, "display_filter": "frame.number == 146", "timestamp_epoch": "1575413122.250152000" }, { "tcp_stream": 14, "frame_number": 148, "display_filter": "frame.number == 148", "timestamp_epoch": "1575413122.250622000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-79b5d68a2d1e473b9f7c5395", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.18.20.8", "protocol": "ldap", "destination": "10.18.20.97", "event_count": 15, "operation_numbers": [ "1", "4,19,19,19,5", "4,5", "5" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 0, "frame_number": 6, "display_filter": "frame.number == 6", "timestamp_epoch": "1575413096.036586000" }, { "tcp_stream": 0, "frame_number": 11, "display_filter": "frame.number == 11", "timestamp_epoch": "1575413096.038592000" }, { "tcp_stream": 0, "frame_number": 13, "display_filter": "frame.number == 13", "timestamp_epoch": "1575413096.040103000" }, { "tcp_stream": 0, "frame_number": 15, "display_filter": "frame.number == 15", "timestamp_epoch": "1575413096.040508000" }, { "tcp_stream": 0, "frame_number": 17, "display_filter": "frame.number == 17", "timestamp_epoch": "1575413096.040930000" }, { "tcp_stream": 0, "frame_number": 19, "display_filter": "frame.number == 19", "timestamp_epoch": "1575413096.041757000" }, { "tcp_stream": 1, "frame_number": 26, "display_filter": "frame.number == 26", "timestamp_epoch": "1575413096.050558000" }, { "tcp_stream": 1, "frame_number": 28, "display_filter": "frame.number == 28", "timestamp_epoch": "1575413096.051063000" }, { "tcp_stream": 1, "frame_number": 60, "display_filter": "frame.number == 60", "timestamp_epoch": "1575413096.073860000" }, { "tcp_stream": 18, "frame_number": 217, "display_filter": "frame.number == 217", "timestamp_epoch": "1575413122.770131000" }, { "tcp_stream": 18, "frame_number": 219, "display_filter": "frame.number == 219", "timestamp_epoch": "1575413122.772469000" }, { "tcp_stream": 20, "frame_number": 226, "display_filter": "frame.number == 226", "timestamp_epoch": "1575413122.776674000" }, { "tcp_stream": 20, "frame_number": 228, "display_filter": "frame.number == 228", "timestamp_epoch": "1575413122.777238000" }, { "tcp_stream": 20, "frame_number": 230, "display_filter": "frame.number == 230", "timestamp_epoch": "1575413122.777674000" }, { "tcp_stream": 18, "frame_number": 232, "display_filter": "frame.number == 232", "timestamp_epoch": "1575413122.778173000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-53ea8ee6b528ae71d4383723", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.18.20.97", "protocol": "drsuapi", "destination": "10.18.20.8", "event_count": 4, "operation_numbers": [ "0", "1", "12" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 14, "frame_number": 141, "display_filter": "frame.number == 141", "timestamp_epoch": "1575413122.244997000" }, { "tcp_stream": 14, "frame_number": 143, "display_filter": "frame.number == 143", "timestamp_epoch": "1575413122.247853000" }, { "tcp_stream": 14, "frame_number": 145, "display_filter": "frame.number == 145", "timestamp_epoch": "1575413122.249629000" }, { "tcp_stream": 14, "frame_number": 147, "display_filter": "frame.number == 147", "timestamp_epoch": "1575413122.250377000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-72107aa073ef73382cd79619", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.18.20.97", "protocol": "ldap", "destination": "10.18.20.8", "event_count": 19, "operation_numbers": [ "0", "2", "3" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 0, "frame_number": 4, "display_filter": "frame.number == 4", "timestamp_epoch": "1575413096.036328000" }, { "tcp_stream": 0, "frame_number": 9, "display_filter": "frame.number == 9", "timestamp_epoch": "1575413096.038065000" }, { "tcp_stream": 0, "frame_number": 12, "display_filter": "frame.number == 12", "timestamp_epoch": "1575413096.039960000" }, { "tcp_stream": 0, "frame_number": 14, "display_filter": "frame.number == 14", "timestamp_epoch": "1575413096.040327000" }, { "tcp_stream": 0, "frame_number": 16, "display_filter": "frame.number == 16", "timestamp_epoch": "1575413096.040717000" }, { "tcp_stream": 0, "frame_number": 18, "display_filter": "frame.number == 18", "timestamp_epoch": "1575413096.041143000" }, { "tcp_stream": 1, "frame_number": 24, "display_filter": "frame.number == 24", "timestamp_epoch": "1575413096.050082000" }, { "tcp_stream": 1, "frame_number": 27, "display_filter": "frame.number == 27", "timestamp_epoch": "1575413096.050946000" }, { "tcp_stream": 1, "frame_number": 59, "display_filter": "frame.number == 59", "timestamp_epoch": "1575413096.073224000" }, { "tcp_stream": 1, "frame_number": 61, "display_filter": "frame.number == 61", "timestamp_epoch": "1575413096.074071000" }, { "tcp_stream": 0, "frame_number": 63, "display_filter": "frame.number == 63", "timestamp_epoch": "1575413096.074355000" }, { "tcp_stream": 18, "frame_number": 215, "display_filter": "frame.number == 215", "timestamp_epoch": "1575413122.769613000" }, { "tcp_stream": 18, "frame_number": 218, "display_filter": "frame.number == 218", "timestamp_epoch": "1575413122.772225000" }, { "tcp_stream": 20, "frame_number": 224, "display_filter": "frame.number == 224", "timestamp_epoch": "1575413122.776163000" }, { "tcp_stream": 20, "frame_number": 227, "display_filter": "frame.number == 227", "timestamp_epoch": "1575413122.777076000" }, { "tcp_stream": 20, "frame_number": 229, "display_filter": "frame.number == 229", "timestamp_epoch": "1575413122.777432000" }, { "tcp_stream": 18, "frame_number": 231, "display_filter": "frame.number == 231", "timestamp_epoch": "1575413122.777880000" }, { "tcp_stream": 20, "frame_number": 249, "display_filter": "frame.number == 249", "timestamp_epoch": "1575413122.785033000" }, { "tcp_stream": 18, "frame_number": 254, "display_filter": "frame.number == 254", "timestamp_epoch": "1575413123.294324000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-2d54f222e676c2fef177f646", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" } ], "artifacts": [ { "md5": "16b183514996887bc3e3048bedafd87a", "sha1": "d13e845694be72d8a62e1bb7af710b4c2bf8465c", "type": "http-exported-object", "sha256": "0b504e7f3cec848c7a1c25720cc40e7fd6919e217b4f56e50f645bda49259a39", "evidence": [ { "tcp_stream": 422, "frame_number": 15940, "display_filter": "frame.number == 15940", "timestamp_epoch": "1575413432.819653000" } ], "filename": "JSHmUi", "filenames": [ "JSHmUi" ], "transfers": [ { "url": "http://w8.wensa.at/api1/I01zepn8d/lW8zbbQjFkfEikrpMjIM/BUpAeRTlHQ4bvFyNQ5b/QJQiaBloENVY8vhKyUyE0o/DlBxOkmYhfcXF/f83ZepX0/p4w8NwGSdWiq2d0xSm7dQRx/c9TVoEwwGP/q1ZfqVF4Kk65L3fk5/ZmA_2F4e_2Fz/EA15GMwiWYS/dM6cnd6KMsJ08_/2FGuylglowKzvlAqp_2B7/1F_2FeKeSZFlbTaP/MX93YLJkZgekq1k/2ECfT2iPz4_2FLNdDL/PjdGytsj5/j_2BwGYOG_0A_0DWVnLJ/lblBYSp5hbm4QlU/JSHmUi", "client_ip": "10.18.20.97", "server_ip": "8.208.24.139", "tcp_stream": 422, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 15581, "response_frame": 15940 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 327092, "artifact_id": "artifact-07496ef35de9b4e366eb98f4", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "3bbf78b6d010c727ca7932776c2cb01a", "sha1": "4c758999f8f453338ecc4c7b8423354393195458", "type": "http-exported-object", "sha256": "cf63a226cdfefcc50f0ebd036df2729d1a6493cac1a5b814eec81ce4eed0f948", "evidence": [ { "tcp_stream": 420, "frame_number": 15565, "display_filter": "frame.number == 15565", "timestamp_epoch": "1575413427.756012000" } ], "filename": "2", "filenames": [ "2" ], "transfers": [ { "url": "http://w8.wensa.at/api1/PUbKL64xdNDApQ_2FhOvR/PzVuL7v93RbB1xfc/OEnwN9VtRcH8Ccu/jPgnw0d37uDEzDiVOf/KHgo0k5Uc/k6JCnK_2FBZ4yd9zeeiC/VpJpc2JMgFpc_2BUK2N/MNdoh0fThkbLeh37DCpXrm/guVivsIWc_2FM/aKnRfxy_/2FhTlme15XsXbjEQesbQbAJ/Z9BLtjy3Zi/ZcwiqStUG_2BZapZN/hqA8oHVvfrmy/sqq6RrFWUhE/NiEXX3DV0k2wcp/3ypM4pRUl6ezpp8W_0A_0/Dq6VuunS4q_2BKna/0dWjHSjvGD9y/2", "client_ip": "10.18.20.97", "server_ip": "8.208.24.139", "tcp_stream": 420, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 15288, "response_frame": 15565 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 260872, "artifact_id": "artifact-e02909a2f42cc5a63eea5334", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 260872, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 260872, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "734a5661b2e66e8bf5775eb104ad9ec3", "sha1": "29bcf5a91dc0c57a1f63bc821d7d0604e53a15de", "type": "http-exported-object", "sha256": "1f0bad278e2bf2f41979f2144a94cb85ac19d93abd041230b236463a992d9190", "evidence": [ { "tcp_stream": 426, "frame_number": 16124, "display_filter": "frame.number == 16124", "timestamp_epoch": "1575413441.877000000" } ], "filename": "t64.dat", "filenames": [ "t64.dat" ], "transfers": [ { "url": "http://api2.casus.at/jvassets/xI/t64.dat", "client_ip": "10.18.20.97", "server_ip": "8.208.24.139", "tcp_stream": 426, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 15971, "response_frame": 16124 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 138820, "artifact_id": "artifact-66aa33ca20cdbc4b456549e7", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 138820, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 138820, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "dd76eb0d848c9b3c9c9719049ee91a38", "sha1": "1b347332e5bbb4081cebdcbe7366a73cfaa6e4f4", "type": "http-exported-object", "sha256": "8bbbecf9c7b14eab33a19f0ab1529dd595dbd2ba51ef0dab65201aef80ce18b6", "evidence": [], "filename": "beBzLG", "filenames": [ "beBzLG" ], "transfers": [], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 23137, "artifact_id": "artifact-47e273b832279271c2b9e942", "occurrences": 1, "completeness": "unknown", "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 23137, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "c5884be3621775b99a38b617db6060c1", "sha1": "21b9614cbbf79437a0acb12672c0f7240b8ca57e", "type": "http-exported-object", "sha256": "a2f75fb154555d2877b0648f52b549a947b9c82bcff786d7c81ba712e9c3f3f8", "evidence": [ { "tcp_stream": 424, "frame_number": 15961, "display_filter": "frame.number == 15961", "timestamp_epoch": "1575413435.074577000" } ], "filename": "AEHAZk", "filenames": [ "AEHAZk" ], "transfers": [ { "url": "http://w8.wensa.at/api1/yHuijzBzQc46MJ8Hh_2B3To/h6eUe0SPQ_/2FyC9fDGgAdh4u0V0/Y_2F7w0Pe86d/_2FTkP74EP4/K1gu1U6e0AQB5l/cREXUjyc5L8u6LnRWbbL1/uRyhvKc_2FJntmF6/2AoYMEWtimRTV2a/PtgF_2F7ZN3svdTbI8/iP951uoBL/13G66amAYJslhDbJ9LRx/3TnU8ybVEHD70NlfPgK/H8jUEtFKAt07GB5iuDJECi/UWsRrR1g_2FwB/Fis0q36f/6B9w_2F9mwHOMRaRAywS_0A/_0DXkcCzh7/ICclVahOB309_2F/AEHAZk", "client_ip": "10.18.20.97", "server_ip": "8.208.24.139", "tcp_stream": 424, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 15956, "response_frame": 15961 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 2416, "artifact_id": "artifact-fe8140322946daa1f444d2e6", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2416, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 2416, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "db78cbd190952735d940bc80ac2432c0", "sha1": "eab040689a0d805b5d6fd654fc168cff00b78be3", "type": "http-exported-object", "sha256": "1a5174980a294a528a110726d5855650266c48d9883bea692b67b6d726da98c5", "evidence": [ { "tcp_stream": 254, "frame_number": 10693, "display_filter": "frame.number == 10693", "timestamp_epoch": "1575413267.344813000" }, { "tcp_stream": 253, "frame_number": 10698, "display_filter": "frame.number == 10698", "timestamp_epoch": "1575413267.351533000" } ], "filename": "USERTrustRSAAddTrustCA(1).crt", "filenames": [ "USERTrustRSAAddTrustCA(1).crt", "USERTrustRSAAddTrustCA.crt" ], "transfers": [ { "url": "http://crt.usertrust.com/USERTrustRSAAddTrustCA.crt", "client_ip": "10.18.20.97", "server_ip": "91.199.212.52", "tcp_stream": 254, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 10625, "response_frame": 10693 }, { "url": "http://crt.usertrust.com/USERTrustRSAAddTrustCA.crt", "client_ip": "10.18.20.97", "server_ip": "91.199.212.52", "tcp_stream": 253, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 10629, "response_frame": 10698 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 1403, "artifact_id": "artifact-fbeb839eb15457940bfef1c4", "occurrences": 2, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1403, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 1403, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "c5dfb849ca051355ee2dba1ac33eb028", "sha1": "d69b561148f01c77c54578c10926df5b856976ad", "type": "http-exported-object", "sha256": "cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b", "evidence": [ { "tcp_stream": 256, "frame_number": 10735, "display_filter": "frame.number == 10735", "timestamp_epoch": "1575413267.555745000" }, { "tcp_stream": 257, "frame_number": 10737, "display_filter": "frame.number == 10737", "timestamp_epoch": "1575413267.556050000" }, { "tcp_stream": 256, "frame_number": 10807, "display_filter": "frame.number == 10807", "timestamp_epoch": "1575413267.730057000" }, { "tcp_stream": 257, "frame_number": 10808, "display_filter": "frame.number == 10808", "timestamp_epoch": "1575413267.740194000" } ], "filename": "D69B561148F01C77C54578C10926DF5B856976AD(1).crt", "filenames": [ "D69B561148F01C77C54578C10926DF5B856976AD(1).crt", "D69B561148F01C77C54578C10926DF5B856976AD(2).crt", "D69B561148F01C77C54578C10926DF5B856976AD(3).crt", "D69B561148F01C77C54578C10926DF5B856976AD.crt" ], "transfers": [ { "url": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt", "client_ip": "10.18.20.97", "server_ip": "198.70.69.154", "tcp_stream": 256, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 10681, "response_frame": 10735 }, { "url": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt", "client_ip": "10.18.20.97", "server_ip": "198.70.69.154", "tcp_stream": 257, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 10684, "response_frame": 10737 }, { "url": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt", "client_ip": "10.18.20.97", "server_ip": "198.70.69.154", "tcp_stream": 256, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 10744, "response_frame": 10807 }, { "url": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt", "client_ip": "10.18.20.97", "server_ip": "198.70.69.154", "tcp_stream": 257, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 10746, "response_frame": 10808 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 867, "artifact_id": "artifact-29057cf771ad40b520934440", "occurrences": 4, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 867, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 867, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "2a64b4a8cfe95fbaebe9cd4a3a847c62", "sha1": "4c3abfe84c34632aacb5c201fc5faf5c59208fdf", "type": "http-exported-object", "sha256": "78f53c3a83a6e9d23f3903efc3a5635ea95fd21264ada13ebb8af23eb761fa40", "evidence": [], "filename": "XLm", "filenames": [ "XLm" ], "transfers": [], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 433, "artifact_id": "artifact-19a4163ca6388c8586d5d3ed", "occurrences": 1, "completeness": "unknown", "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 433, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "8e0fa72d4d0a797cfdc53604a2dd36ea", "sha1": "a40d03c3b5f1d2682a6a309ad8c53fd0506304f6", "type": "http-exported-object", "sha256": "a08902c478721cb65ddbb075d5dea373db29f80c15d67cdb23f25ebfb6284fc7", "evidence": [], "filename": "raR9XNN", "filenames": [ "raR9XNN" ], "transfers": [], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 433, "artifact_id": "artifact-fcaabc79c968320bffb0fcf2", "occurrences": 1, "completeness": "unknown", "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 433, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "56c081b271321855dcca5d63ce7330db", "sha1": "13f344d62c39fb6e7a49b5ca8486ab61417c502e", "type": "http-exported-object", "sha256": "c65cb1829bda38e033f2c42d891e2f0cf9cb5bf2352a74a05ffc27049a98cb56", "evidence": [ { "tcp_stream": 22, "frame_number": 283, "display_filter": "frame.number == 283", "timestamp_epoch": "1575413156.023372000" } ], "filename": "%2f", "filenames": [ "%2f" ], "transfers": [ { "url": "http://mail.aol.com/", "client_ip": "10.18.20.97", "server_ip": "69.147.64.34", "tcp_stream": 22, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "301", "completeness": "matches-declared-content-length", "request_frame": 281, "response_frame": 283 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 303, "artifact_id": "artifact-c251ce239835492f2587f2df", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 303, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 303, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "9fb559a691078558e77d6848202f6541", "sha1": "ea13848d33c2c7f4f4baa39348aeb1dbfad3df31", "type": "http-exported-object", "sha256": "6d8a01dc7647bc218d003b58fe04049e24a9359900b7e0cebae76edf85b8b914", "evidence": [ { "tcp_stream": 449, "frame_number": 17332, "display_filter": "frame.number == 17332", "timestamp_epoch": "1575414488.914065000" } ], "filename": "favicon(2).ico", "filenames": [ "favicon(2).ico" ], "transfers": [ { "url": "http://www.bing.com/favicon.ico", "client_ip": "10.18.20.97", "server_ip": "204.79.197.200", "tcp_stream": 449, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 17330, "response_frame": 17332 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/vnd.microsoft.icon", "size_bytes": 237, "artifact_id": "artifact-4b128524854467e005db487b", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 237, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 237, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "d239192a7dfc49fd6e19f7031fae9e63", "sha1": "2cc83e7767f4ab82af35c23ba7852722d0f9533f", "type": "http-exported-object", "sha256": "afb96043d1f8390179fe445d5063c434d4df10fa0194e7879ecadf4c9e8f9b78", "evidence": [], "filename": "5p6", "filenames": [ "5p6" ], "transfers": [], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 204, "artifact_id": "artifact-ec4c5ddc39f8a9983550e453", "occurrences": 1, "completeness": "unknown", "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 204, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "87bf2951d15ae3e3c9d78a886e3e75d3", "sha1": "76e47a8682455d2e891b901bba7d93e5f379454a", "type": "http-exported-object", "sha256": "5b80b1566219a6c3321b14127ebae23f73a18fd50a0751d2179e42d461e9ad39", "evidence": [ { "tcp_stream": 425, "frame_number": 16193, "display_filter": "frame.number == 16193", "timestamp_epoch": "1575413464.671303000" } ], "filename": "object16193.text%2fhtml", "filenames": [ "object16193.text%2fhtml" ], "transfers": [ { "url": "", "client_ip": "10.18.20.97", "server_ip": "8.208.24.139", "tcp_stream": 425, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "408", "completeness": "unknown", "request_frame": null, "response_frame": 16193 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 110, "artifact_id": "artifact-2f38cdf7c6feccecd1894123", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 110, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 110, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "ff4ed829ffd04e9c6095842b07d11f09", "sha1": "6fbe9df856956467c1691558796c86fc392ed5b6", "type": "http-exported-object", "sha256": "839488ebc08446a096a893996ed23eac321ac166724cd8c5d9092057834d2d79", "evidence": [ { "tcp_stream": 421, "frame_number": 15571, "display_filter": "frame.number == 15571", "timestamp_epoch": "1575413427.952035000" }, { "tcp_stream": 423, "frame_number": 15946, "display_filter": "frame.number == 15946", "timestamp_epoch": "1575413433.027454000" } ], "filename": "favicon(1).ico", "filenames": [ "favicon(1).ico", "favicon.ico" ], "transfers": [ { "url": "http://8.208.24.139/favicon.ico", "client_ip": "10.18.20.97", "server_ip": "8.208.24.139", "tcp_stream": 421, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "503", "completeness": "unknown", "request_frame": 15569, "response_frame": 15571 }, { "url": "http://8.208.24.139/favicon.ico", "client_ip": "10.18.20.97", "server_ip": "8.208.24.139", "tcp_stream": 423, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "503", "completeness": "unknown", "request_frame": 15944, "response_frame": 15946 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/vnd.microsoft.icon", "size_bytes": 107, "artifact_id": "artifact-05877ea4747fd1611d193472", "occurrences": 2, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 107, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 107, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "a631e8bb1a2ef64d137dc8fb41d0cda2", "sha1": "503e290715bf8ae66169754f06e4b1da1db433ac", "type": "http-exported-object", "sha256": "52307c67a1d0d310baf70fb8c346eb51856b73c08f9cf67535720b900023ee5e", "evidence": [], "filename": "V", "filenames": [ "V" ], "transfers": [], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 54, "artifact_id": "artifact-1c09f33e0a2d510b7ff632d3", "occurrences": 1, "completeness": "unknown", "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 54, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "2132892e423fd11073e100e9ec6e067f", "sha1": "e80ef447e8a4e09cdcf97cb2c7f71f56b3f5be03", "type": "http-exported-object", "sha256": "6c0c18274fed35e973d1c060f2f4137bb91444a78fbafd3be6c5f6d2f3cc63b8", "evidence": [ { "tcp_stream": 428, "frame_number": 16174, "display_filter": "frame.number == 16174", "timestamp_epoch": "1575413457.346663000" } ], "filename": "E(1)", "filenames": [ "E(1)" ], "transfers": [ { "url": "http://h1.wensa.at/api1/NdyKQBz2bkQyWRjW/DQxAC7LXQQhux0L/JG8Hy_2FKtggSPly52/OI_2Bww0d/GlhCZjLB1qzPFsZmpylg/Ms3wZA3Stl71Q46KRVb/iVLkW9gg4uKEOIATInV3zY/iLuKm_2BHFq5Q/sYBbWlUn/p_2BS4xgcBhCn0_2FVa5JBR/FwZ3dNRALU/50_2FvcGyN_2Bi_2F/gT8JmJY_2Frd/Lwf2Rf9oDBS/vn2noKvqMLt20R/8_2Fy946FBaM8_2F1ADOd/yK0bIHFjspZwtBHx/YHVqsuHv6P_0A_0/Dv9mhzaFuIXiIwIFNV/J7o6OM2pj/ergUZu91KSmAuKhCbtY2/Z7AlSzdNRd_2F_2BrH8/VYH_2BmX/E", "client_ip": "10.18.20.97", "server_ip": "8.208.24.139", "tcp_stream": 428, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 16166, "response_frame": 16174 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 33, "artifact_id": "artifact-65c4480873cbc52b79fe80b4", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 33, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 33, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "81051bcc2cf1bedf378224b0a93e2877", "sha1": "ba8ab5a0280b953aa97435ff8946cbcbb2755a27", "type": "http-exported-object", "sha256": "7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6", "evidence": [], "filename": "E", "filenames": [ "E", "Faz2p", "_2B", "wV" ], "transfers": [], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 2, "artifact_id": "artifact-6dbcb501624c89d018ca9e8d", "occurrences": 4, "completeness": "unknown", "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 2, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "d41d8cd98f00b204e9800998ecf8427e", "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "type": "http-exported-object", "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "evidence": [], "filename": "5p6(1)", "filenames": [ "5p6(1)", "7Z", "9WN9Wa", "A", "Faz2p(1)", "V(1)", "XLm(1)", "_2B(1)", "beBzLG(1)", "raR9XNN(1)", "wV(1)" ], "transfers": [], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 0, "artifact_id": "artifact-c146dc343107fc043d16ba83", "occurrences": 11, "completeness": "unknown", "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 0, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false } ], "endpoints": [ { "ip": "10.18.20.255", "bytes_sent": 0, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-53989d15b433dbcc81d02b9e", "packets_sent": 0, "mac_addresses": [ "ff:ff:ff:ff:ff:ff" ], "bytes_received": 1380, "evidence_frames": [ 277, 302, 355, 7468, 7619 ], "last_seen_epoch": "1575414485.622146", "first_seen_epoch": "1575413155.774442", "packets_received": 15 }, { "ip": "10.18.20.8", "bytes_sent": 65562, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-49cab8d7d75f93c3cd0028b9", "packets_sent": 337, "mac_addresses": [ "bc:30:5b:12:a7:3a" ], "bytes_received": 67136, "evidence_frames": [ 1, 2, 3, 4, 5 ], "last_seen_epoch": "1575414808.259047", "first_seen_epoch": "1575413096.035613", "packets_received": 376 }, { "ip": "10.18.20.97", "bytes_sent": 1948620, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-9825cc17f096ce3d9c30a684", "packets_sent": 10369, "mac_addresses": [ "00:01:24:56:9b:cf" ], "bytes_received": 8764953, "evidence_frames": [ 1, 2, 3, 4, 5 ], "last_seen_epoch": "1575414808.259047", "first_seen_epoch": "1575413096.035613", "packets_received": 10802 }, { "ip": "104.17.119.107", "bytes_sent": 10420, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-8dcca38764e8c94885ab4664", "packets_sent": 22, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 2483, "evidence_frames": [ 13297, 13299, 13442, 13443, 13445 ], "last_seen_epoch": "1575413386.05483", "first_seen_epoch": "1575413306.272575", "packets_received": 25 }, { "ip": "104.193.80.60", "bytes_sent": 24002, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-c8d3e896ba64f1d3db99679a", "packets_sent": 40, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 4436, "evidence_frames": [ 13082, 13083, 13203, 13205, 13206 ], "last_seen_epoch": "1575413317.591633", "first_seen_epoch": "1575413306.075164", "packets_received": 40 }, { "ip": "104.254.148.196", "bytes_sent": 7210, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-656805143c5b59dd197dd17b", "packets_sent": 18, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 2214, "evidence_frames": [ 14068, 14069, 14127, 14128, 14131 ], "last_seen_epoch": "1575413385.785246", "first_seen_epoch": "1575413307.384663", "packets_received": 21 }, { "ip": "104.254.149.101", "bytes_sent": 11443, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-b2b2e1a5378a48ede8dfdd5b", "packets_sent": 37, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 6581, "evidence_frames": [ 9351, 9352, 9437, 9438, 9439 ], "last_seen_epoch": "1575413385.798239", "first_seen_epoch": "1575413262.659179", "packets_received": 44 }, { "ip": "104.36.113.17", "bytes_sent": 76126, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-19535f4c89748eb35f5a164b", "packets_sent": 228, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 63587, "evidence_frames": [ 10916, 10918, 10919, 10932, 10933 ], "last_seen_epoch": "1575413386.220019", "first_seen_epoch": "1575413268.263543", "packets_received": 248 }, { "ip": "104.36.113.23", "bytes_sent": 23440, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-9b38f9e14a071fc840154896", "packets_sent": 44, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 6206, "evidence_frames": [ 9935, 9936, 10019, 10021, 10022 ], "last_seen_epoch": "1575413386.289835", "first_seen_epoch": "1575413264.716577", "packets_received": 45 }, { "ip": "104.36.113.24", "bytes_sent": 21901, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-ef424320594fa776204e41e1", "packets_sent": 59, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 10430, "evidence_frames": [ 10927, 10928, 11046, 11049, 11050 ], "last_seen_epoch": "1575413386.185668", "first_seen_epoch": "1575413268.274693", "packets_received": 63 }, { "ip": "104.69.23.209", "bytes_sent": 876, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-21abe66efa75d41f3dbc6b74", "packets_sent": 8, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 890, "evidence_frames": [ 12833, 12838, 12947, 12948, 12949 ], "last_seen_epoch": "1575413390.74934", "first_seen_epoch": "1575413305.452503", "packets_received": 9 }, { "ip": "107.178.246.49", "bytes_sent": 8738, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-5522c65d2cc3724f387e3d81", "packets_sent": 22, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 2824, "evidence_frames": [ 14091, 14092, 14143, 14144, 14145 ], "last_seen_epoch": "1575413386.036658", "first_seen_epoch": "1575413307.407271", "packets_received": 24 }, { "ip": "107.23.73.96", "bytes_sent": 18357, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-09fb46835a864a9223a6c541", "packets_sent": 37, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 13403, "evidence_frames": [ 3796, 3797, 3798, 3799, 3800 ], "last_seen_epoch": "1575413302.734641", "first_seen_epoch": "1575413237.898751", "packets_received": 39 }, { "ip": "129.33.138.31", "bytes_sent": 8699, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-ba1ef1fadd8c24b59e762e6c", "packets_sent": 18, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 2501, "evidence_frames": [ 18069, 18070, 18071, 18072, 18073 ], "last_seen_epoch": "1575414533.925274", "first_seen_epoch": "1575414490.618237", "packets_received": 20 }, { "ip": "13.249.22.83", "bytes_sent": 10658, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-dc9726527f8887f00403f493", "packets_sent": 22, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 2607, "evidence_frames": [ 8205, 8206, 8227, 8228, 8230 ], "last_seen_epoch": "1575413302.650633", "first_seen_epoch": "1575413258.37194", "packets_received": 25 }, { "ip": "134.209.129.254", "bytes_sent": 7523, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-5829a8b9d4af387d32badae4", "packets_sent": 20, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 2467, "evidence_frames": [ 13345, 13346, 13575, 13576, 13577 ], "last_seen_epoch": "1575413385.785799", "first_seen_epoch": "1575413306.298351", "packets_received": 24 }, { "ip": "151.101.0.166", "bytes_sent": 9479, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-a80644bb30b717b7aadcef29", "packets_sent": 20, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 2395, "evidence_frames": [ 13338, 13339, 13545, 13546, 13547 ], "last_seen_epoch": "1575413386.061204", "first_seen_epoch": "1575413306.295359", "packets_received": 22 }, { "ip": "151.101.2.2", "bytes_sent": 12635, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-216ca7cf851459f052be41df", "packets_sent": 22, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 2499, "evidence_frames": [ 13309, 13312, 13489, 13490, 13495 ], "last_seen_epoch": "1575413386.06128", "first_seen_epoch": "1575413306.289689", "packets_received": 24 }, { "ip": "151.101.2.49", "bytes_sent": 24434, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-deff14acfe84878719d94e6a", "packets_sent": 45, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 5715, "evidence_frames": [ 10841, 10842, 10936, 10937, 10938 ], "last_seen_epoch": "1575413386.037919", "first_seen_epoch": "1575413267.870297", "packets_received": 46 }, { "ip": "151.101.66.49", "bytes_sent": 11953, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-486aa377f072fca6a249d732", "packets_sent": 22, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 2599, "evidence_frames": [ 14322, 14323, 14332, 14333, 14334 ], "last_seen_epoch": "1575413386.043455", "first_seen_epoch": "1575413308.124608", "packets_received": 24 }, { "ip": "152.195.14.41", "bytes_sent": 21990, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-e5e1517bd2e574dbc4ade217", "packets_sent": 47, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 5575, "evidence_frames": [ 1145, 1146, 1225, 1226, 1227 ], "last_seen_epoch": "1575413302.725232", "first_seen_epoch": "1575413163.523298", "packets_received": 48 }, { "ip": "152.195.32.163", "bytes_sent": 11042, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-4a926d7e0d8ecc13fbe377df", "packets_sent": 22, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 2353, "evidence_frames": [ 930, 932, 956, 957, 958 ], "last_seen_epoch": "1575413265.931271", "first_seen_epoch": "1575413162.913044", "packets_received": 24 }, { "ip": "152.195.55.192", "bytes_sent": 17698, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-29497714142209a584d117ee", "packets_sent": 26, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 2565, "evidence_frames": [ 4188, 4189, 4190, 4193, 4194 ], "last_seen_epoch": "1575413302.696303", "first_seen_epoch": "1575413244.608212", "packets_received": 28 }, { "ip": "152.199.24.48", "bytes_sent": 39342, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-36a33dadaa757cd474bf0d10", "packets_sent": 64, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 9231, "evidence_frames": [ 931, 933, 960, 961, 962 ], "last_seen_epoch": "1575413302.727769", "first_seen_epoch": "1575413162.9131", "packets_received": 67 }, { "ip": "152.199.6.11", "bytes_sent": 1093290, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-79d6e20d45149c7f99b4ee90", "packets_sent": 768, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 26642, "evidence_frames": [ 1073, 1074, 1075, 1077, 1079 ], "last_seen_epoch": "1575413265.931337", "first_seen_epoch": "1575413163.220576", "packets_received": 464 }, { "ip": "152.199.6.14", "bytes_sent": 59767, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-de24dc51a54edbede531fc7d", "packets_sent": 118, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 29191, "evidence_frames": [ 935, 936, 965, 968, 974 ], "last_seen_epoch": "1575413386.621459", "first_seen_epoch": "1575413162.916174", "packets_received": 118 }, { "ip": "152.199.6.24", "bytes_sent": 12384, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-9118692d1f5ebf7654d72d09", "packets_sent": 27, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 5914, "evidence_frames": [ 6900, 6901, 6928, 6929, 6930 ], "last_seen_epoch": "1575413302.6807", "first_seen_epoch": "1575413251.062513", "packets_received": 28 }, { "ip": "156.154.202.36", "bytes_sent": 10267, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-0a73a250ca81589508f51e16", "packets_sent": 21, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 2153, "evidence_frames": [ 2660, 2661, 2679, 2680, 2681 ], "last_seen_epoch": "1575413265.93123", "first_seen_epoch": "1575413167.212049", "packets_received": 21 }, { "ip": "162.125.8.1", "bytes_sent": 11960, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-76ce5ce8a7da0309452642fd", "packets_sent": 23, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 2922, "evidence_frames": [ 14420, 14421, 14422, 14423, 14424 ], "last_seen_epoch": "1575413385.782409", "first_seen_epoch": "1575413311.312691", "packets_received": 27 }, { "ip": "162.125.8.6", "bytes_sent": 190457, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-7da112719dfa5c782b62979c", "packets_sent": 149, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 9409, "evidence_frames": [ 14468, 14469, 14470, 14471, 14472 ], "last_seen_epoch": "1575413385.781746", "first_seen_epoch": "1575413312.489709", "packets_received": 152 }, { "ip": "169.62.192.207", "bytes_sent": 8215, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-8703dc1ed0a9028ed8532973", "packets_sent": 20, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 2277, "evidence_frames": [ 10856, 10857, 10952, 10953, 10954 ], "last_seen_epoch": "1575413302.558969", "first_seen_epoch": "1575413267.96656", "packets_received": 20 }, { "ip": "171.161.198.200", "bytes_sent": 999936, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-5f21a8a6d7f2493da709636d", "packets_sent": 791, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 94492, "evidence_frames": [ 16508, 16511, 16512, 16513, 16514 ], "last_seen_epoch": "1575414533.924762", "first_seen_epoch": "1575414483.777712", "packets_received": 714 }, { "ip": "171.161.202.100", "bytes_sent": 11887, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-38a1d97a4a5abddb676b8196", "packets_sent": 20, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 2791, "evidence_frames": [ 18645, 18646, 18669, 18670, 18671 ], "last_seen_epoch": "1575414515.502007", "first_seen_epoch": "1575414491.789118", "packets_received": 20 }, { "ip": "172.217.1.130", "bytes_sent": 121963, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-73ff5f23d85bc027e8afa513", "packets_sent": 144, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 15402, "evidence_frames": [ 7659, 7660, 7669, 7670, 7671 ], "last_seen_epoch": "1575413386.421601", "first_seen_epoch": "1575413255.125628", "packets_received": 147 }, { "ip": "172.217.12.38", "bytes_sent": 99196, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-9bae713488bc5f7094fb845f", "packets_sent": 149, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 17964, "evidence_frames": [ 1520, 1521, 2325, 2327, 2333 ], "last_seen_epoch": "1575413302.723316", "first_seen_epoch": "1575413164.467939", "packets_received": 145 }, { "ip": "172.217.12.65", "bytes_sent": 34038, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-5d76931863770a38e60047ff", "packets_sent": 39, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 3298, "evidence_frames": [ 7824, 7825, 7826, 7828, 7831 ], "last_seen_epoch": "1575413302.673038", "first_seen_epoch": "1575413255.916205", "packets_received": 33 }, { "ip": "172.217.12.67", "bytes_sent": 148660, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-8e11f7f6e8d25fc2e0fdab30", "packets_sent": 132, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 10840, "evidence_frames": [ 8616, 8617, 8618, 8619, 8620 ], "last_seen_epoch": "1575413302.640533", "first_seen_epoch": "1575413260.271627", "packets_received": 135 }, { "ip": "172.217.14.166", "bytes_sent": 25414, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-1611c169c2ed57021c4b815f", "packets_sent": 38, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 6273, "evidence_frames": [ 1070, 1071, 1076, 1078, 1088 ], "last_seen_epoch": "1575413302.721022", "first_seen_epoch": "1575413163.199111", "packets_received": 38 }, { "ip": "173.231.184.20", "bytes_sent": 29066, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-eacccd88d85f9c31a70cd51b", "packets_sent": 54, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 8582, "evidence_frames": [ 9991, 9992, 10089, 10095, 10101 ], "last_seen_epoch": "1575413385.793671", "first_seen_epoch": "1575413264.924775", "packets_received": 60 }, { "ip": "18.210.147.153", "bytes_sent": 12724, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-8c55e361c077d9c0a742fd60", "packets_sent": 26, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 3292, "evidence_frames": [ 9127, 9128, 9158, 9160, 9161 ], "last_seen_epoch": "1575413302.673254", "first_seen_epoch": "1575413262.267289", "packets_received": 27 }, { "ip": "18.214.122.84", "bytes_sent": 47437, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-be03d22aebb8457c0735eaf2", "packets_sent": 54, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 6314, "evidence_frames": [ 17387, 17388, 17645, 17646, 17650 ], "last_seen_epoch": "1575414533.924895", "first_seen_epoch": "1575414489.545722", "packets_received": 54 }, { "ip": "184.86.155.127", "bytes_sent": 13990, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-f58f23e79c96c476d73e4d0b", "packets_sent": 28, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 4914, "evidence_frames": [ 5074, 5075, 5106, 5107, 5108 ], "last_seen_epoch": "1575413302.691347", "first_seen_epoch": "1575413247.092475", "packets_received": 29 }, { "ip": "185.167.164.42", "bytes_sent": 15884, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-a42251769b3c921d23dd4ddb", "packets_sent": 48, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 7858, "evidence_frames": [ 9998, 9999, 10096, 10097, 10105 ], "last_seen_epoch": "1575413386.269891", "first_seen_epoch": "1575413264.96535", "packets_received": 50 }, { "ip": "192.184.69.225", "bytes_sent": 19060, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-a8fe1141cc55df3980f4885b", "packets_sent": 46, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 6982, "evidence_frames": [ 9361, 9362, 9475, 9476, 9477 ], "last_seen_epoch": "1575413385.797708", "first_seen_epoch": "1575413262.71874", "packets_received": 51 }, { "ip": "192.229.210.141", "bytes_sent": 40995, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-9bf2a6e8e87223c26e9b25c8", "packets_sent": 43, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 3432, "evidence_frames": [ 5227, 5229, 5354, 5355, 5357 ], "last_seen_epoch": "1575413302.691302", "first_seen_epoch": "1575413248.060648", "packets_received": 33 }, { "ip": "192.229.211.36", "bytes_sent": 1529316, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-2f65a248b98ae5fff578fc99", "packets_sent": 1245, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 92357, "evidence_frames": [ 4185, 4186, 4191, 4192, 4195 ], "last_seen_epoch": "1575413302.703539", "first_seen_epoch": "1575413244.60309", "packets_received": 1152 }, { "ip": "193.183.98.66", "bytes_sent": 3090, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-4b1d9120be0e754a02cdad5f", "packets_sent": 16, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 1138, "evidence_frames": [ 15280, 15281, 15575, 15576, 15950 ], "last_seen_epoch": "1575414669.784425", "first_seen_epoch": "1575413425.196289", "packets_received": 16 }, { "ip": "198.70.69.154", "bytes_sent": 7940, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-d742124904bff6f3ebfe611a", "packets_sent": 12, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 1528, "evidence_frames": [ 10621, 10622, 10678, 10679, 10680 ], "last_seen_epoch": "1575413327.736849", "first_seen_epoch": "1575413266.896164", "packets_received": 12 }, { "ip": "198.8.70.128", "bytes_sent": 7731, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-6650f3b30770791608ed81bc", "packets_sent": 19, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 2505, "evidence_frames": [ 9984, 9985, 10085, 10086, 10093 ], "last_seen_epoch": "1575413275.280382", "first_seen_epoch": "1575413264.914116", "packets_received": 18 }, { "ip": "199.255.32.89", "bytes_sent": 11510, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-91d378a843465fd2850b90a0", "packets_sent": 26, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 9282, "evidence_frames": [ 17390, 17391, 17644, 17647, 17649 ], "last_seen_epoch": "1575414533.925025", "first_seen_epoch": "1575414489.559231", "packets_received": 27 }, { "ip": "204.74.252.20", "bytes_sent": 13294, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-a67114a5de083ea74eadd9a1", "packets_sent": 26, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 3090, "evidence_frames": [ 13409, 13410, 13604, 13606, 13607 ], "last_seen_epoch": "1575413385.786534", "first_seen_epoch": "1575413306.387988", "packets_received": 29 }, { "ip": "204.79.197.200", "bytes_sent": 14427, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-59c9e9519b29cf6b88f8ec0c", "packets_sent": 25, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 2895, "evidence_frames": [ 12997, 12998, 13041, 13042, 13043 ], "last_seen_epoch": "1575414533.94663", "first_seen_epoch": "1575413305.911535", "packets_received": 29 }, { "ip": "205.180.86.172", "bytes_sent": 17900, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-a0afc4539d101663a8e266f0", "packets_sent": 42, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 6036, "evidence_frames": [ 10033, 10034, 10139, 10140, 10141 ], "last_seen_epoch": "1575413269.661554", "first_seen_epoch": "1575413265.133174", "packets_received": 48 }, { "ip": "208.67.222.222", "bytes_sent": 1032, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-dd10b91ea87de74e6c124631", "packets_sent": 10, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 838, "evidence_frames": [ 16132, 16133, 16134, 16135, 16136 ], "last_seen_epoch": "1575413459.051947", "first_seen_epoch": "1575413450.598824", "packets_received": 10 }, { "ip": "209.15.36.35", "bytes_sent": 8927, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-d0a3850a0d812eac76d98381", "packets_sent": 22, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 2826, "evidence_frames": [ 10854, 10855, 10968, 10970, 10972 ], "last_seen_epoch": "1575413302.485579", "first_seen_epoch": "1575413267.966393", "packets_received": 24 }, { "ip": "216.200.232.221", "bytes_sent": 17670, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-a2f2a5259e2ceb3e95d30255", "packets_sent": 46, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 7869, "evidence_frames": [ 9314, 9319, 9389, 9390, 9391 ], "last_seen_epoch": "1575413386.355459", "first_seen_epoch": "1575413262.642433", "packets_received": 46 }, { "ip": "216.58.193.130", "bytes_sent": 40531, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-e335a317e51fbca871e6c7ab", "packets_sent": 105, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 18431, "evidence_frames": [ 8203, 8204, 8222, 8223, 8224 ], "last_seen_epoch": "1575413386.500929", "first_seen_epoch": "1575413258.371356", "packets_received": 111 }, { "ip": "216.58.194.106", "bytes_sent": 10112, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-a6c7031d35c13b0d5349d706", "packets_sent": 20, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 2148, "evidence_frames": [ 8316, 8317, 8383, 8386, 8387 ], "last_seen_epoch": "1575413302.650257", "first_seen_epoch": "1575413258.768228", "packets_received": 21 }, { "ip": "224.0.0.22", "bytes_sent": 0, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-0ce597f83621922542ca5cd0", "packets_sent": 0, "mac_addresses": [ "01:00:5e:00:00:16" ], "bytes_received": 108, "evidence_frames": [ 3181, 3183 ], "last_seen_epoch": "1575413205.95621", "first_seen_epoch": "1575413205.85388", "packets_received": 2 }, { "ip": "224.0.0.252", "bytes_sent": 0, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-c5aa7683f2f4db663b4f74d8", "packets_sent": 0, "mac_addresses": [ "01:00:5e:00:00:fc" ], "bytes_received": 128, "evidence_frames": [ 16510, 16515 ], "last_seen_epoch": "1575414483.890674", "first_seen_epoch": "1575414483.793665", "packets_received": 2 }, { "ip": "23.11.217.11", "bytes_sent": 32813, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-621c645018cbdd139d4c0342", "packets_sent": 40, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 4975, "evidence_frames": [ 9346, 9349, 9416, 9418, 9419 ], "last_seen_epoch": "1575413302.604281", "first_seen_epoch": "1575413262.654712", "packets_received": 40 }, { "ip": "23.11.217.71", "bytes_sent": 82989, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-c382080586f354deda1cc6a8", "packets_sent": 155, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 27321, "evidence_frames": [ 9340, 9341, 9401, 9402, 9403 ], "last_seen_epoch": "1575413386.373846", "first_seen_epoch": "1575413262.649913", "packets_received": 165 }, { "ip": "23.11.218.15", "bytes_sent": 112516, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-86a33fb010b49ba27d410d72", "packets_sent": 118, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 19104, "evidence_frames": [ 7497, 7498, 7499, 7500, 7501 ], "last_seen_epoch": "1575413302.674945", "first_seen_epoch": "1575413254.366478", "packets_received": 106 }, { "ip": "23.67.118.68", "bytes_sent": 18523, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-075700b4ad4e14f83436ed01", "packets_sent": 28, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 2569, "evidence_frames": [ 8086, 8087, 8094, 8095, 8096 ], "last_seen_epoch": "1575413302.673082", "first_seen_epoch": "1575413257.989125", "packets_received": 28 }, { "ip": "23.67.120.135", "bytes_sent": 9622, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-1f2314673bfe0b27993cb557", "packets_sent": 24, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 2998, "evidence_frames": [ 13267, 13268, 13411, 13412, 13415 ], "last_seen_epoch": "1575413386.090759", "first_seen_epoch": "1575413306.259265", "packets_received": 24 }, { "ip": "23.7.93.115", "bytes_sent": 9760, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-4c1a21f4fa7bf299c879c805", "packets_sent": 22, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 3026, "evidence_frames": [ 13358, 13359, 13555, 13556, 13557 ], "last_seen_epoch": "1575413386.061338", "first_seen_epoch": "1575413306.308392", "packets_received": 22 }, { "ip": "239.255.255.250", "bytes_sent": 0, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-7ea48e2f5605c6c9ad92a8f4", "packets_sent": 0, "mac_addresses": [ "01:00:5e:7f:ff:fa" ], "bytes_received": 1050, "evidence_frames": [ 3182, 3184, 3199, 3218, 3498 ], "last_seen_epoch": "1575413212.187013", "first_seen_epoch": "1575413205.860754", "packets_received": 6 }, { "ip": "255.255.255.255", "bytes_sent": 0, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-fa82ac4ebd586bef2abe85ca", "packets_sent": 0, "mac_addresses": [ "ff:ff:ff:ff:ff:ff" ], "bytes_received": 342, "evidence_frames": [ 16506 ], "last_seen_epoch": "1575414483.749103", "first_seen_epoch": "1575414483.749103", "packets_received": 1 }, { "ip": "3.136.40.187", "bytes_sent": 10174, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-170a705914f6985b266e450d", "packets_sent": 25, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 6064, "evidence_frames": [ 2228, 2230, 2461, 2464, 2467 ], "last_seen_epoch": "1575413302.522959", "first_seen_epoch": "1575413165.993689", "packets_received": 28 }, { "ip": "3.218.16.73", "bytes_sent": 11618, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-1913cfb6948654a6933a0f52", "packets_sent": 26, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 6243, "evidence_frames": [ 4893, 4894, 4937, 4941, 4942 ], "last_seen_epoch": "1575413302.725172", "first_seen_epoch": "1575413246.305261", "packets_received": 27 }, { "ip": "3.220.227.225", "bytes_sent": 8770, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-02a52f47a13a37ee4b13506f", "packets_sent": 24, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 2531, "evidence_frames": [ 2560, 2568, 2593, 2595, 2601 ], "last_seen_epoch": "1575413265.780201", "first_seen_epoch": "1575413166.687838", "packets_received": 23 }, { "ip": "3.83.197.207", "bytes_sent": 211610, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-4c565cadc08606a1bd694a5a", "packets_sent": 379, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 258136, "evidence_frames": [ 17360, 17361, 17495, 17497, 17498 ], "last_seen_epoch": "1575414533.9245", "first_seen_epoch": "1575414489.335367", "packets_received": 338 }, { "ip": "34.193.46.35", "bytes_sent": 56671, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-4513c4af685545c18103a85b", "packets_sent": 161, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 43887, "evidence_frames": [ 9869, 9870, 9885, 9888, 9943 ], "last_seen_epoch": "1575413385.796712", "first_seen_epoch": "1575413264.519293", "packets_received": 172 }, { "ip": "34.204.232.247", "bytes_sent": 21657, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-1acc8b7dabe08358d059f10c", "packets_sent": 33, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 4950, "evidence_frames": [ 8010, 8011, 8026, 8027, 8028 ], "last_seen_epoch": "1575413302.696359", "first_seen_epoch": "1575413257.316959", "packets_received": 30 }, { "ip": "34.204.4.212", "bytes_sent": 13892, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-4e2374d6a4aa3045d1e2f3f7", "packets_sent": 36, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 6110, "evidence_frames": [ 9154, 9156, 9219, 9221, 9223 ], "last_seen_epoch": "1575413385.802973", "first_seen_epoch": "1575413262.342969", "packets_received": 41 }, { "ip": "34.231.235.125", "bytes_sent": 27579, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-01482f270bf1e99450212a1c", "packets_sent": 47, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 7919, "evidence_frames": [ 7234, 7235, 7383, 7385, 7386 ], "last_seen_epoch": "1575413385.805223", "first_seen_epoch": "1575413253.235795", "packets_received": 53 }, { "ip": "34.232.64.168", "bytes_sent": 20252, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-a8565904cdd33e5349171e8b", "packets_sent": 71, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 43133, "evidence_frames": [ 2216, 2217, 2444, 2446, 2447 ], "last_seen_epoch": "1575413302.522696", "first_seen_epoch": "1575413165.991177", "packets_received": 71 }, { "ip": "34.235.45.38", "bytes_sent": 12795, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-dfe9c7d8110fff57a4f4b4e6", "packets_sent": 25, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 2757, "evidence_frames": [ 10877, 10878, 10978, 10979, 10980 ], "last_seen_epoch": "1575413302.483211", "first_seen_epoch": "1575413268.026982", "packets_received": 28 }, { "ip": "35.169.207.73", "bytes_sent": 14184, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-b81e4aaa216fa890fbf14dd4", "packets_sent": 31, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 4996, "evidence_frames": [ 9986, 9987, 10087, 10088, 10099 ], "last_seen_epoch": "1575413302.489174", "first_seen_epoch": "1575413264.914259", "packets_received": 34 }, { "ip": "35.171.168.180", "bytes_sent": 12275, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-a3509b63b20abd2b8fdf95b9", "packets_sent": 22, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 3021, "evidence_frames": [ 7656, 7657, 7677, 7678, 7679 ], "last_seen_epoch": "1575413302.700222", "first_seen_epoch": "1575413255.099769", "packets_received": 24 }, { "ip": "35.186.239.238", "bytes_sent": 26974, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-f2439c6975b09f39ea1c2a0e", "packets_sent": 48, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 4884, "evidence_frames": [ 9980, 9981, 10036, 10038, 10041 ], "last_seen_epoch": "1575413386.246934", "first_seen_epoch": "1575413264.894692", "packets_received": 47 }, { "ip": "35.190.36.172", "bytes_sent": 26992, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-20183ccb162969e583087302", "packets_sent": 31, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 2729, "evidence_frames": [ 8644, 8645, 8671, 8672, 8673 ], "last_seen_epoch": "1575413302.64428", "first_seen_epoch": "1575413260.380433", "packets_received": 31 }, { "ip": "35.190.72.161", "bytes_sent": 9952, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-aeea5db76f61930d2d68f28e", "packets_sent": 21, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 2393, "evidence_frames": [ 8342, 8343, 8408, 8411, 8412 ], "last_seen_epoch": "1575413302.644627", "first_seen_epoch": "1575413258.874375", "packets_received": 21 }, { "ip": "35.207.24.140", "bytes_sent": 16894, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-b43b293da3fe23238ea9adac", "packets_sent": 26, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 3954, "evidence_frames": [ 13149, 13164, 13279, 13280, 13281 ], "last_seen_epoch": "1575413386.139295", "first_seen_epoch": "1575413306.126971", "packets_received": 28 }, { "ip": "35.211.144.153", "bytes_sent": 32299, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-f7968ac85b21f6bb1cf71349", "packets_sent": 59, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 10453, "evidence_frames": [ 9353, 9354, 9443, 9444, 9446 ], "last_seen_epoch": "1575413385.798707", "first_seen_epoch": "1575413262.659456", "packets_received": 65 }, { "ip": "37.157.6.246", "bytes_sent": 11465, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-0c4e2bde1f8c4a935e2f985a", "packets_sent": 24, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 2688, "evidence_frames": [ 3636, 3637, 3638, 3639, 3640 ], "last_seen_epoch": "1575413302.850872", "first_seen_epoch": "1575413213.480826", "packets_received": 25 }, { "ip": "38.67.14.233", "bytes_sent": 13488, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-79604e2abbe1dc42afd19dd4", "packets_sent": 24, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 2900, "evidence_frames": [ 10859, 10860, 10960, 10961, 10962 ], "last_seen_epoch": "1575413302.561332", "first_seen_epoch": "1575413267.969812", "packets_received": 26 }, { "ip": "50.116.194.21", "bytes_sent": 16364, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-31bf298023006917688a3bbe", "packets_sent": 44, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 6548, "evidence_frames": [ 9358, 9359, 9449, 9450, 9451 ], "last_seen_epoch": "1575413385.799191", "first_seen_epoch": "1575413262.703242", "packets_received": 48 }, { "ip": "50.57.31.206", "bytes_sent": 8984, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-f37f670b4ef6b6a0fbce0784", "packets_sent": 22, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 2704, "evidence_frames": [ 3574, 3575, 3576, 3577, 3578 ], "last_seen_epoch": "1575413302.727722", "first_seen_epoch": "1575413212.855957", "packets_received": 22 }, { "ip": "52.202.55.102", "bytes_sent": 327251, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-9ddeb9c64fe1653dbe714e29", "packets_sent": 410, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 128614, "evidence_frames": [ 17367, 17368, 17511, 17514, 17516 ], "last_seen_epoch": "1575414533.926151", "first_seen_epoch": "1575414489.353793", "packets_received": 361 }, { "ip": "52.54.122.125", "bytes_sent": 23949, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-653001c2ee0056fd0bd4c2b8", "packets_sent": 97, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 17213, "evidence_frames": [ 8081, 8082, 8102, 8103, 8104 ], "last_seen_epoch": "1575413385.803951", "first_seen_epoch": "1575413257.958736", "packets_received": 104 }, { "ip": "52.7.147.140", "bytes_sent": 15939, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-c4e8fc56d0da2b773cd4b839", "packets_sent": 42, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 5567, "evidence_frames": [ 9975, 9976, 10069, 10072, 10076 ], "last_seen_epoch": "1575413385.794913", "first_seen_epoch": "1575413264.860852", "packets_received": 47 }, { "ip": "52.71.154.85", "bytes_sent": 44194, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-cd0e9865f53bbe8d5304a934", "packets_sent": 50, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 4692, "evidence_frames": [ 18914, 18915, 18926, 18927, 18928 ], "last_seen_epoch": "1575414533.925743", "first_seen_epoch": "1575414494.107151", "packets_received": 44 }, { "ip": "52.72.249.172", "bytes_sent": 14761, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-2c19c6ae0868bf04a23db385", "packets_sent": 44, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 7339, "evidence_frames": [ 10816, 10817, 10908, 10911, 10915 ], "last_seen_epoch": "1575413386.205888", "first_seen_epoch": "1575413267.790494", "packets_received": 46 }, { "ip": "54.158.57.141", "bytes_sent": 36219, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-0b97fbf5932c35de4a63edab", "packets_sent": 140, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 36779, "evidence_frames": [ 9338, 9339, 9413, 9415, 9423 ], "last_seen_epoch": "1575413385.801913", "first_seen_epoch": "1575413262.649578", "packets_received": 154 }, { "ip": "54.175.7.235", "bytes_sent": 385373, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-39407e4b6380672b265de66a", "packets_sent": 557, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 233595, "evidence_frames": [ 17365, 17366, 17512, 17513, 17517 ], "last_seen_epoch": "1575414533.925996", "first_seen_epoch": "1575414489.353382", "packets_received": 488 }, { "ip": "54.175.88.188", "bytes_sent": 12759, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-3f62789fa1964ed674d51ca1", "packets_sent": 25, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 2657, "evidence_frames": [ 10994, 10995, 11183, 11185, 11186 ], "last_seen_epoch": "1575413302.48007", "first_seen_epoch": "1575413268.360108", "packets_received": 29 }, { "ip": "54.186.165.46", "bytes_sent": 9456, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-aa9554c650bf38c1ee11ee55", "packets_sent": 24, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 3134, "evidence_frames": [ 2704, 2705, 2761, 2762, 2763 ], "last_seen_epoch": "1575413265.778344", "first_seen_epoch": "1575413167.311943", "packets_received": 28 }, { "ip": "54.236.178.170", "bytes_sent": 12797, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-343099e881acf751776479f3", "packets_sent": 23, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 2867, "evidence_frames": [ 3838, 3839, 3840, 3841, 3842 ], "last_seen_epoch": "1575413302.521547", "first_seen_epoch": "1575413238.559304", "packets_received": 25 }, { "ip": "54.82.194.252", "bytes_sent": 12585, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-072a6796406d0355dfcd818f", "packets_sent": 23, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 2553, "evidence_frames": [ 13114, 13115, 13246, 13248, 13249 ], "last_seen_epoch": "1575413385.790057", "first_seen_epoch": "1575413306.10387", "packets_received": 26 }, { "ip": "54.84.47.220", "bytes_sent": 15167, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-b369d885a58362d4c61bff15", "packets_sent": 42, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 7649, "evidence_frames": [ 9335, 9337, 9405, 9406, 9407 ], "last_seen_epoch": "1575413385.800283", "first_seen_epoch": "1575413262.649028", "packets_received": 45 }, { "ip": "54.85.102.186", "bytes_sent": 13079, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-8f0fc149fd797fce89381656", "packets_sent": 22, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 2389, "evidence_frames": [ 10889, 10890, 11002, 11003, 11004 ], "last_seen_epoch": "1575413302.58108", "first_seen_epoch": "1575413268.087721", "packets_received": 24 }, { "ip": "66.218.84.42", "bytes_sent": 10749, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-5a91133ae667b74f8d0a97d2", "packets_sent": 30, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 14975, "evidence_frames": [ 645, 655, 657, 658, 659 ], "last_seen_epoch": "1575413302.77018", "first_seen_epoch": "1575413160.448329", "packets_received": 29 }, { "ip": "66.218.87.13", "bytes_sent": 47131, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-fd073d53e27fac5ce864dc9e", "packets_sent": 56, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 10582, "evidence_frames": [ 4923, 4924, 4967, 4968, 4969 ], "last_seen_epoch": "1575413265.776835", "first_seen_epoch": "1575413246.489429", "packets_received": 58 }, { "ip": "66.235.147.244", "bytes_sent": 12683, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-7882f2885bbfef4979b6dbcb", "packets_sent": 35, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 5820, "evidence_frames": [ 17336, 17337, 17355, 17356, 17357 ], "last_seen_epoch": "1575414533.924301", "first_seen_epoch": "1575414489.185579", "packets_received": 42 }, { "ip": "67.195.204.151", "bytes_sent": 116998, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-5fff2801c174b37920df2aeb", "packets_sent": 149, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 28256, "evidence_frames": [ 309, 310, 311, 312, 313 ], "last_seen_epoch": "1575413302.776514", "first_seen_epoch": "1575413156.735399", "packets_received": 152 }, { "ip": "69.147.64.34", "bytes_sent": 636692, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-d29ad4c2b0f315a2d677e999", "packets_sent": 664, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 105416, "evidence_frames": [ 278, 279, 280, 281, 282 ], "last_seen_epoch": "1575413936.170793", "first_seen_epoch": "1575413155.847475", "packets_received": 634 }, { "ip": "70.42.32.63", "bytes_sent": 8831, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-1439d5a7a7c0c04890e9e2c2", "packets_sent": 20, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 2425, "evidence_frames": [ 13286, 13287, 13487, 13488, 13492 ], "last_seen_epoch": "1575413385.78617", "first_seen_epoch": "1575413306.270835", "packets_received": 24 }, { "ip": "72.21.81.200", "bytes_sent": 124613, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-fbad37aa38176215d5aad07f", "packets_sent": 138, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 11665, "evidence_frames": [ 2903, 2905, 2906, 2907, 2908 ], "last_seen_epoch": "1575414533.946761", "first_seen_epoch": "1575413185.254028", "packets_received": 135 }, { "ip": "72.5.64.63", "bytes_sent": 648, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-86ef964759e56c9bbc9cdf35", "packets_sent": 12, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 776, "evidence_frames": [ 13319, 13320, 13526, 13540, 13884 ], "last_seen_epoch": "1575413309.349564", "first_seen_epoch": "1575413306.290616", "packets_received": 12 }, { "ip": "74.119.118.138", "bytes_sent": 6474, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-6fcb2890b0984bc3de39f427", "packets_sent": 20, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 2362, "evidence_frames": [ 10848, 10849, 10944, 10945, 10946 ], "last_seen_epoch": "1575413302.486334", "first_seen_epoch": "1575413267.948962", "packets_received": 23 }, { "ip": "74.6.138.72", "bytes_sent": 19956, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-31c5f3c45c2d9ce94301e58c", "packets_sent": 39, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 6447, "evidence_frames": [ 7142, 7143, 7183, 7184, 7185 ], "last_seen_epoch": "1575413302.725104", "first_seen_epoch": "1575413252.927375", "packets_received": 42 }, { "ip": "74.6.138.75", "bytes_sent": 21558, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-6af081a95ab9703b4126652f", "packets_sent": 53, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 10775, "evidence_frames": [ 9811, 9812, 9908, 9911, 9917 ], "last_seen_epoch": "1575413385.797195", "first_seen_epoch": "1575413264.126791", "packets_received": 60 }, { "ip": "76.13.32.137", "bytes_sent": 34549, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-cf19930013594cc2898c2130", "packets_sent": 57, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 9762, "evidence_frames": [ 8647, 8648, 8679, 8680, 8681 ], "last_seen_epoch": "1575413386.537648", "first_seen_epoch": "1575413260.433831", "packets_received": 64 }, { "ip": "8.208.24.139", "bytes_sent": 620104, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-a0f2d6e48eb5c7a6d310b01d", "packets_sent": 526, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 58805, "evidence_frames": [ 15284, 15285, 15286, 15287, 15288 ], "last_seen_epoch": "1575414671.928875", "first_seen_epoch": "1575413425.780261", "packets_received": 461 }, { "ip": "8.41.222.150", "bytes_sent": 12300, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-83d25428b8b82e570d548cee", "packets_sent": 22, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 3118, "evidence_frames": [ 13292, 13295, 13491, 13493, 13497 ], "last_seen_epoch": "1575413314.720431", "first_seen_epoch": "1575413306.272129", "packets_received": 21 }, { "ip": "91.199.212.52", "bytes_sent": 4224, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-f6f60101c25cdc98d8fb2048", "packets_sent": 12, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 958, "evidence_frames": [ 10538, 10539, 10623, 10624, 10625 ], "last_seen_epoch": "1575413273.541468", "first_seen_epoch": "1575413266.380633", "packets_received": 12 }, { "ip": "96.6.83.178", "bytes_sent": 7496, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-54be8e3466277ef9798ecec7", "packets_sent": 19, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 2127, "evidence_frames": [ 2672, 2673, 2683, 2685, 2687 ], "last_seen_epoch": "1575413265.931141", "first_seen_epoch": "1575413167.223809", "packets_received": 22 }, { "ip": "98.136.96.149", "bytes_sent": 25985, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-71f2e28953eede56f0b74444", "packets_sent": 45, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 8135, "evidence_frames": [ 6464, 6465, 6592, 6593, 6594 ], "last_seen_epoch": "1575413302.720034", "first_seen_epoch": "1575413250.07013", "packets_received": 43 }, { "ip": "98.137.155.9", "bytes_sent": 34077, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-85c144dc586ee8c729ae0a82", "packets_sent": 84, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 10020, "evidence_frames": [ 2225, 2227, 2231, 2232, 2233 ], "last_seen_epoch": "1575413302.749127", "first_seen_epoch": "1575413165.993412", "packets_received": 88 }, { "ip": "98.137.156.136", "bytes_sent": 38789, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-652a0a3eb65bcc47220e6722", "packets_sent": 60, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 12955, "evidence_frames": [ 353, 354, 356, 357, 358 ], "last_seen_epoch": "1575413241.48707", "first_seen_epoch": "1575413157.279503", "packets_received": 60 }, { "ip": "98.137.156.137", "bytes_sent": 63948, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-546d0517d096aec2f12cdb9a", "packets_sent": 142, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 51353, "evidence_frames": [ 653, 656, 669, 670, 674 ], "last_seen_epoch": "1575413265.782666", "first_seen_epoch": "1575413160.624563", "packets_received": 156 }, { "ip": "99.86.77.108", "bytes_sent": 8909, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-280e07dd13d7066b8c68a90c", "packets_sent": 22, "mac_addresses": [ "00:07:50:93:a6:84" ], "bytes_received": 2257, "evidence_frames": [ 2669, 2670, 2684, 2686, 2697 ], "last_seen_epoch": "1575413265.928002", "first_seen_epoch": "1575413167.222802", "packets_received": 22 } ], "identities": [ { "type": "account", "value": "JUANITA-WORK-PC$", "bindings": [ { "account": "", "owner_ip": "10.18.20.97", "frame_number": 32, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.18.20.8", "conversation_src": "10.18.20.97" }, { "account": "", "owner_ip": "10.18.20.97", "frame_number": 40, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.18.20.8", "conversation_src": "10.18.20.97" }, { "account": "", "owner_ip": "10.18.20.97", "frame_number": 42, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.18.20.97", "conversation_src": "10.18.20.8" }, { "account": "", "owner_ip": "10.18.20.97", "frame_number": 54, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.18.20.97", "conversation_src": "10.18.20.8" } ], "evidence": [ { "tcp_stream": 2, "frame_number": 32, "display_filter": "frame.number == 32", "timestamp_epoch": "1575413096.052549000" }, { "tcp_stream": 3, "frame_number": 40, "display_filter": "frame.number == 40", "timestamp_epoch": "1575413096.068791000" }, { "tcp_stream": 3, "frame_number": 42, "display_filter": "frame.number == 42", "timestamp_epoch": "1575413096.069357000" }, { "tcp_stream": 4, "frame_number": 54, "display_filter": "frame.number == 54", "timestamp_epoch": "1575413096.071249000" } ], "raw_values": [ "JUANITA-WORK-PC$" ], "identity_id": "identity-6d9e30c8fcee7fb94a00fa9c", "ip_addresses": [ "10.18.20.97" ], "mac_addresses": [ "00:01:24:56:9b:cf" ] }, { "type": "account", "value": "momia.juanita", "bindings": [ { "account": "", "owner_ip": "10.18.20.97", "frame_number": 89, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.18.20.8", "conversation_src": "10.18.20.97" }, { "account": "", "owner_ip": "10.18.20.97", "frame_number": 97, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.18.20.8", "conversation_src": "10.18.20.97" }, { "account": "", "owner_ip": "10.18.20.97", "frame_number": 99, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.18.20.97", "conversation_src": "10.18.20.8" }, { "account": "", "owner_ip": "10.18.20.97", "frame_number": 111, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.18.20.97", "conversation_src": "10.18.20.8" }, { "account": "", "owner_ip": "10.18.20.97", "frame_number": 130, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.18.20.97", "conversation_src": "10.18.20.8" }, { "account": "", "owner_ip": "10.18.20.97", "frame_number": 163, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.18.20.97", "conversation_src": "10.18.20.8" }, { "account": "", "owner_ip": "10.18.20.97", "frame_number": 175, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.18.20.97", "conversation_src": "10.18.20.8" }, { "account": "", "owner_ip": "10.18.20.97", "frame_number": 209, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.18.20.97", "conversation_src": "10.18.20.8" } ], "evidence": [ { "tcp_stream": 9, "frame_number": 89, "display_filter": "frame.number == 89", "timestamp_epoch": "1575413121.832216000" }, { "tcp_stream": 10, "frame_number": 97, "display_filter": "frame.number == 97", "timestamp_epoch": "1575413121.843796000" }, { "tcp_stream": 10, "frame_number": 99, "display_filter": "frame.number == 99", "timestamp_epoch": "1575413121.844620000" }, { "tcp_stream": 11, "frame_number": 111, "display_filter": "frame.number == 111", "timestamp_epoch": "1575413121.846043000" }, { "tcp_stream": 13, "frame_number": 130, "display_filter": "frame.number == 130", "timestamp_epoch": "1575413122.234609000" }, { "tcp_stream": 16, "frame_number": 163, "display_filter": "frame.number == 163", "timestamp_epoch": "1575413122.270169000" }, { "tcp_stream": 17, "frame_number": 175, "display_filter": "frame.number == 175", "timestamp_epoch": "1575413122.271201000" }, { "tcp_stream": 19, "frame_number": 209, "display_filter": "frame.number == 209", "timestamp_epoch": "1575413122.768900000" } ], "raw_values": [ "momia.juanita" ], "identity_id": "identity-d523bf030d121b54f401ab44", "ip_addresses": [ "10.18.20.97" ], "mac_addresses": [ "00:01:24:56:9b:cf" ] }, { "type": "hostname", "value": "Juanita-Work-PC", "bindings": [ { "account": "", "owner_ip": "0.0.0.0", "frame_number": 16506, "relationship": "dhcp-client-assertion", "source_field": "dhcp.option.hostname", "conversation_dst": "255.255.255.255", "conversation_src": "10.18.20.97" } ], "evidence": [ { "udp_stream": 172, "frame_number": 16506, "display_filter": "frame.number == 16506", "timestamp_epoch": "1575414483.749103000" } ], "raw_values": [ "Juanita-Work-PC" ], "identity_id": "identity-028d078a83f9e45d3ea0abb3", "ip_addresses": [], "mac_addresses": [ "00:01:24:56:9b:cf,00:01:24:56:9b:cf" ] } ], "actor_leads": [], "observables": [ { "type": "domain", "roles": [ "dns-query" ], "value": "222.222.67.208.in-addr.arpa", "evidence": [ { "udp_stream": 149, "frame_number": 16132, "display_filter": "frame.number == 16132", "timestamp_epoch": "1575413450.598824000" }, { "udp_stream": 150, "frame_number": 16133, "display_filter": "frame.number == 16133", "timestamp_epoch": "1575413450.598925000" }, { "udp_stream": 149, "frame_number": 16134, "display_filter": "frame.number == 16134", "timestamp_epoch": "1575413450.991320000" }, { "udp_stream": 150, "frame_number": 16136, "display_filter": "frame.number == 16136", "timestamp_epoch": "1575413450.995136000" } ], "is_private": null, "observable_id": "observable-2abae6ca95386b6e43cd26f8", "last_seen_epoch": "1575413450.995136000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413450.598824000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "a.tribalfusion.com", "evidence": [ { "udp_stream": 124, "frame_number": 13184, "display_filter": "frame.number == 13184", "timestamp_epoch": "1575413306.142255000" }, { "udp_stream": 124, "frame_number": 13357, "display_filter": "frame.number == 13357", "timestamp_epoch": "1575413306.307779000" }, { "tcp_stream": 383, "frame_number": 13559, "display_filter": "frame.number == 13559", "timestamp_epoch": "1575413306.504817000" }, { "tcp_stream": 384, "frame_number": 13561, "display_filter": "frame.number == 13561", "timestamp_epoch": "1575413306.505030000" } ], "is_private": null, "observable_id": "observable-5d457c947380fa15fc9bb743", "last_seen_epoch": "1575413306.505030000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413306.142255000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "aa.agkn.com", "evidence": [ { "udp_stream": 31, "frame_number": 2655, "display_filter": "frame.number == 2655", "timestamp_epoch": "1575413167.132764000" }, { "udp_stream": 31, "frame_number": 2659, "display_filter": "frame.number == 2659", "timestamp_epoch": "1575413167.210776000" }, { "tcp_stream": 64, "frame_number": 2681, "display_filter": "frame.number == 2681", "timestamp_epoch": "1575413167.297012000" }, { "tcp_stream": 65, "frame_number": 2695, "display_filter": "frame.number == 2695", "timestamp_epoch": "1575413167.305025000" } ], "is_private": null, "observable_id": "observable-094d4fac48fb64fd59c46c1f", "last_seen_epoch": "1575413167.305025000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413167.132764000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "ad.doubleclick.net", "evidence": [ { "udp_stream": 23, "frame_number": 1040, "display_filter": "frame.number == 1040", "timestamp_epoch": "1575413163.088488000" }, { "udp_stream": 23, "frame_number": 1069, "display_filter": "frame.number == 1069", "timestamp_epoch": "1575413163.198550000" }, { "tcp_stream": 46, "frame_number": 1088, "display_filter": "frame.number == 1088", "timestamp_epoch": "1575413163.327415000" }, { "tcp_stream": 45, "frame_number": 1101, "display_filter": "frame.number == 1101", "timestamp_epoch": "1575413163.331669000" } ], "is_private": null, "observable_id": "observable-acb5dbd36b8670eb6e65598e", "last_seen_epoch": "1575413163.331669000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413163.088488000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "ad.turn.com", "evidence": [ { "udp_stream": 78, "frame_number": 9292, "display_filter": "frame.number == 9292", "timestamp_epoch": "1575413262.581216000" }, { "udp_stream": 78, "frame_number": 9357, "display_filter": "frame.number == 9357", "timestamp_epoch": "1575413262.702392000" }, { "tcp_stream": 216, "frame_number": 9451, "display_filter": "frame.number == 9451", "timestamp_epoch": "1575413262.860441000" }, { "tcp_stream": 215, "frame_number": 9457, "display_filter": "frame.number == 9457", "timestamp_epoch": "1575413262.864668000" }, { "tcp_stream": 319, "frame_number": 12703, "display_filter": "frame.number == 12703", "timestamp_epoch": "1575413305.286681000" }, { "tcp_stream": 320, "frame_number": 12709, "display_filter": "frame.number == 12709", "timestamp_epoch": "1575413305.291034000" } ], "is_private": null, "observable_id": "observable-c84950f3b1fce8b4e4c51c92", "last_seen_epoch": "1575413305.291034000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.581216000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "ad.turn.com.akadns.net", "evidence": [ { "udp_stream": 78, "frame_number": 9357, "display_filter": "frame.number == 9357", "timestamp_epoch": "1575413262.702392000" } ], "is_private": null, "observable_id": "observable-7a77b900cf6e944c01be95b8", "last_seen_epoch": "1575413262.702392000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.702392000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "ads.pubmatic.com", "evidence": [ { "udp_stream": 80, "frame_number": 9294, "display_filter": "frame.number == 9294", "timestamp_epoch": "1575413262.587877000" }, { "udp_stream": 80, "frame_number": 9345, "display_filter": "frame.number == 9345", "timestamp_epoch": "1575413262.654064000" }, { "tcp_stream": 209, "frame_number": 9419, "display_filter": "frame.number == 9419", "timestamp_epoch": "1575413262.804160000" }, { "tcp_stream": 210, "frame_number": 9430, "display_filter": "frame.number == 9430", "timestamp_epoch": "1575413262.820376000" } ], "is_private": null, "observable_id": "observable-102021d5d0e7bf80cdfb1751", "last_seen_epoch": "1575413262.820376000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.587877000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "ads.yahoo.com", "evidence": [ { "udp_stream": 69, "frame_number": 8604, "display_filter": "frame.number == 8604", "timestamp_epoch": "1575413260.166154000" }, { "udp_stream": 69, "frame_number": 8646, "display_filter": "frame.number == 8646", "timestamp_epoch": "1575413260.432992000" }, { "tcp_stream": 185, "frame_number": 8681, "display_filter": "frame.number == 8681", "timestamp_epoch": "1575413260.570908000" }, { "tcp_stream": 186, "frame_number": 8685, "display_filter": "frame.number == 8685", "timestamp_epoch": "1575413260.585331000" }, { "tcp_stream": 303, "frame_number": 12582, "display_filter": "frame.number == 12582", "timestamp_epoch": "1575413304.669901000" }, { "tcp_stream": 304, "frame_number": 12584, "display_filter": "frame.number == 12584", "timestamp_epoch": "1575413304.670144000" } ], "is_private": null, "observable_id": "observable-31dc241354ff0bff8e876c61", "last_seen_epoch": "1575413304.670144000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413260.166154000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "ads.yap.yahoo.com", "evidence": [ { "udp_stream": 49, "frame_number": 6379, "display_filter": "frame.number == 6379", "timestamp_epoch": "1575413249.766503000" }, { "udp_stream": 49, "frame_number": 6460, "display_filter": "frame.number == 6460", "timestamp_epoch": "1575413250.068987000" }, { "tcp_stream": 130, "frame_number": 6596, "display_filter": "frame.number == 6596", "timestamp_epoch": "1575413250.317154000" }, { "tcp_stream": 129, "frame_number": 6598, "display_filter": "frame.number == 6598", "timestamp_epoch": "1575413250.317352000" } ], "is_private": null, "observable_id": "observable-527ab6475e33966fa862b7d3", "last_seen_epoch": "1575413250.317352000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413249.766503000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "adserver-vpc-alb-0-2072243822.us-east-1.elb.amazonaws.com", "evidence": [ { "udp_stream": 119, "frame_number": 13113, "display_filter": "frame.number == 13113", "timestamp_epoch": "1575413306.103126000" } ], "is_private": null, "observable_id": "observable-80abe780a41d5f15cba0680f", "last_seen_epoch": "1575413306.103126000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413306.103126000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "adserver.adtech.advertising.com", "evidence": [ { "udp_stream": 50, "frame_number": 6833, "display_filter": "frame.number == 6833", "timestamp_epoch": "1575413250.760262000" }, { "udp_stream": 50, "frame_number": 6899, "display_filter": "frame.number == 6899", "timestamp_epoch": "1575413251.062084000" }, { "tcp_stream": 133, "frame_number": 6930, "display_filter": "frame.number == 6930", "timestamp_epoch": "1575413251.162091000" }, { "tcp_stream": 134, "frame_number": 6934, "display_filter": "frame.number == 6934", "timestamp_epoch": "1575413251.164564000" } ], "is_private": null, "observable_id": "observable-9cdd32d434f1ee3a44a43e59", "last_seen_epoch": "1575413251.164564000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413250.760262000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "aero.bankofamerica.com", "evidence": [ { "udp_stream": 182, "frame_number": 17338, "display_filter": "frame.number == 17338", "timestamp_epoch": "1575414489.185931000" }, { "udp_stream": 182, "frame_number": 17363, "display_filter": "frame.number == 17363", "timestamp_epoch": "1575414489.352624000" }, { "tcp_stream": 459, "frame_number": 17521, "display_filter": "frame.number == 17521", "timestamp_epoch": "1575414489.714009000" }, { "tcp_stream": 458, "frame_number": 17527, "display_filter": "frame.number == 17527", "timestamp_epoch": "1575414489.714501000" }, { "tcp_stream": 468, "frame_number": 18434, "display_filter": "frame.number == 18434", "timestamp_epoch": "1575414491.357363000" }, { "tcp_stream": 470, "frame_number": 18446, "display_filter": "frame.number == 18446", "timestamp_epoch": "1575414491.364631000" }, { "tcp_stream": 481, "frame_number": 20233, "display_filter": "frame.number == 20233", "timestamp_epoch": "1575414522.730039000" }, { "tcp_stream": 486, "frame_number": 20567, "display_filter": "frame.number == 20567", "timestamp_epoch": "1575414523.405641000" } ], "is_private": null, "observable_id": "observable-32ef5d448f2bd5cc0a30ad9e", "last_seen_epoch": "1575414523.405641000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414489.185931000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "aka-cdn.adtechus.com", "evidence": [ { "udp_stream": 22, "frame_number": 1037, "display_filter": "frame.number == 1037", "timestamp_epoch": "1575413163.086015000" }, { "udp_stream": 22, "frame_number": 1072, "display_filter": "frame.number == 1072", "timestamp_epoch": "1575413163.219942000" }, { "tcp_stream": 47, "frame_number": 1081, "display_filter": "frame.number == 1081", "timestamp_epoch": "1575413163.327080000" }, { "tcp_stream": 48, "frame_number": 1083, "display_filter": "frame.number == 1083", "timestamp_epoch": "1575413163.327186000" } ], "is_private": null, "observable_id": "observable-7e43d55a5fe2bd53bb6180e8", "last_seen_epoch": "1575413163.327186000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413163.086015000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "api.bing.com", "evidence": [ { "udp_stream": 11, "frame_number": 551, "display_filter": "frame.number == 551", "timestamp_epoch": "1575413159.407057000" }, { "udp_stream": 12, "frame_number": 552, "display_filter": "frame.number == 552", "timestamp_epoch": "1575413159.407211000" }, { "udp_stream": 11, "frame_number": 560, "display_filter": "frame.number == 560", "timestamp_epoch": "1575413159.571932000" }, { "udp_stream": 12, "frame_number": 561, "display_filter": "frame.number == 561", "timestamp_epoch": "1575413159.572020000" }, { "udp_stream": 139, "frame_number": 15894, "display_filter": "frame.number == 15894", "timestamp_epoch": "1575413432.609808000" }, { "udp_stream": 140, "frame_number": 15895, "display_filter": "frame.number == 15895", "timestamp_epoch": "1575413432.610255000" }, { "udp_stream": 140, "frame_number": 15924, "display_filter": "frame.number == 15924", "timestamp_epoch": "1575413432.761525000" }, { "udp_stream": 139, "frame_number": 15925, "display_filter": "frame.number == 15925", "timestamp_epoch": "1575413432.761612000" }, { "udp_stream": 177, "frame_number": 17197, "display_filter": "frame.number == 17197", "timestamp_epoch": "1575414487.622818000" }, { "udp_stream": 180, "frame_number": 17200, "display_filter": "frame.number == 17200", "timestamp_epoch": "1575414487.625563000" }, { "udp_stream": 180, "frame_number": 17245, "display_filter": "frame.number == 17245", "timestamp_epoch": "1575414487.898383000" }, { "udp_stream": 177, "frame_number": 17247, "display_filter": "frame.number == 17247", "timestamp_epoch": "1575414487.898510000" } ], "is_private": null, "observable_id": "observable-bb0aa819f5c331d34de6ff37", "last_seen_epoch": "1575414487.898510000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413159.407057000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "api.login.aol.com", "evidence": [ { "udp_stream": 7, "frame_number": 351, "display_filter": "frame.number == 351", "timestamp_epoch": "1575413157.216685000" }, { "udp_stream": 7, "frame_number": 352, "display_filter": "frame.number == 352", "timestamp_epoch": "1575413157.278971000" }, { "tcp_stream": 26, "frame_number": 358, "display_filter": "frame.number == 358", "timestamp_epoch": "1575413157.370538000" }, { "tcp_stream": 27, "frame_number": 362, "display_filter": "frame.number == 362", "timestamp_epoch": "1575413157.375597000" }, { "tcp_stream": 97, "frame_number": 3896, "display_filter": "frame.number == 3896", "timestamp_epoch": "1575413239.592707000" }, { "tcp_stream": 96, "frame_number": 3900, "display_filter": "frame.number == 3900", "timestamp_epoch": "1575413239.596757000" } ], "is_private": null, "observable_id": "observable-92962bb482ea1243cfc95546", "last_seen_epoch": "1575413239.596757000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413157.216685000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "api2.casus.at", "evidence": [ { "udp_stream": 146, "frame_number": 15966, "display_filter": "frame.number == 15966", "timestamp_epoch": "1575413440.200051000" }, { "udp_stream": 146, "frame_number": 15967, "display_filter": "frame.number == 15967", "timestamp_epoch": "1575413440.498835000" }, { "tcp_stream": 426, "frame_number": 15971, "display_filter": "frame.number == 15971", "timestamp_epoch": "1575413440.713801000" } ], "is_private": null, "observable_id": "observable-e397fc7e778496bac3dac380", "last_seen_epoch": "1575413440.713801000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413440.200051000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "apx.moatads.com", "evidence": [ { "udp_stream": 27, "frame_number": 1431, "display_filter": "frame.number == 1431", "timestamp_epoch": "1575413164.249265000" }, { "udp_stream": 27, "frame_number": 2058, "display_filter": "frame.number == 2058", "timestamp_epoch": "1575413165.535569000" }, { "udp_stream": 27, "frame_number": 2214, "display_filter": "frame.number == 2214", "timestamp_epoch": "1575413165.990675000" }, { "tcp_stream": 53, "frame_number": 2447, "display_filter": "frame.number == 2447", "timestamp_epoch": "1575413166.362415000" }, { "tcp_stream": 54, "frame_number": 2453, "display_filter": "frame.number == 2453", "timestamp_epoch": "1575413166.367591000" } ], "is_private": null, "observable_id": "observable-b175953c3556bacea93d2923", "last_seen_epoch": "1575413166.367591000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413164.249265000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "at.atwola.com", "evidence": [ { "udp_stream": 48, "frame_number": 5605, "display_filter": "frame.number == 5605", "timestamp_epoch": "1575413248.806325000" }, { "udp_stream": 48, "frame_number": 5656, "display_filter": "frame.number == 5656", "timestamp_epoch": "1575413248.903560000" }, { "tcp_stream": 121, "frame_number": 6054, "display_filter": "frame.number == 6054", "timestamp_epoch": "1575413249.284537000" }, { "tcp_stream": 120, "frame_number": 6055, "display_filter": "frame.number == 6055", "timestamp_epoch": "1575413249.284637000" }, { "tcp_stream": 135, "frame_number": 7074, "display_filter": "frame.number == 7074", "timestamp_epoch": "1575413252.276342000" }, { "tcp_stream": 298, "frame_number": 12490, "display_filter": "frame.number == 12490", "timestamp_epoch": "1575413303.010327000" }, { "tcp_stream": 297, "frame_number": 12494, "display_filter": "frame.number == 12494", "timestamp_epoch": "1575413303.013351000" } ], "is_private": null, "observable_id": "observable-eee2f162b77a33664598f447", "last_seen_epoch": "1575413303.013351000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413248.806325000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "audex.userreport.com", "evidence": [ { "udp_stream": 32, "frame_number": 2658, "display_filter": "frame.number == 2658", "timestamp_epoch": "1575413167.147746000" }, { "udp_stream": 32, "frame_number": 2663, "display_filter": "frame.number == 2663", "timestamp_epoch": "1575413167.216789000" }, { "tcp_stream": 67, "frame_number": 2699, "display_filter": "frame.number == 2699", "timestamp_epoch": "1575413167.307424000" }, { "tcp_stream": 66, "frame_number": 2700, "display_filter": "frame.number == 2700", "timestamp_epoch": "1575413167.307490000" } ], "is_private": null, "observable_id": "observable-69163faa4644efe6f6c92969", "last_seen_epoch": "1575413167.307490000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413167.147746000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "awuseb.advanced-web-analytics.com", "evidence": [ { "udp_stream": 189, "frame_number": 18877, "display_filter": "frame.number == 18877", "timestamp_epoch": "1575414493.246643000" }, { "udp_stream": 189, "frame_number": 18913, "display_filter": "frame.number == 18913", "timestamp_epoch": "1575414494.106735000" }, { "tcp_stream": 476, "frame_number": 18928, "display_filter": "frame.number == 18928", "timestamp_epoch": "1575414494.321804000" }, { "tcp_stream": 475, "frame_number": 18932, "display_filter": "frame.number == 18932", "timestamp_epoch": "1575414494.325959000" } ], "is_private": null, "observable_id": "observable-0eb5dad8d2bbf156e4e6e460", "last_seen_epoch": "1575414494.325959000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414493.246643000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "b.aol.com", "evidence": [ { "udp_stream": 53, "frame_number": 7456, "display_filter": "frame.number == 7456", "timestamp_epoch": "1575413253.970345000" }, { "udp_stream": 53, "frame_number": 7467, "display_filter": "frame.number == 7467", "timestamp_epoch": "1575413254.084287000" } ], "is_private": null, "observable_id": "observable-8f86f35245a1eb8fbe68a586", "last_seen_epoch": "1575413254.084287000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413253.970345000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "b1sync.zemanta.com", "evidence": [ { "udp_stream": 127, "frame_number": 13194, "display_filter": "frame.number == 13194", "timestamp_epoch": "1575413306.152210000" }, { "udp_stream": 127, "frame_number": 13285, "display_filter": "frame.number == 13285", "timestamp_epoch": "1575413306.270237000" }, { "tcp_stream": 367, "frame_number": 13501, "display_filter": "frame.number == 13501", "timestamp_epoch": "1575413306.454402000" }, { "tcp_stream": 368, "frame_number": 13504, "display_filter": "frame.number == 13504", "timestamp_epoch": "1575413306.454572000" } ], "is_private": null, "observable_id": "observable-c1ca62d275d487faa211ad9b", "last_seen_epoch": "1575413306.454572000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413306.152210000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "bankofamerica.tt.omtrdc.net", "evidence": [ { "udp_stream": 181, "frame_number": 17334, "display_filter": "frame.number == 17334", "timestamp_epoch": "1575414489.089710000" }, { "udp_stream": 181, "frame_number": 17335, "display_filter": "frame.number == 17335", "timestamp_epoch": "1575414489.184029000" }, { "tcp_stream": 451, "frame_number": 17357, "display_filter": "frame.number == 17357", "timestamp_epoch": "1575414489.303501000" }, { "tcp_stream": 452, "frame_number": 17371, "display_filter": "frame.number == 17371", "timestamp_epoch": "1575414489.358157000" }, { "tcp_stream": 480, "frame_number": 19717, "display_filter": "frame.number == 19717", "timestamp_epoch": "1575414520.904583000" }, { "tcp_stream": 479, "frame_number": 19719, "display_filter": "frame.number == 19719", "timestamp_epoch": "1575414520.904656000" } ], "is_private": null, "observable_id": "observable-038baef259648cbfbe4de5ea", "last_seen_epoch": "1575414520.904656000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414489.089710000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "beap.gemini.yahoo.com", "evidence": [ { "udp_stream": 51, "frame_number": 7120, "display_filter": "frame.number == 7120", "timestamp_epoch": "1575413252.786071000" }, { "udp_stream": 51, "frame_number": 7139, "display_filter": "frame.number == 7139", "timestamp_epoch": "1575413252.926670000" }, { "tcp_stream": 137, "frame_number": 7185, "display_filter": "frame.number == 7185", "timestamp_epoch": "1575413253.027999000" }, { "tcp_stream": 136, "frame_number": 7201, "display_filter": "frame.number == 7201", "timestamp_epoch": "1575413253.176098000" }, { "tcp_stream": 251, "frame_number": 10489, "display_filter": "frame.number == 10489", "timestamp_epoch": "1575413266.137026000" }, { "tcp_stream": 250, "frame_number": 10491, "display_filter": "frame.number == 10491", "timestamp_epoch": "1575413266.137584000" } ], "is_private": null, "observable_id": "observable-b976ceb017e63e01812eb3de", "last_seen_epoch": "1575413266.137584000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413252.786071000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "beap1.cb.g01.yahoodns.net", "evidence": [ { "udp_stream": 51, "frame_number": 7139, "display_filter": "frame.number == 7139", "timestamp_epoch": "1575413252.926670000" } ], "is_private": null, "observable_id": "observable-d4ec6f0c3d118ddc963d99e3", "last_seen_epoch": "1575413252.926670000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413252.926670000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "bh.contextweb.com", "evidence": [ { "udp_stream": 16, "frame_number": 13189, "display_filter": "frame.number == 13189", "timestamp_epoch": "1575413306.146694000" }, { "udp_stream": 16, "frame_number": 13337, "display_filter": "frame.number == 13337", "timestamp_epoch": "1575413306.294911000" }, { "tcp_stream": 380, "frame_number": 13547, "display_filter": "frame.number == 13547", "timestamp_epoch": "1575413306.483362000" }, { "tcp_stream": 379, "frame_number": 13553, "display_filter": "frame.number == 13553", "timestamp_epoch": "1575413306.487291000" } ], "is_private": null, "observable_id": "observable-cef84fa09435bfa8c9436fd8", "last_seen_epoch": "1575413306.487291000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413306.146694000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "bm.adentifi.com", "evidence": [ { "udp_stream": 60, "frame_number": 8002, "display_filter": "frame.number == 8002", "timestamp_epoch": "1575413257.206920000" }, { "udp_stream": 60, "frame_number": 8009, "display_filter": "frame.number == 8009", "timestamp_epoch": "1575413257.314055000" }, { "tcp_stream": 154, "frame_number": 8028, "display_filter": "frame.number == 8028", "timestamp_epoch": "1575413257.408110000" }, { "tcp_stream": 155, "frame_number": 8032, "display_filter": "frame.number == 8032", "timestamp_epoch": "1575413257.416303000" } ], "is_private": null, "observable_id": "observable-8759cea9cfa68bf20e28efee", "last_seen_epoch": "1575413257.416303000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413257.206920000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "boss.bankofamerica.com", "evidence": [ { "udp_stream": 183, "frame_number": 17339, "display_filter": "frame.number == 17339", "timestamp_epoch": "1575414489.187171000" }, { "udp_stream": 183, "frame_number": 17364, "display_filter": "frame.number == 17364", "timestamp_epoch": "1575414489.352724000" }, { "tcp_stream": 457, "frame_number": 17523, "display_filter": "frame.number == 17523", "timestamp_epoch": "1575414489.714291000" }, { "tcp_stream": 456, "frame_number": 17529, "display_filter": "frame.number == 17529", "timestamp_epoch": "1575414489.714649000" }, { "tcp_stream": 469, "frame_number": 18379, "display_filter": "frame.number == 18379", "timestamp_epoch": "1575414491.316577000" }, { "tcp_stream": 467, "frame_number": 18426, "display_filter": "frame.number == 18426", "timestamp_epoch": "1575414491.356015000" }, { "tcp_stream": 473, "frame_number": 18871, "display_filter": "frame.number == 18871", "timestamp_epoch": "1575414493.185956000" }, { "tcp_stream": 474, "frame_number": 18918, "display_filter": "frame.number == 18918", "timestamp_epoch": "1575414494.140958000" }, { "tcp_stream": 482, "frame_number": 20344, "display_filter": "frame.number == 20344", "timestamp_epoch": "1575414522.899753000" }, { "tcp_stream": 483, "frame_number": 20371, "display_filter": "frame.number == 20371", "timestamp_epoch": "1575414523.032260000" }, { "tcp_stream": 484, "frame_number": 20377, "display_filter": "frame.number == 20377", "timestamp_epoch": "1575414523.032855000" }, { "tcp_stream": 485, "frame_number": 20564, "display_filter": "frame.number == 20564", "timestamp_epoch": "1575414523.405133000" } ], "is_private": null, "observable_id": "observable-1b36a6859ec3d67f91e32b2b", "last_seen_epoch": "1575414523.405133000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414489.187171000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "c.fqtag.com", "evidence": [ { "udp_stream": 66, "frame_number": 8270, "display_filter": "frame.number == 8270", "timestamp_epoch": "1575413258.607616000" }, { "udp_stream": 66, "frame_number": 8331, "display_filter": "frame.number == 8331", "timestamp_epoch": "1575413258.871609000" }, { "tcp_stream": 174, "frame_number": 8416, "display_filter": "frame.number == 8416", "timestamp_epoch": "1575413259.192038000" }, { "tcp_stream": 175, "frame_number": 8422, "display_filter": "frame.number == 8422", "timestamp_epoch": "1575413259.194025000" } ], "is_private": null, "observable_id": "observable-cb61d9b74c3ca69303f3895a", "last_seen_epoch": "1575413259.194025000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413258.607616000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "c1.adform.net", "evidence": [ { "udp_stream": 90, "frame_number": 9899, "display_filter": "frame.number == 9899", "timestamp_epoch": "1575413264.539023000" }, { "udp_stream": 90, "frame_number": 9997, "display_filter": "frame.number == 9997", "timestamp_epoch": "1575413264.964593000" }, { "tcp_stream": 244, "frame_number": 10128, "display_filter": "frame.number == 10128", "timestamp_epoch": "1575413265.191805000" }, { "tcp_stream": 243, "frame_number": 10129, "display_filter": "frame.number == 10129", "timestamp_epoch": "1575413265.191850000" }, { "tcp_stream": 343, "frame_number": 13144, "display_filter": "frame.number == 13144", "timestamp_epoch": "1575413306.126314000" }, { "tcp_stream": 344, "frame_number": 13150, "display_filter": "frame.number == 13150", "timestamp_epoch": "1575413306.127107000" } ], "is_private": null, "observable_id": "observable-bf331719c013b37bb9accce6", "last_seen_epoch": "1575413306.127107000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413264.539023000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "casale-match.dotomi.com", "evidence": [ { "udp_stream": 88, "frame_number": 9897, "display_filter": "frame.number == 9897", "timestamp_epoch": "1575413264.536227000" }, { "udp_stream": 88, "frame_number": 10032, "display_filter": "frame.number == 10032", "timestamp_epoch": "1575413265.132382000" }, { "tcp_stream": 246, "frame_number": 10141, "display_filter": "frame.number == 10141", "timestamp_epoch": "1575413265.311628000" }, { "tcp_stream": 245, "frame_number": 10145, "display_filter": "frame.number == 10145", "timestamp_epoch": "1575413265.320884000" } ], "is_private": null, "observable_id": "observable-a69bed8a9cf47e16d0b4c3be", "last_seen_epoch": "1575413265.320884000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413264.536227000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "cdn.fqtag.com", "evidence": [ { "udp_stream": 68, "frame_number": 8601, "display_filter": "frame.number == 8601", "timestamp_epoch": "1575413260.162620000" }, { "udp_stream": 68, "frame_number": 8643, "display_filter": "frame.number == 8643", "timestamp_epoch": "1575413260.379428000" }, { "tcp_stream": 183, "frame_number": 8673, "display_filter": "frame.number == 8673", "timestamp_epoch": "1575413260.523537000" }, { "tcp_stream": 184, "frame_number": 8677, "display_filter": "frame.number == 8677", "timestamp_epoch": "1575413260.524660000" } ], "is_private": null, "observable_id": "observable-23f25314663154b353843685", "last_seen_epoch": "1575413260.524660000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413260.162620000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "cm.adgrx.com", "evidence": [ { "udp_stream": 91, "frame_number": 9900, "display_filter": "frame.number == 9900", "timestamp_epoch": "1575413264.539552000" }, { "udp_stream": 91, "frame_number": 9990, "display_filter": "frame.number == 9990", "timestamp_epoch": "1575413264.924248000" }, { "tcp_stream": 241, "frame_number": 10127, "display_filter": "frame.number == 10127", "timestamp_epoch": "1575413265.191748000" }, { "tcp_stream": 242, "frame_number": 10131, "display_filter": "frame.number == 10131", "timestamp_epoch": "1575413265.191985000" }, { "tcp_stream": 346, "frame_number": 13147, "display_filter": "frame.number == 13147", "timestamp_epoch": "1575413306.126851000" }, { "tcp_stream": 345, "frame_number": 13155, "display_filter": "frame.number == 13155", "timestamp_epoch": "1575413306.127361000" } ], "is_private": null, "observable_id": "observable-50321f90b882642588797dae", "last_seen_epoch": "1575413306.127361000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413264.539552000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "cm.eyereturn.com", "evidence": [ { "udp_stream": 89, "frame_number": 9898, "display_filter": "frame.number == 9898", "timestamp_epoch": "1575413264.537914000" }, { "udp_stream": 89, "frame_number": 9979, "display_filter": "frame.number == 9979", "timestamp_epoch": "1575413264.894068000" }, { "tcp_stream": 235, "frame_number": 10045, "display_filter": "frame.number == 10045", "timestamp_epoch": "1575413265.135568000" }, { "tcp_stream": 236, "frame_number": 10048, "display_filter": "frame.number == 10048", "timestamp_epoch": "1575413265.135802000" }, { "tcp_stream": 355, "frame_number": 13296, "display_filter": "frame.number == 13296", "timestamp_epoch": "1575413306.272502000" }, { "tcp_stream": 356, "frame_number": 13304, "display_filter": "frame.number == 13304", "timestamp_epoch": "1575413306.274331000" } ], "is_private": null, "observable_id": "observable-f1030a7ae8cc443f76affadf", "last_seen_epoch": "1575413306.274331000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413264.537914000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "cm.g.doubleclick.net", "evidence": [ { "udp_stream": 72, "frame_number": 9281, "display_filter": "frame.number == 9281", "timestamp_epoch": "1575413262.562854000" }, { "udp_stream": 72, "frame_number": 9322, "display_filter": "frame.number == 9322", "timestamp_epoch": "1575413262.643180000" }, { "tcp_stream": 201, "frame_number": 9377, "display_filter": "frame.number == 9377", "timestamp_epoch": "1575413262.735404000" }, { "tcp_stream": 200, "frame_number": 9378, "display_filter": "frame.number == 9378", "timestamp_epoch": "1575413262.735505000" }, { "tcp_stream": 202, "frame_number": 9380, "display_filter": "frame.number == 9380", "timestamp_epoch": "1575413262.735796000" }, { "tcp_stream": 199, "frame_number": 9387, "display_filter": "frame.number == 9387", "timestamp_epoch": "1575413262.740925000" }, { "tcp_stream": 305, "frame_number": 12660, "display_filter": "frame.number == 12660", "timestamp_epoch": "1575413305.241743000" }, { "tcp_stream": 306, "frame_number": 12669, "display_filter": "frame.number == 12669", "timestamp_epoch": "1575413305.253240000" }, { "tcp_stream": 311, "frame_number": 12680, "display_filter": "frame.number == 12680", "timestamp_epoch": "1575413305.257120000" }, { "tcp_stream": 312, "frame_number": 12682, "display_filter": "frame.number == 12682", "timestamp_epoch": "1575413305.257257000" } ], "is_private": null, "observable_id": "observable-46011bfd52503a3760f74fcb", "last_seen_epoch": "1575413305.257257000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.562854000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "cms.analytics.yahoo.com", "evidence": [ { "udp_stream": 28, "frame_number": 1598, "display_filter": "frame.number == 1598", "timestamp_epoch": "1575413164.774429000" }, { "udp_stream": 28, "frame_number": 2213, "display_filter": "frame.number == 2213", "timestamp_epoch": "1575413165.783856000" }, { "udp_stream": 28, "frame_number": 2224, "display_filter": "frame.number == 2224", "timestamp_epoch": "1575413165.993066000" }, { "tcp_stream": 55, "frame_number": 2455, "display_filter": "frame.number == 2455", "timestamp_epoch": "1575413166.367879000" }, { "tcp_stream": 60, "frame_number": 2480, "display_filter": "frame.number == 2480", "timestamp_epoch": "1575413166.410412000" }, { "tcp_stream": 61, "frame_number": 2484, "display_filter": "frame.number == 2484", "timestamp_epoch": "1575413166.410679000" }, { "tcp_stream": 56, "frame_number": 2488, "display_filter": "frame.number == 2488", "timestamp_epoch": "1575413166.411517000" }, { "tcp_stream": 59, "frame_number": 2492, "display_filter": "frame.number == 2492", "timestamp_epoch": "1575413166.413832000" }, { "tcp_stream": 83, "frame_number": 3537, "display_filter": "frame.number == 3537", "timestamp_epoch": "1575413212.376817000" }, { "tcp_stream": 84, "frame_number": 3541, "display_filter": "frame.number == 3541", "timestamp_epoch": "1575413212.385880000" } ], "is_private": null, "observable_id": "observable-c7bf9faa2bd18f146295e7f0", "last_seen_epoch": "1575413212.385880000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413164.774429000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "consent.cmp.oath.com", "evidence": [ { "udp_stream": 42, "frame_number": 4183, "display_filter": "frame.number == 4183", "timestamp_epoch": "1575413244.536843000" }, { "udp_stream": 42, "frame_number": 4187, "display_filter": "frame.number == 4187", "timestamp_epoch": "1575413244.607312000" }, { "tcp_stream": 105, "frame_number": 4198, "display_filter": "frame.number == 4198", "timestamp_epoch": "1575413244.664431000" }, { "tcp_stream": 104, "frame_number": 4199, "display_filter": "frame.number == 4199", "timestamp_epoch": "1575413244.664515000" } ], "is_private": null, "observable_id": "observable-8103ffcc03f19ff3a50a4176", "last_seen_epoch": "1575413244.664515000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413244.536843000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "cookie.brealtime.com", "evidence": [ { "udp_stream": 125, "frame_number": 13190, "display_filter": "frame.number == 13190", "timestamp_epoch": "1575413306.147638000" }, { "udp_stream": 125, "frame_number": 13293, "display_filter": "frame.number == 13293", "timestamp_epoch": "1575413306.272141000" }, { "tcp_stream": 372, "frame_number": 13448, "display_filter": "frame.number == 13448", "timestamp_epoch": "1575413306.423610000" }, { "tcp_stream": 371, "frame_number": 13449, "display_filter": "frame.number == 13449", "timestamp_epoch": "1575413306.423688000" } ], "is_private": null, "observable_id": "observable-4a61cad65fdd3e0ae078fef3", "last_seen_epoch": "1575413306.423688000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413306.147638000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "cookie.brealtime.com.cdn.cloudflare.net", "evidence": [ { "udp_stream": 125, "frame_number": 13293, "display_filter": "frame.number == 13293", "timestamp_epoch": "1575413306.272141000" } ], "is_private": null, "observable_id": "observable-818b6c2a14fc32e6d1470743", "last_seen_epoch": "1575413306.272141000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413306.272141000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "crt.usertrust.com", "evidence": [ { "udp_stream": 94, "frame_number": 10413, "display_filter": "frame.number == 10413", "timestamp_epoch": "1575413265.792188000" }, { "udp_stream": 95, "frame_number": 10468, "display_filter": "frame.number == 10468", "timestamp_epoch": "1575413265.946223000" }, { "udp_stream": 95, "frame_number": 10536, "display_filter": "frame.number == 10536", "timestamp_epoch": "1575413266.379001000" }, { "udp_stream": 94, "frame_number": 10537, "display_filter": "frame.number == 10537", "timestamp_epoch": "1575413266.379122000" }, { "tcp_stream": 254, "frame_number": 10625, "display_filter": "frame.number == 10625", "timestamp_epoch": "1575413266.902247000" }, { "tcp_stream": 253, "frame_number": 10629, "display_filter": "frame.number == 10629", "timestamp_epoch": "1575413266.906579000" } ], "is_private": null, "observable_id": "observable-0fe3eeefc5b698a1867ce9ac", "last_seen_epoch": "1575413266.906579000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413265.792188000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "cs550162656.adn.psicdn.net", "evidence": [ { "udp_stream": 42, "frame_number": 4187, "display_filter": "frame.number == 4187", "timestamp_epoch": "1575413244.607312000" } ], "is_private": null, "observable_id": "observable-b393cabf8c39bb0b7ae01658", "last_seen_epoch": "1575413244.607312000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413244.607312000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "cs629.wpc.lambdacdn.net", "evidence": [ { "udp_stream": 41, "frame_number": 4184, "display_filter": "frame.number == 4184", "timestamp_epoch": "1575413244.602338000" }, { "udp_stream": 47, "frame_number": 5418, "display_filter": "frame.number == 5418", "timestamp_epoch": "1575413248.467142000" } ], "is_private": null, "observable_id": "observable-3421a4258340df2b859d932d", "last_seen_epoch": "1575413248.467142000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413244.602338000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "cs737157920.wpc.omicroncdn.net", "evidence": [ { "udp_stream": 46, "frame_number": 5225, "display_filter": "frame.number == 5225", "timestamp_epoch": "1575413248.059796000" } ], "is_private": null, "observable_id": "observable-6eb5e7cab184e062405555c2", "last_seen_epoch": "1575413248.059796000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413248.059796000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "cs747173190.wac.omegacdn.net", "evidence": [ { "udp_stream": 21, "frame_number": 929, "display_filter": "frame.number == 929", "timestamp_epoch": "1575413162.912621000" } ], "is_private": null, "observable_id": "observable-e62e9cb95d32767f234e4f76", "last_seen_epoch": "1575413162.912621000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413162.912621000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "csm2waycm-atl.netmng.com", "evidence": [ { "udp_stream": 118, "frame_number": 13021, "display_filter": "frame.number == 13021", "timestamp_epoch": "1575413305.963396000" }, { "udp_stream": 118, "frame_number": 13081, "display_filter": "frame.number == 13081", "timestamp_epoch": "1575413306.074332000" }, { "tcp_stream": 348, "frame_number": 13206, "display_filter": "frame.number == 13206", "timestamp_epoch": "1575413306.180173000" }, { "tcp_stream": 349, "frame_number": 13219, "display_filter": "frame.number == 13219", "timestamp_epoch": "1575413306.186794000" } ], "is_private": null, "observable_id": "observable-417bd4be1e243993c77e60aa", "last_seen_epoch": "1575413306.186794000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413305.963396000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "d.adroll.com", "evidence": [ { "udp_stream": 119, "frame_number": 13023, "display_filter": "frame.number == 13023", "timestamp_epoch": "1575413305.964081000" }, { "udp_stream": 119, "frame_number": 13113, "display_filter": "frame.number == 13113", "timestamp_epoch": "1575413306.103126000" }, { "tcp_stream": 351, "frame_number": 13252, "display_filter": "frame.number == 13252", "timestamp_epoch": "1575413306.241473000" }, { "tcp_stream": 352, "frame_number": 13258, "display_filter": "frame.number == 13258", "timestamp_epoch": "1575413306.242423000" } ], "is_private": null, "observable_id": "observable-52ce2be832fd6d42a90b521b", "last_seen_epoch": "1575413306.242423000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413305.964081000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "d.agkn.com", "evidence": [ { "udp_stream": 64, "frame_number": 8117, "display_filter": "frame.number == 8117", "timestamp_epoch": "1575413258.171519000" }, { "udp_stream": 64, "frame_number": 8202, "display_filter": "frame.number == 8202", "timestamp_epoch": "1575413258.371041000" }, { "tcp_stream": 162, "frame_number": 8232, "display_filter": "frame.number == 8232", "timestamp_epoch": "1575413258.496034000" }, { "tcp_stream": 163, "frame_number": 8234, "display_filter": "frame.number == 8234", "timestamp_epoch": "1575413258.496358000" } ], "is_private": null, "observable_id": "observable-350d9ade5f63dd6a90cfba17", "last_seen_epoch": "1575413258.496358000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413258.171519000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "d2u28gf9o4d1cv.cloudfront.net", "evidence": [ { "udp_stream": 32, "frame_number": 2663, "display_filter": "frame.number == 2663", "timestamp_epoch": "1575413167.216789000" } ], "is_private": null, "observable_id": "observable-dcb174a46072ed1d25a4c118", "last_seen_epoch": "1575413167.216789000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413167.216789000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "dart.l.doubleclick.net", "evidence": [ { "udp_stream": 23, "frame_number": 1069, "display_filter": "frame.number == 1069", "timestamp_epoch": "1575413163.198550000" } ], "is_private": null, "observable_id": "observable-3184e9db19c8f57710aaeac3", "last_seen_epoch": "1575413163.198550000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413163.198550000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "data.coremetrics.com", "evidence": [ { "udp_stream": 187, "frame_number": 17999, "display_filter": "frame.number == 17999", "timestamp_epoch": "1575414490.527327000" }, { "udp_stream": 187, "frame_number": 18068, "display_filter": "frame.number == 18068", "timestamp_epoch": "1575414490.617736000" }, { "tcp_stream": 465, "frame_number": 18073, "display_filter": "frame.number == 18073", "timestamp_epoch": "1575414490.719140000" }, { "tcp_stream": 466, "frame_number": 18077, "display_filter": "frame.number == 18077", "timestamp_epoch": "1575414490.735364000" } ], "is_private": null, "observable_id": "observable-f7bd17f3a585e0914a85f683", "last_seen_epoch": "1575414490.735364000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414490.527327000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "dis.criteo.com", "evidence": [ { "udp_stream": 100, "frame_number": 10786, "display_filter": "frame.number == 10786", "timestamp_epoch": "1575413267.654094000" }, { "udp_stream": 100, "frame_number": 10847, "display_filter": "frame.number == 10847", "timestamp_epoch": "1575413267.948443000" }, { "tcp_stream": 263, "frame_number": 10948, "display_filter": "frame.number == 10948", "timestamp_epoch": "1575413268.290123000" }, { "tcp_stream": 262, "frame_number": 10949, "display_filter": "frame.number == 10949", "timestamp_epoch": "1575413268.290174000" } ], "is_private": null, "observable_id": "observable-56be77e2df29fdc0d8032c2e", "last_seen_epoch": "1575413268.290174000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413267.654094000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "dns.msftncsi.com", "evidence": [ { "udp_stream": 2, "frame_number": 253, "display_filter": "frame.number == 253", "timestamp_epoch": "1575413123.292845000" }, { "udp_stream": 2, "frame_number": 257, "display_filter": "frame.number == 257", "timestamp_epoch": "1575413123.352446000" }, { "udp_stream": 3, "frame_number": 258, "display_filter": "frame.number == 258", "timestamp_epoch": "1575413123.353131000" }, { "udp_stream": 3, "frame_number": 259, "display_filter": "frame.number == 259", "timestamp_epoch": "1575413123.412011000" } ], "is_private": null, "observable_id": "observable-83e41d6fecaa1c13e303a5cb", "last_seen_epoch": "1575413123.412011000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413123.292845000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "dpm.demdex.net", "evidence": [ { "udp_stream": 33, "frame_number": 2677, "display_filter": "frame.number == 2677", "timestamp_epoch": "1575413167.227450000" }, { "udp_stream": 33, "frame_number": 2703, "display_filter": "frame.number == 2703", "timestamp_epoch": "1575413167.311200000" }, { "tcp_stream": 70, "frame_number": 2763, "display_filter": "frame.number == 2763", "timestamp_epoch": "1575413167.452950000" }, { "tcp_stream": 71, "frame_number": 2777, "display_filter": "frame.number == 2777", "timestamp_epoch": "1575413167.476096000" } ], "is_private": null, "observable_id": "observable-bf737cad0145f495bcd81fc1", "last_seen_epoch": "1575413167.476096000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413167.227450000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "ds-ats.member.g02.yahoodns.net", "evidence": [ { "udp_stream": 6, "frame_number": 308, "display_filter": "frame.number == 308", "timestamp_epoch": "1575413156.734046000" }, { "udp_stream": 7, "frame_number": 352, "display_filter": "frame.number == 352", "timestamp_epoch": "1575413157.278971000" }, { "udp_stream": 8, "frame_number": 399, "display_filter": "frame.number == 399", "timestamp_epoch": "1575413157.843186000" } ], "is_private": null, "observable_id": "observable-b3153640c0257552655d2e35", "last_seen_epoch": "1575413157.843186000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413156.734046000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "ds-geoycpi-uno-lite.gycpi.b.yahoodns.net", "evidence": [ { "udp_stream": 16, "frame_number": 644, "display_filter": "frame.number == 644", "timestamp_epoch": "1575413160.441484000" } ], "is_private": null, "observable_id": "observable-9c9e3d5802dc8e59bcdf0cad", "last_seen_epoch": "1575413160.441484000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413160.441484000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "ds-pr-bh.ybp.gysm.yahoodns.net", "evidence": [ { "udp_stream": 83, "frame_number": 9810, "display_filter": "frame.number == 9810", "timestamp_epoch": "1575413264.126151000" } ], "is_private": null, "observable_id": "observable-7b4183146e956ccd740a213e", "last_seen_epoch": "1575413264.126151000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413264.126151000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "dsum-sec.casalemedia.com", "evidence": [ { "udp_stream": 93, "frame_number": 9973, "display_filter": "frame.number == 9973", "timestamp_epoch": "1575413264.829744000" }, { "udp_stream": 93, "frame_number": 10059, "display_filter": "frame.number == 10059", "timestamp_epoch": "1575413265.173234000" }, { "tcp_stream": 247, "frame_number": 10196, "display_filter": "frame.number == 10196", "timestamp_epoch": "1575413265.403229000" }, { "tcp_stream": 248, "frame_number": 10197, "display_filter": "frame.number == 10197", "timestamp_epoch": "1575413265.403332000" }, { "tcp_stream": 249, "frame_number": 10198, "display_filter": "frame.number == 10198", "timestamp_epoch": "1575413265.403378000" }, { "tcp_stream": 252, "frame_number": 10597, "display_filter": "frame.number == 10597", "timestamp_epoch": "1575413266.750929000" }, { "tcp_stream": 255, "frame_number": 10656, "display_filter": "frame.number == 10656", "timestamp_epoch": "1575413267.132409000" }, { "tcp_stream": 387, "frame_number": 13888, "display_filter": "frame.number == 13888", "timestamp_epoch": "1575413306.996081000" }, { "tcp_stream": 388, "frame_number": 13896, "display_filter": "frame.number == 13896", "timestamp_epoch": "1575413307.000043000" } ], "is_private": null, "observable_id": "observable-8b05266a91b50044a75389a9", "last_seen_epoch": "1575413307.000043000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413264.829744000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "dsum.casalemedia.com", "evidence": [ { "udp_stream": 111, "frame_number": 11021, "display_filter": "frame.number == 11021", "timestamp_epoch": "1575413268.446252000" }, { "udp_stream": 111, "frame_number": 11250, "display_filter": "frame.number == 11250", "timestamp_epoch": "1575413268.813668000" }, { "tcp_stream": 289, "frame_number": 11388, "display_filter": "frame.number == 11388", "timestamp_epoch": "1575413269.029328000" }, { "tcp_stream": 288, "frame_number": 11389, "display_filter": "frame.number == 11389", "timestamp_epoch": "1575413269.029388000" } ], "is_private": null, "observable_id": "observable-bd067b2162665756a56b4dd6", "last_seen_epoch": "1575413269.029388000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413268.446252000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "dull.bankofamerica.com", "evidence": [ { "udp_stream": 184, "frame_number": 17340, "display_filter": "frame.number == 17340", "timestamp_epoch": "1575414489.188976000" }, { "udp_stream": 184, "frame_number": 17359, "display_filter": "frame.number == 17359", "timestamp_epoch": "1575414489.334625000" }, { "tcp_stream": 454, "frame_number": 17501, "display_filter": "frame.number == 17501", "timestamp_epoch": "1575414489.707149000" }, { "tcp_stream": 453, "frame_number": 17503, "display_filter": "frame.number == 17503", "timestamp_epoch": "1575414489.707359000" } ], "is_private": null, "observable_id": "observable-c7ebc047f69e57cd24c7da2c", "last_seen_epoch": "1575414489.707359000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414489.188976000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "dxedge-prod-lb-946522505.us-east-1.elb.amazonaws.com", "evidence": [ { "udp_stream": 87, "frame_number": 9974, "display_filter": "frame.number == 9974", "timestamp_epoch": "1575413264.859950000" } ], "is_private": null, "observable_id": "observable-d4113795a6a2a978fbcd7b50", "last_seen_epoch": "1575413264.859950000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413264.859950000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "e.serverbid.com", "evidence": [ { "udp_stream": 128, "frame_number": 13195, "display_filter": "frame.number == 13195", "timestamp_epoch": "1575413306.154087000" }, { "udp_stream": 128, "frame_number": 13344, "display_filter": "frame.number == 13344", "timestamp_epoch": "1575413306.297988000" }, { "tcp_stream": 382, "frame_number": 13579, "display_filter": "frame.number == 13579", "timestamp_epoch": "1575413306.525415000" }, { "tcp_stream": 381, "frame_number": 13580, "display_filter": "frame.number == 13580", "timestamp_epoch": "1575413306.525493000" } ], "is_private": null, "observable_id": "observable-1229bafb89b93202ef52171f", "last_seen_epoch": "1575413306.525493000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413306.154087000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "edge.gycpi.b.yahoodns.net", "evidence": [ { "udp_stream": 9, "frame_number": 504, "display_filter": "frame.number == 504", "timestamp_epoch": "1575413158.967341000" } ], "is_private": null, "observable_id": "observable-b2b225d7a6b7b93ef4a92429", "last_seen_epoch": "1575413158.967341000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413158.967341000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "f2.taboola.map.fastly.net", "evidence": [ { "udp_stream": 123, "frame_number": 13306, "display_filter": "frame.number == 13306", "timestamp_epoch": "1575413306.288790000" } ], "is_private": null, "observable_id": "observable-87d9ff28dbda0d49f0d80215", "last_seen_epoch": "1575413306.288790000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413306.288790000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "fam-geo-atsv2.prod.media.g03.yahoodns.net", "evidence": [ { "udp_stream": 17, "frame_number": 647, "display_filter": "frame.number == 647", "timestamp_epoch": "1575413160.623478000" } ], "is_private": null, "observable_id": "observable-bbd402ee2a64ad4dbe35ff11", "last_seen_epoch": "1575413160.623478000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413160.623478000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "fc.yahoo.com", "evidence": [ { "udp_stream": 18, "frame_number": 641, "display_filter": "frame.number == 641", "timestamp_epoch": "1575413160.335721000" }, { "udp_stream": 18, "frame_number": 648, "display_filter": "frame.number == 648", "timestamp_epoch": "1575413160.623583000" }, { "tcp_stream": 37, "frame_number": 662, "display_filter": "frame.number == 662", "timestamp_epoch": "1575413160.952787000" }, { "tcp_stream": 35, "frame_number": 675, "display_filter": "frame.number == 675", "timestamp_epoch": "1575413160.953563000" } ], "is_private": null, "observable_id": "observable-0e0896daeedefb950896f7fd", "last_seen_epoch": "1575413160.953563000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413160.335721000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "fo-fd-world-new.yax.gysm.yahoodns.net", "evidence": [ { "udp_stream": 69, "frame_number": 8646, "display_filter": "frame.number == 8646", "timestamp_epoch": "1575413260.432992000" } ], "is_private": null, "observable_id": "observable-9bb57fe7b0daff63be7c20b0", "last_seen_epoch": "1575413260.432992000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413260.432992000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "fonts.googleapis.com", "evidence": [ { "udp_stream": 65, "frame_number": 8238, "display_filter": "frame.number == 8238", "timestamp_epoch": "1575413258.535495000" }, { "udp_stream": 65, "frame_number": 8315, "display_filter": "frame.number == 8315", "timestamp_epoch": "1575413258.762246000" }, { "tcp_stream": 173, "frame_number": 8390, "display_filter": "frame.number == 8390", "timestamp_epoch": "1575413259.082074000" }, { "tcp_stream": 172, "frame_number": 8392, "display_filter": "frame.number == 8392", "timestamp_epoch": "1575413259.082670000" } ], "is_private": null, "observable_id": "observable-1ecd2bb276a8fe143e19fe49", "last_seen_epoch": "1575413259.082670000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413258.535495000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "fonts.gstatic.com", "evidence": [ { "udp_stream": 67, "frame_number": 8582, "display_filter": "frame.number == 8582", "timestamp_epoch": "1575413259.995926000" }, { "udp_stream": 67, "frame_number": 8615, "display_filter": "frame.number == 8615", "timestamp_epoch": "1575413260.271166000" }, { "tcp_stream": 180, "frame_number": 8659, "display_filter": "frame.number == 8659", "timestamp_epoch": "1575413260.503407000" }, { "tcp_stream": 178, "frame_number": 8660, "display_filter": "frame.number == 8660", "timestamp_epoch": "1575413260.503755000" }, { "tcp_stream": 181, "frame_number": 8663, "display_filter": "frame.number == 8663", "timestamp_epoch": "1575413260.504466000" }, { "tcp_stream": 179, "frame_number": 8665, "display_filter": "frame.number == 8665", "timestamp_epoch": "1575413260.504684000" }, { "tcp_stream": 182, "frame_number": 8669, "display_filter": "frame.number == 8669", "timestamp_epoch": "1575413260.507679000" } ], "is_private": null, "observable_id": "observable-a101666ba0044e36e8f06d55", "last_seen_epoch": "1575413260.507679000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413259.995926000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "geo.moatads.com", "evidence": [ { "udp_stream": 26, "frame_number": 1430, "display_filter": "frame.number == 1430", "timestamp_epoch": "1575413164.247294000" }, { "udp_stream": 26, "frame_number": 2059, "display_filter": "frame.number == 2059", "timestamp_epoch": "1575413165.536404000" }, { "udp_stream": 26, "frame_number": 2223, "display_filter": "frame.number == 2223", "timestamp_epoch": "1575413165.992964000" }, { "tcp_stream": 57, "frame_number": 2472, "display_filter": "frame.number == 2472", "timestamp_epoch": "1575413166.399229000" }, { "tcp_stream": 58, "frame_number": 2474, "display_filter": "frame.number == 2474", "timestamp_epoch": "1575413166.399383000" } ], "is_private": null, "observable_id": "observable-21b25939081833ab55750753", "last_seen_epoch": "1575413166.399383000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413164.247294000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "geo.yahoo.com", "evidence": [ { "udp_stream": 17, "frame_number": 640, "display_filter": "frame.number == 640", "timestamp_epoch": "1575413160.316417000" }, { "udp_stream": 17, "frame_number": 647, "display_filter": "frame.number == 647", "timestamp_epoch": "1575413160.623478000" }, { "tcp_stream": 36, "frame_number": 678, "display_filter": "frame.number == 678", "timestamp_epoch": "1575413160.953856000" }, { "tcp_stream": 38, "frame_number": 680, "display_filter": "frame.number == 680", "timestamp_epoch": "1575413160.953961000" }, { "tcp_stream": 72, "frame_number": 2896, "display_filter": "frame.number == 2896", "timestamp_epoch": "1575413185.224964000" }, { "tcp_stream": 73, "frame_number": 2900, "display_filter": "frame.number == 2900", "timestamp_epoch": "1575413185.235960000" }, { "tcp_stream": 87, "frame_number": 3613, "display_filter": "frame.number == 3613", "timestamp_epoch": "1575413213.214158000" }, { "tcp_stream": 90, "frame_number": 3754, "display_filter": "frame.number == 3754", "timestamp_epoch": "1575413237.455051000" }, { "tcp_stream": 91, "frame_number": 3758, "display_filter": "frame.number == 3758", "timestamp_epoch": "1575413237.465842000" }, { "tcp_stream": 128, "frame_number": 6544, "display_filter": "frame.number == 6544", "timestamp_epoch": "1575413250.119831000" } ], "is_private": null, "observable_id": "observable-433a641dc351a0c326074469", "last_seen_epoch": "1575413250.119831000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413160.316417000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "geoycpi-uno.gycpi.b.yahoodns.net", "evidence": [ { "udp_stream": 4, "frame_number": 276, "display_filter": "frame.number == 276", "timestamp_epoch": "1575413155.227694000" } ], "is_private": null, "observable_id": "observable-bef060f14df6552cf2a8ef88", "last_seen_epoch": "1575413155.227694000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413155.227694000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "go.microsoft.com", "evidence": [ { "udp_stream": 117, "frame_number": 12700, "display_filter": "frame.number == 12700", "timestamp_epoch": "1575413305.285884000" }, { "udp_stream": 117, "frame_number": 12826, "display_filter": "frame.number == 12826", "timestamp_epoch": "1575413305.449366000" }, { "tcp_stream": 329, "frame_number": 12951, "display_filter": "frame.number == 12951", "timestamp_epoch": "1575413305.661450000" } ], "is_private": null, "observable_id": "observable-d644a63266e91fd324da5b44", "last_seen_epoch": "1575413305.661450000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413305.285884000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "googleads.g.doubleclick.net", "evidence": [ { "udp_stream": 74, "frame_number": 9288, "display_filter": "frame.number == 9288", "timestamp_epoch": "1575413262.571454000" }, { "udp_stream": 74, "frame_number": 9306, "display_filter": "frame.number == 9306", "timestamp_epoch": "1575413262.640954000" }, { "tcp_stream": 195, "frame_number": 9367, "display_filter": "frame.number == 9367", "timestamp_epoch": "1575413262.720347000" }, { "tcp_stream": 197, "frame_number": 9379, "display_filter": "frame.number == 9379", "timestamp_epoch": "1575413262.735724000" }, { "tcp_stream": 309, "frame_number": 12668, "display_filter": "frame.number == 12668", "timestamp_epoch": "1575413305.253173000" }, { "tcp_stream": 310, "frame_number": 12677, "display_filter": "frame.number == 12677", "timestamp_epoch": "1575413305.256655000" } ], "is_private": null, "observable_id": "observable-b435ca743935f6703dad9358", "last_seen_epoch": "1575413305.256655000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.571454000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "googleads4.g.doubleclick.net", "evidence": [ { "udp_stream": 63, "frame_number": 8116, "display_filter": "frame.number == 8116", "timestamp_epoch": "1575413258.171271000" }, { "udp_stream": 63, "frame_number": 8199, "display_filter": "frame.number == 8199", "timestamp_epoch": "1575413258.370803000" }, { "tcp_stream": 161, "frame_number": 8224, "display_filter": "frame.number == 8224", "timestamp_epoch": "1575413258.484254000" }, { "tcp_stream": 160, "frame_number": 8236, "display_filter": "frame.number == 8236", "timestamp_epoch": "1575413258.496522000" } ], "is_private": null, "observable_id": "observable-f2151bfd24e041600180e837", "last_seen_epoch": "1575413258.496522000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413258.171271000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "gstaticadssl.l.google.com", "evidence": [ { "udp_stream": 67, "frame_number": 8615, "display_filter": "frame.number == 8615", "timestamp_epoch": "1575413260.271166000" } ], "is_private": null, "observable_id": "observable-d75c164547da339fe492938b", "last_seen_epoch": "1575413260.271166000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413260.271166000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "guce.advertising.com", "evidence": [ { "udp_stream": 40, "frame_number": 3836, "display_filter": "frame.number == 3836", "timestamp_epoch": "1575413238.467239000" }, { "udp_stream": 40, "frame_number": 3837, "display_filter": "frame.number == 3837", "timestamp_epoch": "1575413238.558263000" }, { "tcp_stream": 94, "frame_number": 3844, "display_filter": "frame.number == 3844", "timestamp_epoch": "1575413238.657727000" }, { "tcp_stream": 95, "frame_number": 3845, "display_filter": "frame.number == 3845", "timestamp_epoch": "1575413238.657823000" } ], "is_private": null, "observable_id": "observable-a0f4a132ff9c49af306eca47", "last_seen_epoch": "1575413238.657823000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413238.467239000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "guce.aol.com", "evidence": [ { "udp_stream": 39, "frame_number": 3794, "display_filter": "frame.number == 3794", "timestamp_epoch": "1575413237.817285000" }, { "udp_stream": 39, "frame_number": 3795, "display_filter": "frame.number == 3795", "timestamp_epoch": "1575413237.897960000" }, { "tcp_stream": 92, "frame_number": 3800, "display_filter": "frame.number == 3800", "timestamp_epoch": "1575413237.982876000" }, { "tcp_stream": 93, "frame_number": 3804, "display_filter": "frame.number == 3804", "timestamp_epoch": "1575413237.989740000" } ], "is_private": null, "observable_id": "observable-4f087341ffe14e5fdcf290ad", "last_seen_epoch": "1575413237.989740000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413237.817285000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "gxp2.mail.aol.com", "evidence": [ { "udp_stream": 43, "frame_number": 4873, "display_filter": "frame.number == 4873", "timestamp_epoch": "1575413246.231562000" }, { "udp_stream": 43, "frame_number": 4892, "display_filter": "frame.number == 4892", "timestamp_epoch": "1575413246.304051000" }, { "tcp_stream": 110, "frame_number": 4947, "display_filter": "frame.number == 4947", "timestamp_epoch": "1575413246.523761000" }, { "tcp_stream": 109, "frame_number": 4949, "display_filter": "frame.number == 4949", "timestamp_epoch": "1575413246.524008000" } ], "is_private": null, "observable_id": "observable-23fcbd1b6899af2fa0be7f69", "last_seen_epoch": "1575413246.524008000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413246.231562000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "h1.wensa.at", "evidence": [ { "udp_stream": 159, "frame_number": 16148, "display_filter": "frame.number == 16148", "timestamp_epoch": "1575413455.165434000" }, { "udp_stream": 159, "frame_number": 16149, "display_filter": "frame.number == 16149", "timestamp_epoch": "1575413455.357740000" }, { "udp_stream": 160, "frame_number": 16159, "display_filter": "frame.number == 16159", "timestamp_epoch": "1575413456.141997000" }, { "udp_stream": 160, "frame_number": 16160, "display_filter": "frame.number == 16160", "timestamp_epoch": "1575413456.425216000" }, { "udp_stream": 161, "frame_number": 16178, "display_filter": "frame.number == 16178", "timestamp_epoch": "1575413457.348260000" }, { "udp_stream": 161, "frame_number": 16179, "display_filter": "frame.number == 16179", "timestamp_epoch": "1575413457.526856000" }, { "udp_stream": 162, "frame_number": 16195, "display_filter": "frame.number == 16195", "timestamp_epoch": "1575413468.491491000" }, { "udp_stream": 162, "frame_number": 16196, "display_filter": "frame.number == 16196", "timestamp_epoch": "1575413468.760703000" }, { "udp_stream": 163, "frame_number": 16208, "display_filter": "frame.number == 16208", "timestamp_epoch": "1575413469.615843000" }, { "udp_stream": 163, "frame_number": 16209, "display_filter": "frame.number == 16209", "timestamp_epoch": "1575413469.819055000" }, { "udp_stream": 164, "frame_number": 16308, "display_filter": "frame.number == 16308", "timestamp_epoch": "1575413756.153041000" }, { "udp_stream": 164, "frame_number": 16309, "display_filter": "frame.number == 16309", "timestamp_epoch": "1575413756.347599000" }, { "udp_stream": 165, "frame_number": 16431, "display_filter": "frame.number == 16431", "timestamp_epoch": "1575414056.144786000" }, { "udp_stream": 165, "frame_number": 16432, "display_filter": "frame.number == 16432", "timestamp_epoch": "1575414056.349092000" }, { "udp_stream": 166, "frame_number": 16442, "display_filter": "frame.number == 16442", "timestamp_epoch": "1575414057.220629000" }, { "udp_stream": 166, "frame_number": 16443, "display_filter": "frame.number == 16443", "timestamp_epoch": "1575414057.413839000" }, { "udp_stream": 168, "frame_number": 16486, "display_filter": "frame.number == 16486", "timestamp_epoch": "1575414357.231323000" }, { "udp_stream": 168, "frame_number": 16487, "display_filter": "frame.number == 16487", "timestamp_epoch": "1575414357.417756000" }, { "udp_stream": 190, "frame_number": 21098, "display_filter": "frame.number == 21098", "timestamp_epoch": "1575414657.235731000" }, { "udp_stream": 190, "frame_number": 21099, "display_filter": "frame.number == 21099", "timestamp_epoch": "1575414657.443819000" } ], "is_private": null, "observable_id": "observable-31893647f5c0c7cc982f3a76", "last_seen_epoch": "1575414669.952174000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413455.165434000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "ib.adnxs.com", "evidence": [ { "udp_stream": 81, "frame_number": 9295, "display_filter": "frame.number == 9295", "timestamp_epoch": "1575413262.589105000" }, { "udp_stream": 81, "frame_number": 9344, "display_filter": "frame.number == 9344", "timestamp_epoch": "1575413262.653946000" }, { "tcp_stream": 211, "frame_number": 9439, "display_filter": "frame.number == 9439", "timestamp_epoch": "1575413262.854389000" }, { "tcp_stream": 212, "frame_number": 9445, "display_filter": "frame.number == 9445", "timestamp_epoch": "1575413262.859437000" }, { "tcp_stream": 324, "frame_number": 12745, "display_filter": "frame.number == 12745", "timestamp_epoch": "1575413305.323450000" }, { "tcp_stream": 323, "frame_number": 12747, "display_filter": "frame.number == 12747", "timestamp_epoch": "1575413305.323625000" } ], "is_private": null, "observable_id": "observable-43d502761133c22bac0209b2", "last_seen_epoch": "1575413305.323625000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.589105000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "iecvlist.microsoft.com", "evidence": [ { "udp_stream": 34, "frame_number": 2890, "display_filter": "frame.number == 2890", "timestamp_epoch": "1575413185.149414000" }, { "udp_stream": 34, "frame_number": 2902, "display_filter": "frame.number == 2902", "timestamp_epoch": "1575413185.249277000" }, { "tcp_stream": 74, "frame_number": 2909, "display_filter": "frame.number == 2909", "timestamp_epoch": "1575413185.320300000" }, { "tcp_stream": 77, "frame_number": 3030, "display_filter": "frame.number == 3030", "timestamp_epoch": "1575413185.747908000" }, { "tcp_stream": 78, "frame_number": 3032, "display_filter": "frame.number == 3032", "timestamp_epoch": "1575413185.748739000" }, { "tcp_stream": 477, "frame_number": 19408, "display_filter": "frame.number == 19408", "timestamp_epoch": "1575414513.780707000" }, { "tcp_stream": 478, "frame_number": 19410, "display_filter": "frame.number == 19410", "timestamp_epoch": "1575414513.781170000" } ], "is_private": null, "observable_id": "observable-a04182d0a119c4e17be36885", "last_seen_epoch": "1575414513.781170000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413185.149414000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "image2.pubmatic.com", "evidence": [ { "udp_stream": 108, "frame_number": 10829, "display_filter": "frame.number == 10829", "timestamp_epoch": "1575413267.830137000" }, { "udp_stream": 108, "frame_number": 10910, "display_filter": "frame.number == 10910", "timestamp_epoch": "1575413268.262916000" }, { "tcp_stream": 276, "frame_number": 11032, "display_filter": "frame.number == 11032", "timestamp_epoch": "1575413268.463232000" }, { "tcp_stream": 277, "frame_number": 11048, "display_filter": "frame.number == 11048", "timestamp_epoch": "1575413268.492173000" }, { "tcp_stream": 278, "frame_number": 11051, "display_filter": "frame.number == 11051", "timestamp_epoch": "1575413268.492523000" }, { "tcp_stream": 285, "frame_number": 11192, "display_filter": "frame.number == 11192", "timestamp_epoch": "1575413268.636080000" }, { "tcp_stream": 291, "frame_number": 11515, "display_filter": "frame.number == 11515", "timestamp_epoch": "1575413269.531034000" }, { "tcp_stream": 293, "frame_number": 11558, "display_filter": "frame.number == 11558", "timestamp_epoch": "1575413269.719299000" }, { "tcp_stream": 389, "frame_number": 13985, "display_filter": "frame.number == 13985", "timestamp_epoch": "1575413307.174430000" }, { "tcp_stream": 390, "frame_number": 13988, "display_filter": "frame.number == 13988", "timestamp_epoch": "1575413307.174741000" } ], "is_private": null, "observable_id": "observable-05ef48696bde9d3fec6089a7", "last_seen_epoch": "1575413307.174741000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413267.830137000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "image4.pubmatic.com", "evidence": [ { "udp_stream": 107, "frame_number": 10824, "display_filter": "frame.number == 10824", "timestamp_epoch": "1575413267.805499000" }, { "udp_stream": 107, "frame_number": 10924, "display_filter": "frame.number == 10924", "timestamp_epoch": "1575413268.273846000" }, { "tcp_stream": 279, "frame_number": 11050, "display_filter": "frame.number == 11050", "timestamp_epoch": "1575413268.492357000" }, { "tcp_stream": 280, "frame_number": 11065, "display_filter": "frame.number == 11065", "timestamp_epoch": "1575413268.498230000" } ], "is_private": null, "observable_id": "observable-10cc055c5fe6c3127ee2d4ff", "last_seen_epoch": "1575413268.498230000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413267.805499000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "image6.pubmatic.com", "evidence": [ { "udp_stream": 85, "frame_number": 9852, "display_filter": "frame.number == 9852", "timestamp_epoch": "1575413264.386247000" }, { "udp_stream": 85, "frame_number": 9934, "display_filter": "frame.number == 9934", "timestamp_epoch": "1575413264.714628000" }, { "tcp_stream": 230, "frame_number": 10022, "display_filter": "frame.number == 10022", "timestamp_epoch": "1575413265.023163000" }, { "tcp_stream": 229, "frame_number": 10047, "display_filter": "frame.number == 10047", "timestamp_epoch": "1575413265.135752000" }, { "tcp_stream": 327, "frame_number": 12757, "display_filter": "frame.number == 12757", "timestamp_epoch": "1575413305.324132000" }, { "tcp_stream": 328, "frame_number": 12777, "display_filter": "frame.number == 12777", "timestamp_epoch": "1575413305.343252000" } ], "is_private": null, "observable_id": "observable-4c0849e5cddf63ce17fe4848", "last_seen_epoch": "1575413305.343252000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413264.386247000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "login.aol.com", "evidence": [ { "udp_stream": 8, "frame_number": 398, "display_filter": "frame.number == 398", "timestamp_epoch": "1575413157.773625000" }, { "udp_stream": 8, "frame_number": 399, "display_filter": "frame.number == 399", "timestamp_epoch": "1575413157.843186000" }, { "tcp_stream": 28, "frame_number": 406, "display_filter": "frame.number == 406", "timestamp_epoch": "1575413157.957301000" }, { "tcp_stream": 29, "frame_number": 408, "display_filter": "frame.number == 408", "timestamp_epoch": "1575413157.957372000" }, { "tcp_stream": 82, "frame_number": 3212, "display_filter": "frame.number == 3212", "timestamp_epoch": "1575413209.121309000" }, { "tcp_stream": 81, "frame_number": 3216, "display_filter": "frame.number == 3216", "timestamp_epoch": "1575413209.125896000" } ], "is_private": null, "observable_id": "observable-285ff452b5cb6e0e74ca6455", "last_seen_epoch": "1575413209.125896000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413157.773625000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "m-node-alb-us-east-1-prod-530825477.us-east-1.elb.amazonaws.com", "evidence": [ { "udp_stream": 56, "frame_number": 7655, "display_filter": "frame.number == 7655", "timestamp_epoch": "1575413255.099136000" }, { "udp_stream": 71, "frame_number": 9152, "display_filter": "frame.number == 9152", "timestamp_epoch": "1575413262.342458000" } ], "is_private": null, "observable_id": "observable-36d7c19b3b18dcf78504ea04", "last_seen_epoch": "1575413262.342458000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413255.099136000" }, { "type": "domain", "roles": [ "dns-query", "http-host", "tls-sni" ], "value": "mail.aol.com", "evidence": [ { "udp_stream": 4, "frame_number": 275, "display_filter": "frame.number == 275", "timestamp_epoch": "1575413155.172788000" }, { "udp_stream": 4, "frame_number": 276, "display_filter": "frame.number == 276", "timestamp_epoch": "1575413155.227694000" }, { "tcp_stream": 22, "frame_number": 281, "display_filter": "frame.number == 281", "timestamp_epoch": "1575413155.938245000" }, { "tcp_stream": 23, "frame_number": 288, "display_filter": "frame.number == 288", "timestamp_epoch": "1575413156.177305000" }, { "tcp_stream": 100, "frame_number": 4036, "display_filter": "frame.number == 4036", "timestamp_epoch": "1575413242.848243000" }, { "tcp_stream": 101, "frame_number": 4044, "display_filter": "frame.number == 4044", "timestamp_epoch": "1575413242.859580000" }, { "tcp_stream": 419, "frame_number": 14824, "display_filter": "frame.number == 14824", "timestamp_epoch": "1575413366.025506000" }, { "tcp_stream": 432, "frame_number": 16227, "display_filter": "frame.number == 16227", "timestamp_epoch": "1575413486.057022000" }, { "tcp_stream": 433, "frame_number": 16287, "display_filter": "frame.number == 16287", "timestamp_epoch": "1575413726.073713000" }, { "tcp_stream": 435, "frame_number": 16334, "display_filter": "frame.number == 16334", "timestamp_epoch": "1575413845.995219000" }, { "tcp_stream": 436, "frame_number": 16338, "display_filter": "frame.number == 16338", "timestamp_epoch": "1575413846.003112000" }, { "tcp_stream": 437, "frame_number": 16342, "display_filter": "frame.number == 16342", "timestamp_epoch": "1575413846.029786000" } ], "is_private": null, "observable_id": "observable-76026d979017cfab95acf2f8", "last_seen_epoch": "1575413846.029786000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413155.172788000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "match-975362022.us-east-1.elb.amazonaws.com", "evidence": [ { "udp_stream": 75, "frame_number": 9334, "display_filter": "frame.number == 9334", "timestamp_epoch": "1575413262.647446000" } ], "is_private": null, "observable_id": "observable-2a4313ed252b9e5877876f0b", "last_seen_epoch": "1575413262.647446000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.647446000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "match.adsrvr.org", "evidence": [ { "udp_stream": 75, "frame_number": 9289, "display_filter": "frame.number == 9289", "timestamp_epoch": "1575413262.574246000" }, { "udp_stream": 75, "frame_number": 9334, "display_filter": "frame.number == 9334", "timestamp_epoch": "1575413262.647446000" }, { "tcp_stream": 203, "frame_number": 9409, "display_filter": "frame.number == 9409", "timestamp_epoch": "1575413262.794307000" }, { "tcp_stream": 204, "frame_number": 9411, "display_filter": "frame.number == 9411", "timestamp_epoch": "1575413262.794440000" }, { "tcp_stream": 314, "frame_number": 12711, "display_filter": "frame.number == 12711", "timestamp_epoch": "1575413305.291195000" }, { "tcp_stream": 313, "frame_number": 12719, "display_filter": "frame.number == 12719", "timestamp_epoch": "1575413305.295194000" } ], "is_private": null, "observable_id": "observable-573683686841d23c696138a4", "last_seen_epoch": "1575413305.295194000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.574246000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "match.prod.bidr.io", "evidence": [ { "udp_stream": 92, "frame_number": 9907, "display_filter": "frame.number == 9907", "timestamp_epoch": "1575413264.560359000" }, { "udp_stream": 92, "frame_number": 9982, "display_filter": "frame.number == 9982", "timestamp_epoch": "1575413264.913423000" }, { "tcp_stream": 239, "frame_number": 10110, "display_filter": "frame.number == 10110", "timestamp_epoch": "1575413265.188216000" }, { "tcp_stream": 240, "frame_number": 10111, "display_filter": "frame.number == 10111", "timestamp_epoch": "1575413265.188358000" } ], "is_private": null, "observable_id": "observable-0fe67f2f5943cc0f3ba6612e", "last_seen_epoch": "1575413265.188358000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413264.560359000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "match.rundsp.com", "evidence": [ { "udp_stream": 106, "frame_number": 10802, "display_filter": "frame.number == 10802", "timestamp_epoch": "1575413267.665708000" }, { "udp_stream": 106, "frame_number": 10888, "display_filter": "frame.number == 10888", "timestamp_epoch": "1575413268.087189000" }, { "tcp_stream": 275, "frame_number": 11004, "display_filter": "frame.number == 11004", "timestamp_epoch": "1575413268.385846000" }, { "tcp_stream": 274, "frame_number": 11010, "display_filter": "frame.number == 11010", "timestamp_epoch": "1575413268.393109000" } ], "is_private": null, "observable_id": "observable-79f3faa6f04f0b4c9af13a93", "last_seen_epoch": "1575413268.393109000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413267.665708000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "match.taboola.com", "evidence": [ { "udp_stream": 133, "frame_number": 14021, "display_filter": "frame.number == 14021", "timestamp_epoch": "1575413307.237564000" }, { "udp_stream": 133, "frame_number": 14095, "display_filter": "frame.number == 14095", "timestamp_epoch": "1575413307.419283000" }, { "tcp_stream": 401, "frame_number": 14155, "display_filter": "frame.number == 14155", "timestamp_epoch": "1575413307.601114000" }, { "tcp_stream": 400, "frame_number": 14156, "display_filter": "frame.number == 14156", "timestamp_epoch": "1575413307.601203000" } ], "is_private": null, "observable_id": "observable-752dacb2399993cae2ce1c27", "last_seen_epoch": "1575413307.601203000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413307.237564000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "match.zorosrv.com", "evidence": [ { "udp_stream": 134, "frame_number": 14309, "display_filter": "frame.number == 14309", "timestamp_epoch": "1575413308.047524000" }, { "udp_stream": 134, "frame_number": 14321, "display_filter": "frame.number == 14321", "timestamp_epoch": "1575413308.123917000" }, { "tcp_stream": 407, "frame_number": 14334, "display_filter": "frame.number == 14334", "timestamp_epoch": "1575413308.175469000" }, { "tcp_stream": 408, "frame_number": 14338, "display_filter": "frame.number == 14338", "timestamp_epoch": "1575413308.187872000" } ], "is_private": null, "observable_id": "observable-ed3aa637e2ee6edf262dc3ac", "last_seen_epoch": "1575413308.187872000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413308.047524000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "matchuseast-1393638539.us-east-1.elb.amazonaws.com", "evidence": [ { "udp_stream": 106, "frame_number": 10888, "display_filter": "frame.number == 10888", "timestamp_epoch": "1575413268.087189000" } ], "is_private": null, "observable_id": "observable-ef5eaacb44eb88b3f43b8270", "last_seen_epoch": "1575413268.087189000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413268.087189000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "media-router-flurry1.prod.media.wg1.b.yahoo.com", "evidence": [ { "udp_stream": 49, "frame_number": 6460, "display_filter": "frame.number == 6460", "timestamp_epoch": "1575413250.068987000" } ], "is_private": null, "observable_id": "observable-224eb79bcc4d299028f69e40", "last_seen_epoch": "1575413250.068987000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413250.068987000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "myip.opendns.com", "evidence": [ { "udp_stream": 155, "frame_number": 16140, "display_filter": "frame.number == 16140", "timestamp_epoch": "1575413455.012126000" }, { "udp_stream": 156, "frame_number": 16141, "display_filter": "frame.number == 16141", "timestamp_epoch": "1575413455.012294000" }, { "udp_stream": 155, "frame_number": 16142, "display_filter": "frame.number == 16142", "timestamp_epoch": "1575413455.067315000" }, { "udp_stream": 157, "frame_number": 16143, "display_filter": "frame.number == 16143", "timestamp_epoch": "1575413455.070317000" }, { "udp_stream": 156, "frame_number": 16144, "display_filter": "frame.number == 16144", "timestamp_epoch": "1575413455.075680000" }, { "udp_stream": 158, "frame_number": 16145, "display_filter": "frame.number == 16145", "timestamp_epoch": "1575413455.078339000" }, { "udp_stream": 157, "frame_number": 16146, "display_filter": "frame.number == 16146", "timestamp_epoch": "1575413455.131069000" }, { "udp_stream": 158, "frame_number": 16147, "display_filter": "frame.number == 16147", "timestamp_epoch": "1575413455.140510000" } ], "is_private": null, "observable_id": "observable-8b967e85f04e1de2bcfeed75", "last_seen_epoch": "1575413455.140510000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413455.012126000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "myip.opendns.com.icemaiden.com", "evidence": [ { "udp_stream": 151, "frame_number": 16135, "display_filter": "frame.number == 16135", "timestamp_epoch": "1575413450.992534000" }, { "udp_stream": 152, "frame_number": 16137, "display_filter": "frame.number == 16137", "timestamp_epoch": "1575413450.995863000" }, { "udp_stream": 153, "frame_number": 16138, "display_filter": "frame.number == 16138", "timestamp_epoch": "1575413452.999333000" }, { "udp_stream": 154, "frame_number": 16139, "display_filter": "frame.number == 16139", "timestamp_epoch": "1575413452.999457000" }, { "udp_stream": 152, "frame_number": 16168, "display_filter": "frame.number == 16168", "timestamp_epoch": "1575413457.097506000" }, { "udp_stream": 151, "frame_number": 16169, "display_filter": "frame.number == 16169", "timestamp_epoch": "1575413457.100534000" }, { "udp_stream": 153, "frame_number": 16191, "display_filter": "frame.number == 16191", "timestamp_epoch": "1575413459.043562000" }, { "udp_stream": 154, "frame_number": 16192, "display_filter": "frame.number == 16192", "timestamp_epoch": "1575413459.051947000" } ], "is_private": null, "observable_id": "observable-c201ea6cfeef25850f3162e6", "last_seen_epoch": "1575413459.051947000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413450.992534000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "o.aolcdn.com", "evidence": [ { "udp_stream": 47, "frame_number": 5344, "display_filter": "frame.number == 5344", "timestamp_epoch": "1575413248.190906000" }, { "udp_stream": 47, "frame_number": 5418, "display_filter": "frame.number == 5418", "timestamp_epoch": "1575413248.467142000" }, { "tcp_stream": 118, "frame_number": 5569, "display_filter": "frame.number == 5569", "timestamp_epoch": "1575413248.615528000" }, { "tcp_stream": 119, "frame_number": 5577, "display_filter": "frame.number == 5577", "timestamp_epoch": "1575413248.637510000" }, { "tcp_stream": 125, "frame_number": 6389, "display_filter": "frame.number == 6389", "timestamp_epoch": "1575413249.886098000" }, { "tcp_stream": 124, "frame_number": 6392, "display_filter": "frame.number == 6392", "timestamp_epoch": "1575413249.886410000" }, { "tcp_stream": 122, "frame_number": 6394, "display_filter": "frame.number == 6394", "timestamp_epoch": "1575413249.886633000" }, { "tcp_stream": 123, "frame_number": 6396, "display_filter": "frame.number == 6396", "timestamp_epoch": "1575413249.887009000" }, { "tcp_stream": 127, "frame_number": 6416, "display_filter": "frame.number == 6416", "timestamp_epoch": "1575413250.007581000" }, { "tcp_stream": 126, "frame_number": 6418, "display_filter": "frame.number == 6418", "timestamp_epoch": "1575413250.007765000" }, { "tcp_stream": 131, "frame_number": 6711, "display_filter": "frame.number == 6711", "timestamp_epoch": "1575413250.560233000" }, { "tcp_stream": 132, "frame_number": 6714, "display_filter": "frame.number == 6714", "timestamp_epoch": "1575413250.560521000" } ], "is_private": null, "observable_id": "observable-f16fcabbbe6413c7cbfc6335", "last_seen_epoch": "1575413250.560521000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413248.190906000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "oao-js-tag.onemobile.yahoo.com", "evidence": [ { "udp_stream": 52, "frame_number": 7180, "display_filter": "frame.number == 7180", "timestamp_epoch": "1575413253.008581000" }, { "udp_stream": 52, "frame_number": 7233, "display_filter": "frame.number == 7233", "timestamp_epoch": "1575413253.235151000" }, { "tcp_stream": 138, "frame_number": 7386, "display_filter": "frame.number == 7386", "timestamp_epoch": "1575413253.561508000" }, { "tcp_stream": 139, "frame_number": 7401, "display_filter": "frame.number == 7401", "timestamp_epoch": "1575413253.562698000" }, { "tcp_stream": 300, "frame_number": 12546, "display_filter": "frame.number == 12546", "timestamp_epoch": "1575413304.110176000" }, { "tcp_stream": 299, "frame_number": 12547, "display_filter": "frame.number == 12547", "timestamp_epoch": "1575413304.110245000" } ], "is_private": null, "observable_id": "observable-b9e21b63c69ea2f706f22dba", "last_seen_epoch": "1575413304.110245000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413253.008581000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "oidc.mail.aol.com", "evidence": [ { "udp_stream": 6, "frame_number": 307, "display_filter": "frame.number == 307", "timestamp_epoch": "1575413156.673565000" }, { "udp_stream": 6, "frame_number": 308, "display_filter": "frame.number == 308", "timestamp_epoch": "1575413156.734046000" }, { "tcp_stream": 24, "frame_number": 313, "display_filter": "frame.number == 313", "timestamp_epoch": "1575413156.844944000" }, { "tcp_stream": 25, "frame_number": 317, "display_filter": "frame.number == 317", "timestamp_epoch": "1575413156.862203000" }, { "tcp_stream": 98, "frame_number": 3980, "display_filter": "frame.number == 3980", "timestamp_epoch": "1575413241.586415000" }, { "tcp_stream": 99, "frame_number": 3984, "display_filter": "frame.number == 3984", "timestamp_epoch": "1575413241.595025000" } ], "is_private": null, "observable_id": "observable-46734ba0502474bae253a387", "last_seen_epoch": "1575413241.595025000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413156.673565000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "opus.analytics.yahoo.com", "evidence": [ { "udp_stream": 20, "frame_number": 920, "display_filter": "frame.number == 920", "timestamp_epoch": "1575413162.714269000" }, { "udp_stream": 20, "frame_number": 928, "display_filter": "frame.number == 928", "timestamp_epoch": "1575413162.912415000" }, { "tcp_stream": 42, "frame_number": 962, "display_filter": "frame.number == 962", "timestamp_epoch": "1575413162.990597000" }, { "tcp_stream": 40, "frame_number": 972, "display_filter": "frame.number == 972", "timestamp_epoch": "1575413162.993109000" }, { "tcp_stream": 188, "frame_number": 9048, "display_filter": "frame.number == 9048", "timestamp_epoch": "1575413261.210715000" }, { "tcp_stream": 187, "frame_number": 9049, "display_filter": "frame.number == 9049", "timestamp_epoch": "1575413261.210773000" } ], "is_private": null, "observable_id": "observable-417a628958affe9af4406c2a", "last_seen_epoch": "1575413261.210773000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413162.714269000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "p.adsymptotic.com", "evidence": [ { "udp_stream": 98, "frame_number": 10765, "display_filter": "frame.number == 10765", "timestamp_epoch": "1575413267.635090000" }, { "udp_stream": 98, "frame_number": 10815, "display_filter": "frame.number == 10815", "timestamp_epoch": "1575413267.789823000" }, { "tcp_stream": 258, "frame_number": 10915, "display_filter": "frame.number == 10915", "timestamp_epoch": "1575413268.263420000" }, { "tcp_stream": 259, "frame_number": 10929, "display_filter": "frame.number == 10929", "timestamp_epoch": "1575413268.275131000" }, { "tcp_stream": 361, "frame_number": 13349, "display_filter": "frame.number == 13349", "timestamp_epoch": "1575413306.301316000" }, { "tcp_stream": 362, "frame_number": 13355, "display_filter": "frame.number == 13355", "timestamp_epoch": "1575413306.306691000" } ], "is_private": null, "observable_id": "observable-b84bdb241c6ec12751704e85", "last_seen_epoch": "1575413306.306691000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413267.635090000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "p.rfihub.com", "evidence": [ { "udp_stream": 86, "frame_number": 9893, "display_filter": "frame.number == 9893", "timestamp_epoch": "1575413264.532818000" }, { "udp_stream": 86, "frame_number": 9983, "display_filter": "frame.number == 9983", "timestamp_epoch": "1575413264.913538000" }, { "tcp_stream": 237, "frame_number": 10108, "display_filter": "frame.number == 10108", "timestamp_epoch": "1575413265.188012000" }, { "tcp_stream": 238, "frame_number": 10109, "display_filter": "frame.number == 10109", "timestamp_epoch": "1575413265.188160000" } ], "is_private": null, "observable_id": "observable-5c411958409e4dac146b7a46", "last_seen_epoch": "1575413265.188160000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413264.532818000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "pagead-googlehosted.l.google.com", "evidence": [ { "udp_stream": 58, "frame_number": 7823, "display_filter": "frame.number == 7823", "timestamp_epoch": "1575413255.913526000" } ], "is_private": null, "observable_id": "observable-031fabd00ce17948d744c88f", "last_seen_epoch": "1575413255.913526000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413255.913526000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "pagead.l.doubleclick.net", "evidence": [ { "udp_stream": 63, "frame_number": 8199, "display_filter": "frame.number == 8199", "timestamp_epoch": "1575413258.370803000" }, { "udp_stream": 72, "frame_number": 9322, "display_filter": "frame.number == 9322", "timestamp_epoch": "1575413262.643180000" } ], "is_private": null, "observable_id": "observable-7d206dcea8f25727df66bb52", "last_seen_epoch": "1575413262.643180000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413258.370803000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "pagead2.googlesyndication.com", "evidence": [ { "udp_stream": 59, "frame_number": 7967, "display_filter": "frame.number == 7967", "timestamp_epoch": "1575413256.911444000" }, { "udp_stream": 59, "frame_number": 7972, "display_filter": "frame.number == 7972", "timestamp_epoch": "1575413257.008584000" }, { "tcp_stream": 152, "frame_number": 7977, "display_filter": "frame.number == 7977", "timestamp_epoch": "1575413257.092361000" }, { "tcp_stream": 153, "frame_number": 7981, "display_filter": "frame.number == 7981", "timestamp_epoch": "1575413257.101753000" } ], "is_private": null, "observable_id": "observable-989a34518134d51e6101b89b", "last_seen_epoch": "1575413257.101753000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413256.911444000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "pagead46.l.doubleclick.net", "evidence": [ { "udp_stream": 57, "frame_number": 7658, "display_filter": "frame.number == 7658", "timestamp_epoch": "1575413255.123657000" }, { "udp_stream": 59, "frame_number": 7972, "display_filter": "frame.number == 7972", "timestamp_epoch": "1575413257.008584000" }, { "udp_stream": 74, "frame_number": 9306, "display_filter": "frame.number == 9306", "timestamp_epoch": "1575413262.640954000" } ], "is_private": null, "observable_id": "observable-77f71ee548a7d91604668eaf", "last_seen_epoch": "1575413262.640954000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413255.123657000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "pixel-a.sitescout.com", "evidence": [ { "udp_stream": 101, "frame_number": 10850, "display_filter": "frame.number == 10850", "timestamp_epoch": "1575413267.965591000" } ], "is_private": null, "observable_id": "observable-5dab12271fd8ecea3a06d68a", "last_seen_epoch": "1575413267.965591000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413267.965591000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "pixel-origin.mathtag.com", "evidence": [ { "udp_stream": 77, "frame_number": 9305, "display_filter": "frame.number == 9305", "timestamp_epoch": "1575413262.640867000" } ], "is_private": null, "observable_id": "observable-17aace6bd86e7b2781ae5609", "last_seen_epoch": "1575413262.640867000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.640867000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "pixel-sync.sitescout.com", "evidence": [ { "udp_stream": 101, "frame_number": 10787, "display_filter": "frame.number == 10787", "timestamp_epoch": "1575413267.655554000" }, { "udp_stream": 101, "frame_number": 10850, "display_filter": "frame.number == 10850", "timestamp_epoch": "1575413267.965591000" }, { "tcp_stream": 265, "frame_number": 10972, "display_filter": "frame.number == 10972", "timestamp_epoch": "1575413268.314920000" }, { "tcp_stream": 264, "frame_number": 10976, "display_filter": "frame.number == 10976", "timestamp_epoch": "1575413268.333871000" } ], "is_private": null, "observable_id": "observable-53f279a9261a60feb6b94e65", "last_seen_epoch": "1575413268.333871000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413267.655554000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "pixel.advertising.com", "evidence": [ { "udp_stream": 73, "frame_number": 9286, "display_filter": "frame.number == 9286", "timestamp_epoch": "1575413262.570113000" }, { "udp_stream": 73, "frame_number": 9324, "display_filter": "frame.number == 9324", "timestamp_epoch": "1575413262.643694000" }, { "tcp_stream": 205, "frame_number": 9423, "display_filter": "frame.number == 9423", "timestamp_epoch": "1575413262.804456000" }, { "tcp_stream": 206, "frame_number": 9429, "display_filter": "frame.number == 9429", "timestamp_epoch": "1575413262.820301000" }, { "tcp_stream": 220, "frame_number": 9826, "display_filter": "frame.number == 9826", "timestamp_epoch": "1575413264.158665000" }, { "tcp_stream": 219, "frame_number": 9831, "display_filter": "frame.number == 9831", "timestamp_epoch": "1575413264.161621000" }, { "tcp_stream": 221, "frame_number": 9839, "display_filter": "frame.number == 9839", "timestamp_epoch": "1575413264.190485000" }, { "tcp_stream": 222, "frame_number": 9903, "display_filter": "frame.number == 9903", "timestamp_epoch": "1575413264.551307000" }, { "tcp_stream": 307, "frame_number": 12692, "display_filter": "frame.number == 12692", "timestamp_epoch": "1575413305.278668000" }, { "tcp_stream": 308, "frame_number": 12698, "display_filter": "frame.number == 12698", "timestamp_epoch": "1575413305.285416000" }, { "tcp_stream": 331, "frame_number": 12987, "display_filter": "frame.number == 12987", "timestamp_epoch": "1575413305.850256000" }, { "tcp_stream": 334, "frame_number": 13033, "display_filter": "frame.number == 13033", "timestamp_epoch": "1575413305.970868000" }, { "tcp_stream": 335, "frame_number": 13068, "display_filter": "frame.number == 13068", "timestamp_epoch": "1575413306.051550000" }, { "tcp_stream": 336, "frame_number": 13072, "display_filter": "frame.number == 13072", "timestamp_epoch": "1575413306.055922000" } ], "is_private": null, "observable_id": "observable-56e3b40bc13b8222ed259e63", "last_seen_epoch": "1575413306.055922000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.570113000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "pixel.quantserve.com", "evidence": [ { "udp_stream": 82, "frame_number": 9296, "display_filter": "frame.number == 9296", "timestamp_epoch": "1575413262.590656000" }, { "udp_stream": 82, "frame_number": 9360, "display_filter": "frame.number == 9360", "timestamp_epoch": "1575413262.717743000" }, { "tcp_stream": 217, "frame_number": 9477, "display_filter": "frame.number == 9477", "timestamp_epoch": "1575413262.891237000" }, { "tcp_stream": 218, "frame_number": 9489, "display_filter": "frame.number == 9489", "timestamp_epoch": "1575413262.912758000" }, { "tcp_stream": 325, "frame_number": 12761, "display_filter": "frame.number == 12761", "timestamp_epoch": "1575413305.324462000" }, { "tcp_stream": 326, "frame_number": 12763, "display_filter": "frame.number == 12763", "timestamp_epoch": "1575413305.324617000" } ], "is_private": null, "observable_id": "observable-800980b5d5df4f3e741d3a56", "last_seen_epoch": "1575413305.324617000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.590656000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "pixel.tapad.com", "evidence": [ { "udp_stream": 132, "frame_number": 13991, "display_filter": "frame.number == 13991", "timestamp_epoch": "1575413307.175029000" }, { "udp_stream": 132, "frame_number": 14090, "display_filter": "frame.number == 14090", "timestamp_epoch": "1575413307.406763000" }, { "tcp_stream": 399, "frame_number": 14145, "display_filter": "frame.number == 14145", "timestamp_epoch": "1575413307.595452000" }, { "tcp_stream": 398, "frame_number": 14149, "display_filter": "frame.number == 14149", "timestamp_epoch": "1575413307.596410000" } ], "is_private": null, "observable_id": "observable-3b094461d1602835f7d1843e", "last_seen_epoch": "1575413307.596410000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413307.175029000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "pm.w55c.net", "evidence": [ { "udp_stream": 87, "frame_number": 9894, "display_filter": "frame.number == 9894", "timestamp_epoch": "1575413264.533633000" }, { "udp_stream": 87, "frame_number": 9974, "display_filter": "frame.number == 9974", "timestamp_epoch": "1575413264.859950000" }, { "tcp_stream": 233, "frame_number": 10076, "display_filter": "frame.number == 10076", "timestamp_epoch": "1575413265.180775000" }, { "tcp_stream": 234, "frame_number": 10107, "display_filter": "frame.number == 10107", "timestamp_epoch": "1575413265.187818000" }, { "tcp_stream": 341, "frame_number": 13107, "display_filter": "frame.number == 13107", "timestamp_epoch": "1575413306.090359000" }, { "tcp_stream": 342, "frame_number": 13125, "display_filter": "frame.number == 13125", "timestamp_epoch": "1575413306.124143000" } ], "is_private": null, "observable_id": "observable-8b91c5b8304afcdb836bdf05", "last_seen_epoch": "1575413306.124143000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413264.533633000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "pmp.mxptint.net", "evidence": [ { "udp_stream": 104, "frame_number": 10794, "display_filter": "frame.number == 10794", "timestamp_epoch": "1575413267.660148000" }, { "udp_stream": 104, "frame_number": 10858, "display_filter": "frame.number == 10858", "timestamp_epoch": "1575413267.969283000" }, { "tcp_stream": 268, "frame_number": 10964, "display_filter": "frame.number == 10964", "timestamp_epoch": "1575413268.302484000" }, { "tcp_stream": 269, "frame_number": 10965, "display_filter": "frame.number == 10965", "timestamp_epoch": "1575413268.302562000" } ], "is_private": null, "observable_id": "observable-d5c4addb65d3ccd4113ac6f4", "last_seen_epoch": "1575413268.302562000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413267.660148000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "pr-bh.ybp.yahoo.com", "evidence": [ { "udp_stream": 83, "frame_number": 9748, "display_filter": "frame.number == 9748", "timestamp_epoch": "1575413263.778707000" }, { "udp_stream": 83, "frame_number": 9810, "display_filter": "frame.number == 9810", "timestamp_epoch": "1575413264.126151000" }, { "tcp_stream": 224, "frame_number": 9917, "display_filter": "frame.number == 9917", "timestamp_epoch": "1575413264.686859000" }, { "tcp_stream": 223, "frame_number": 9928, "display_filter": "frame.number == 9928", "timestamp_epoch": "1575413264.710393000" }, { "tcp_stream": 332, "frame_number": 13017, "display_filter": "frame.number == 13017", "timestamp_epoch": "1575413305.959219000" }, { "tcp_stream": 333, "frame_number": 13029, "display_filter": "frame.number == 13029", "timestamp_epoch": "1575413305.965354000" } ], "is_private": null, "observable_id": "observable-5fa076919fc50b1a0c413556", "last_seen_epoch": "1575413305.965354000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413263.778707000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "prod-lb-10-490190718.us-east-1.elb.amazonaws.com", "evidence": [ { "udp_stream": 184, "frame_number": 17359, "display_filter": "frame.number == 17359", "timestamp_epoch": "1575414489.334625000" }, { "udp_stream": 185, "frame_number": 17386, "display_filter": "frame.number == 17386", "timestamp_epoch": "1575414489.544905000" } ], "is_private": null, "observable_id": "observable-5b7302d8816de737b27a04de", "last_seen_epoch": "1575414489.544905000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414489.334625000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "prod-lb-13-1730166618.us-east-1.elb.amazonaws.com", "evidence": [ { "udp_stream": 189, "frame_number": 18913, "display_filter": "frame.number == 18913", "timestamp_epoch": "1575414494.106735000" } ], "is_private": null, "observable_id": "observable-1ef520f2bf32d0b1064d1b42", "last_seen_epoch": "1575414494.106735000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414494.106735000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "prod-lb-8-1772099769.us-east-1.elb.amazonaws.com", "evidence": [ { "udp_stream": 182, "frame_number": 17363, "display_filter": "frame.number == 17363", "timestamp_epoch": "1575414489.352624000" } ], "is_private": null, "observable_id": "observable-25976c10c301eb50ffd9077e", "last_seen_epoch": "1575414489.352624000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414489.352624000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "prod-lb-9-1476932994.us-east-1.elb.amazonaws.com", "evidence": [ { "udp_stream": 183, "frame_number": 17364, "display_filter": "frame.number == 17364", "timestamp_epoch": "1575414489.352724000" } ], "is_private": null, "observable_id": "observable-0c357a35f9c7c5bdec9481e3", "last_seen_epoch": "1575414489.352724000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414489.352724000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "prod-m-node-1111.ssp.advertising.com", "evidence": [ { "udp_stream": 56, "frame_number": 7650, "display_filter": "frame.number == 7650", "timestamp_epoch": "1575413255.026754000" }, { "udp_stream": 56, "frame_number": 7655, "display_filter": "frame.number == 7655", "timestamp_epoch": "1575413255.099136000" }, { "tcp_stream": 145, "frame_number": 7681, "display_filter": "frame.number == 7681", "timestamp_epoch": "1575413255.191849000" }, { "tcp_stream": 144, "frame_number": 7683, "display_filter": "frame.number == 7683", "timestamp_epoch": "1575413255.192007000" } ], "is_private": null, "observable_id": "observable-b54b867b83bde222cbb0d403", "last_seen_epoch": "1575413255.192007000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413255.026754000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "prod.contextweb.map.fastlylb.net", "evidence": [ { "udp_stream": 16, "frame_number": 13337, "display_filter": "frame.number == 13337", "timestamp_epoch": "1575413306.294911000" } ], "is_private": null, "observable_id": "observable-9b2ffba1f40b340a7e40b780", "last_seen_epoch": "1575413306.294911000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413306.294911000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "prod.gxp.pse.public.aol.com", "evidence": [ { "udp_stream": 43, "frame_number": 4892, "display_filter": "frame.number == 4892", "timestamp_epoch": "1575413246.304051000" } ], "is_private": null, "observable_id": "observable-481ec601c3a2027f9d6f6c85", "last_seen_epoch": "1575413246.304051000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413246.304051000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "prod.ups-yahoo.aolp-ds-prd.aws.oath.cloud", "evidence": [ { "udp_stream": 84, "frame_number": 9864, "display_filter": "frame.number == 9864", "timestamp_epoch": "1575413264.518110000" } ], "is_private": null, "observable_id": "observable-b7fdf827e1feba830b1e43a9", "last_seen_epoch": "1575413264.518110000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413264.518110000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "pubmatic-match.dotomi.com", "evidence": [ { "udp_stream": 102, "frame_number": 10790, "display_filter": "frame.number == 10790", "timestamp_epoch": "1575413267.656198000" }, { "udp_stream": 102, "frame_number": 10873, "display_filter": "frame.number == 10873", "timestamp_epoch": "1575413268.023538000" }, { "tcp_stream": 270, "frame_number": 10988, "display_filter": "frame.number == 10988", "timestamp_epoch": "1575413268.347144000" }, { "tcp_stream": 271, "frame_number": 10998, "display_filter": "frame.number == 10998", "timestamp_epoch": "1575413268.361812000" } ], "is_private": null, "observable_id": "observable-f31208813a865270d769da72", "last_seen_epoch": "1575413268.361812000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413267.656198000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "pubmatic2waycm-atl.netmng.com", "evidence": [ { "udp_stream": 129, "frame_number": 13200, "display_filter": "frame.number == 13200", "timestamp_epoch": "1575413306.158220000" }, { "udp_stream": 129, "frame_number": 13307, "display_filter": "frame.number == 13307", "timestamp_epoch": "1575413306.288918000" }, { "tcp_stream": 373, "frame_number": 13530, "display_filter": "frame.number == 13530", "timestamp_epoch": "1575413306.471385000" }, { "tcp_stream": 375, "frame_number": 13532, "display_filter": "frame.number == 13532", "timestamp_epoch": "1575413306.471738000" } ], "is_private": null, "observable_id": "observable-4e65b7432b29bd6dacb1e0b5", "last_seen_epoch": "1575413306.471738000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413306.158220000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "px.adhigh.net", "evidence": [ { "udp_stream": 126, "frame_number": 13193, "display_filter": "frame.number == 13193", "timestamp_epoch": "1575413306.150408000" }, { "udp_stream": 126, "frame_number": 13408, "display_filter": "frame.number == 13408", "timestamp_epoch": "1575413306.386965000" }, { "tcp_stream": 385, "frame_number": 13609, "display_filter": "frame.number == 13609", "timestamp_epoch": "1575413306.599021000" }, { "tcp_stream": 386, "frame_number": 13610, "display_filter": "frame.number == 13610", "timestamp_epoch": "1575413306.599079000" } ], "is_private": null, "observable_id": "observable-c9cc81d4e17d62d082b5622e", "last_seen_epoch": "1575413306.599079000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413306.150408000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "px.moatads.com", "evidence": [ { "udp_stream": 55, "frame_number": 7649, "display_filter": "frame.number == 7649", "timestamp_epoch": "1575413255.007713000" }, { "udp_stream": 55, "frame_number": 7652, "display_filter": "frame.number == 7652", "timestamp_epoch": "1575413255.067988000" }, { "tcp_stream": 142, "frame_number": 7663, "display_filter": "frame.number == 7663", "timestamp_epoch": "1575413255.152653000" }, { "tcp_stream": 143, "frame_number": 7667, "display_filter": "frame.number == 7667", "timestamp_epoch": "1575413255.157961000" } ], "is_private": null, "observable_id": "observable-a6b21fa380975bf85bd65968", "last_seen_epoch": "1575413255.157961000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413255.007713000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "px.owneriq.net", "evidence": [ { "udp_stream": 121, "frame_number": 13170, "display_filter": "frame.number == 13170", "timestamp_epoch": "1575413306.135970000" }, { "udp_stream": 121, "frame_number": 13263, "display_filter": "frame.number == 13263", "timestamp_epoch": "1575413306.258315000" }, { "tcp_stream": 365, "frame_number": 13415, "display_filter": "frame.number == 13415", "timestamp_epoch": "1575413306.390056000" }, { "tcp_stream": 366, "frame_number": 13422, "display_filter": "frame.number == 13422", "timestamp_epoch": "1575413306.394547000" } ], "is_private": null, "observable_id": "observable-72994fdda319d5f7ccf7cab7", "last_seen_epoch": "1575413306.394547000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413306.135970000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "r20swj13mr.microsoft.com", "evidence": [ { "udp_stream": 35, "frame_number": 2891, "display_filter": "frame.number == 2891", "timestamp_epoch": "1575413185.149481000" }, { "udp_stream": 35, "frame_number": 2904, "display_filter": "frame.number == 2904", "timestamp_epoch": "1575413185.267497000" }, { "tcp_stream": 75, "frame_number": 2921, "display_filter": "frame.number == 2921", "timestamp_epoch": "1575413185.333679000" }, { "tcp_stream": 76, "frame_number": 2937, "display_filter": "frame.number == 2937", "timestamp_epoch": "1575413185.386287000" } ], "is_private": null, "observable_id": "observable-5bedfe444935b59c24799f14", "last_seen_epoch": "1575413185.386287000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413185.149481000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "rail.bankofamerica.com", "evidence": [ { "udp_stream": 185, "frame_number": 17347, "display_filter": "frame.number == 17347", "timestamp_epoch": "1575414489.232049000" }, { "udp_stream": 185, "frame_number": 17386, "display_filter": "frame.number == 17386", "timestamp_epoch": "1575414489.544905000" }, { "tcp_stream": 461, "frame_number": 17656, "display_filter": "frame.number == 17656", "timestamp_epoch": "1575414489.980687000" }, { "tcp_stream": 462, "frame_number": 17658, "display_filter": "frame.number == 17658", "timestamp_epoch": "1575414489.980891000" } ], "is_private": null, "observable_id": "observable-bb8fe26944a95d3d50d88e0d", "last_seen_epoch": "1575414489.980891000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414489.232049000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "resolver1.opendns.com", "evidence": [ { "udp_stream": 147, "frame_number": 16128, "display_filter": "frame.number == 16128", "timestamp_epoch": "1575413450.199517000" }, { "udp_stream": 148, "frame_number": 16129, "display_filter": "frame.number == 16129", "timestamp_epoch": "1575413450.209086000" }, { "udp_stream": 148, "frame_number": 16130, "display_filter": "frame.number == 16130", "timestamp_epoch": "1575413450.595849000" }, { "udp_stream": 147, "frame_number": 16131, "display_filter": "frame.number == 16131", "timestamp_epoch": "1575413450.595932000" } ], "is_private": null, "observable_id": "observable-12a7feee0433050805a2ee47", "last_seen_epoch": "1575413450.595932000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413450.199517000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "rp.gwallet.com", "evidence": [ { "udp_stream": 130, "frame_number": 13201, "display_filter": "frame.number == 13201", "timestamp_epoch": "1575413306.159653000" }, { "udp_stream": 130, "frame_number": 13311, "display_filter": "frame.number == 13311", "timestamp_epoch": "1575413306.289844000" } ], "is_private": null, "observable_id": "observable-b4736cbf9fedab0bb3a8d531", "last_seen_epoch": "1575413306.289844000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413306.159653000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "rtb.adentifi.com", "evidence": [ { "udp_stream": 61, "frame_number": 8073, "display_filter": "frame.number == 8073", "timestamp_epoch": "1575413257.790729000" }, { "udp_stream": 61, "frame_number": 8080, "display_filter": "frame.number == 8080", "timestamp_epoch": "1575413257.956936000" }, { "tcp_stream": 157, "frame_number": 8104, "display_filter": "frame.number == 8104", "timestamp_epoch": "1575413258.098025000" }, { "tcp_stream": 156, "frame_number": 8108, "display_filter": "frame.number == 8108", "timestamp_epoch": "1575413258.099351000" }, { "tcp_stream": 168, "frame_number": 8352, "display_filter": "frame.number == 8352", "timestamp_epoch": "1575413258.899477000" }, { "tcp_stream": 170, "frame_number": 8360, "display_filter": "frame.number == 8360", "timestamp_epoch": "1575413258.899980000" }, { "tcp_stream": 171, "frame_number": 8366, "display_filter": "frame.number == 8366", "timestamp_epoch": "1575413258.908848000" }, { "tcp_stream": 169, "frame_number": 8368, "display_filter": "frame.number == 8368", "timestamp_epoch": "1575413258.909021000" }, { "tcp_stream": 358, "frame_number": 13333, "display_filter": "frame.number == 13333", "timestamp_epoch": "1575413306.294208000" }, { "tcp_stream": 357, "frame_number": 13342, "display_filter": "frame.number == 13342", "timestamp_epoch": "1575413306.296982000" } ], "is_private": null, "observable_id": "observable-682b974103ec352440ad2b2c", "last_seen_epoch": "1575413306.296982000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413257.790729000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "rtb.mfadsrvr.com", "evidence": [ { "udp_stream": 120, "frame_number": 13057, "display_filter": "frame.number == 13057", "timestamp_epoch": "1575413306.033399000" }, { "udp_stream": 120, "frame_number": 13146, "display_filter": "frame.number == 13146", "timestamp_epoch": "1575413306.126479000" }, { "tcp_stream": 353, "frame_number": 13281, "display_filter": "frame.number == 13281", "timestamp_epoch": "1575413306.266962000" }, { "tcp_stream": 354, "frame_number": 13315, "display_filter": "frame.number == 13315", "timestamp_epoch": "1575413306.290358000" } ], "is_private": null, "observable_id": "observable-283ed453e356b509ee285331", "last_seen_epoch": "1575413306.290358000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413306.033399000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "s.aolcdn.com", "evidence": [ { "udp_stream": 41, "frame_number": 4182, "display_filter": "frame.number == 4182", "timestamp_epoch": "1575413244.526729000" }, { "udp_stream": 41, "frame_number": 4184, "display_filter": "frame.number == 4184", "timestamp_epoch": "1575413244.602338000" }, { "tcp_stream": 103, "frame_number": 4202, "display_filter": "frame.number == 4202", "timestamp_epoch": "1575413244.664685000" }, { "tcp_stream": 102, "frame_number": 4204, "display_filter": "frame.number == 4204", "timestamp_epoch": "1575413244.665010000" }, { "tcp_stream": 106, "frame_number": 4902, "display_filter": "frame.number == 4902", "timestamp_epoch": "1575413246.318317000" }, { "tcp_stream": 107, "frame_number": 4912, "display_filter": "frame.number == 4912", "timestamp_epoch": "1575413246.341642000" }, { "tcp_stream": 108, "frame_number": 4918, "display_filter": "frame.number == 4918", "timestamp_epoch": "1575413246.393099000" }, { "tcp_stream": 115, "frame_number": 5290, "display_filter": "frame.number == 5290", "timestamp_epoch": "1575413248.076689000" } ], "is_private": null, "observable_id": "observable-6d5c07c3653035dd514656cb", "last_seen_epoch": "1575413248.076689000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413244.526729000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "s.blogsmithmedia.com", "evidence": [ { "udp_stream": 46, "frame_number": 5160, "display_filter": "frame.number == 5160", "timestamp_epoch": "1575413247.781242000" }, { "udp_stream": 46, "frame_number": 5225, "display_filter": "frame.number == 5225", "timestamp_epoch": "1575413248.059796000" }, { "tcp_stream": 117, "frame_number": 5359, "display_filter": "frame.number == 5359", "timestamp_epoch": "1575413248.204550000" }, { "tcp_stream": 116, "frame_number": 5361, "display_filter": "frame.number == 5361", "timestamp_epoch": "1575413248.206180000" } ], "is_private": null, "observable_id": "observable-6e986dbdfe1abe164c01493d", "last_seen_epoch": "1575413248.206180000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413247.781242000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "s.yimg.com", "evidence": [ { "udp_stream": 9, "frame_number": 502, "display_filter": "frame.number == 502", "timestamp_epoch": "1575413158.880779000" }, { "udp_stream": 9, "frame_number": 504, "display_filter": "frame.number == 504", "timestamp_epoch": "1575413158.967341000" }, { "tcp_stream": 31, "frame_number": 524, "display_filter": "frame.number == 524", "timestamp_epoch": "1575413159.150193000" }, { "tcp_stream": 32, "frame_number": 526, "display_filter": "frame.number == 526", "timestamp_epoch": "1575413159.150917000" }, { "tcp_stream": 33, "frame_number": 535, "display_filter": "frame.number == 535", "timestamp_epoch": "1575413159.388361000" } ], "is_private": null, "observable_id": "observable-ddbc888d826c1476d369afd9", "last_seen_epoch": "1575413159.388361000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413158.880779000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "s0-2mdn-net.l.google.com", "evidence": [ { "udp_stream": 25, "frame_number": 1448, "display_filter": "frame.number == 1448", "timestamp_epoch": "1575413164.452822000" } ], "is_private": null, "observable_id": "observable-c2106cc7816dc4bd75092498", "last_seen_epoch": "1575413164.452822000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413164.452822000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "s0.2mdn.net", "evidence": [ { "udp_stream": 25, "frame_number": 1395, "display_filter": "frame.number == 1395", "timestamp_epoch": "1575413164.035420000" }, { "udp_stream": 25, "frame_number": 1448, "display_filter": "frame.number == 1448", "timestamp_epoch": "1575413164.452822000" }, { "tcp_stream": 51, "frame_number": 2333, "display_filter": "frame.number == 2333", "timestamp_epoch": "1575413166.025194000" }, { "tcp_stream": 52, "frame_number": 2352, "display_filter": "frame.number == 2352", "timestamp_epoch": "1575413166.046867000" }, { "tcp_stream": 149, "frame_number": 7819, "display_filter": "frame.number == 7819", "timestamp_epoch": "1575413255.911366000" }, { "tcp_stream": 148, "frame_number": 7821, "display_filter": "frame.number == 7821", "timestamp_epoch": "1575413255.911536000" }, { "tcp_stream": 164, "frame_number": 8328, "display_filter": "frame.number == 8328", "timestamp_epoch": "1575413258.869116000" }, { "tcp_stream": 166, "frame_number": 8338, "display_filter": "frame.number == 8338", "timestamp_epoch": "1575413258.874067000" }, { "tcp_stream": 165, "frame_number": 8339, "display_filter": "frame.number == 8339", "timestamp_epoch": "1575413258.874115000" }, { "tcp_stream": 167, "frame_number": 8348, "display_filter": "frame.number == 8348", "timestamp_epoch": "1575413258.878255000" }, { "tcp_stream": 176, "frame_number": 8480, "display_filter": "frame.number == 8480", "timestamp_epoch": "1575413259.415505000" }, { "tcp_stream": 177, "frame_number": 8481, "display_filter": "frame.number == 8481", "timestamp_epoch": "1575413259.415564000" } ], "is_private": null, "observable_id": "observable-632e18cb886b8e3be3bc8bcf", "last_seen_epoch": "1575413259.415564000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413164.035420000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "sb.scorecardresearch.com", "evidence": [ { "udp_stream": 45, "frame_number": 5058, "display_filter": "frame.number == 5058", "timestamp_epoch": "1575413247.024624000" }, { "udp_stream": 45, "frame_number": 5073, "display_filter": "frame.number == 5073", "timestamp_epoch": "1575413247.091636000" }, { "tcp_stream": 113, "frame_number": 5108, "display_filter": "frame.number == 5108", "timestamp_epoch": "1575413247.249279000" }, { "tcp_stream": 114, "frame_number": 5112, "display_filter": "frame.number == 5112", "timestamp_epoch": "1575413247.250557000" } ], "is_private": null, "observable_id": "observable-334490b561f380e92dcf7d71", "last_seen_epoch": "1575413247.250557000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413247.024624000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "sdarlasplitroute.gapx.yahoodns.net", "evidence": [ { "udp_stream": 18, "frame_number": 648, "display_filter": "frame.number == 648", "timestamp_epoch": "1575413160.623583000" } ], "is_private": null, "observable_id": "observable-d3dfff5021eca73472170600", "last_seen_epoch": "1575413160.623583000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413160.623583000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "secure.adnxs.com", "evidence": [ { "udp_stream": 131, "frame_number": 13968, "display_filter": "frame.number == 13968", "timestamp_epoch": "1575413307.128376000" }, { "udp_stream": 131, "frame_number": 14067, "display_filter": "frame.number == 14067", "timestamp_epoch": "1575413307.383718000" }, { "tcp_stream": 397, "frame_number": 14131, "display_filter": "frame.number == 14131", "timestamp_epoch": "1575413307.537978000" }, { "tcp_stream": 396, "frame_number": 14137, "display_filter": "frame.number == 14137", "timestamp_epoch": "1575413307.541121000" } ], "is_private": null, "observable_id": "observable-1ddd49cf2a1babebfd180982", "last_seen_epoch": "1575413307.541121000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413307.128376000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "secure.bankofamerica.com", "evidence": [ { "udp_stream": 169, "frame_number": 16501, "display_filter": "frame.number == 16501", "timestamp_epoch": "1575414483.432527000" }, { "udp_stream": 169, "frame_number": 16502, "display_filter": "frame.number == 16502", "timestamp_epoch": "1575414483.604203000" }, { "tcp_stream": 443, "frame_number": 16513, "display_filter": "frame.number == 16513", "timestamp_epoch": "1575414483.886699000" }, { "tcp_stream": 444, "frame_number": 16561, "display_filter": "frame.number == 16561", "timestamp_epoch": "1575414484.898618000" }, { "tcp_stream": 445, "frame_number": 16597, "display_filter": "frame.number == 16597", "timestamp_epoch": "1575414484.907482000" }, { "tcp_stream": 446, "frame_number": 16599, "display_filter": "frame.number == 16599", "timestamp_epoch": "1575414484.908213000" }, { "tcp_stream": 447, "frame_number": 16601, "display_filter": "frame.number == 16601", "timestamp_epoch": "1575414484.908685000" }, { "tcp_stream": 448, "frame_number": 17143, "display_filter": "frame.number == 17143", "timestamp_epoch": "1575414487.178444000" }, { "tcp_stream": 455, "frame_number": 17525, "display_filter": "frame.number == 17525", "timestamp_epoch": "1575414489.714375000" }, { "tcp_stream": 460, "frame_number": 17662, "display_filter": "frame.number == 17662", "timestamp_epoch": "1575414489.981171000" } ], "is_private": null, "observable_id": "observable-1255b9de94ef10e30b30f08d", "last_seen_epoch": "1575414489.981171000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414483.432527000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "secure.ecglb.bac.com", "evidence": [ { "udp_stream": 169, "frame_number": 16502, "display_filter": "frame.number == 16502", "timestamp_epoch": "1575414483.604203000" } ], "is_private": null, "observable_id": "observable-4c72d28717c3ed3f1c3d99a7", "last_seen_epoch": "1575414483.604203000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414483.604203000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "service.idsync.analytics.yahoo.com", "evidence": [ { "udp_stream": 29, "frame_number": 2499, "display_filter": "frame.number == 2499", "timestamp_epoch": "1575413166.433997000" }, { "udp_stream": 29, "frame_number": 2546, "display_filter": "frame.number == 2546", "timestamp_epoch": "1575413166.668934000" }, { "tcp_stream": 62, "frame_number": 2615, "display_filter": "frame.number == 2615", "timestamp_epoch": "1575413166.956048000" }, { "tcp_stream": 63, "frame_number": 2621, "display_filter": "frame.number == 2621", "timestamp_epoch": "1575413166.958828000" } ], "is_private": null, "observable_id": "observable-1498e5a94ff2c760c483ada3", "last_seen_epoch": "1575413166.958828000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413166.433997000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "service.sp.aolp-ds-prd.aws.oath.cloud", "evidence": [ { "udp_stream": 29, "frame_number": 2546, "display_filter": "frame.number == 2546", "timestamp_epoch": "1575413166.668934000" } ], "is_private": null, "observable_id": "observable-1eb7b7fa39e8bbe6da83fb0e", "last_seen_epoch": "1575413166.668934000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413166.668934000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "simage2.pubmatic.com", "evidence": [ { "udp_stream": 109, "frame_number": 10839, "display_filter": "frame.number == 10839", "timestamp_epoch": "1575413267.846641000" }, { "udp_stream": 109, "frame_number": 10931, "display_filter": "frame.number == 10931", "timestamp_epoch": "1575413268.278653000" }, { "tcp_stream": 282, "frame_number": 11076, "display_filter": "frame.number == 11076", "timestamp_epoch": "1575413268.504574000" }, { "tcp_stream": 281, "frame_number": 11091, "display_filter": "frame.number == 11091", "timestamp_epoch": "1575413268.514941000" }, { "tcp_stream": 284, "frame_number": 11101, "display_filter": "frame.number == 11101", "timestamp_epoch": "1575413268.526883000" }, { "tcp_stream": 283, "frame_number": 11112, "display_filter": "frame.number == 11112", "timestamp_epoch": "1575413268.540611000" }, { "tcp_stream": 290, "frame_number": 11505, "display_filter": "frame.number == 11505", "timestamp_epoch": "1575413269.468173000" }, { "tcp_stream": 292, "frame_number": 11521, "display_filter": "frame.number == 11521", "timestamp_epoch": "1575413269.551960000" }, { "tcp_stream": 294, "frame_number": 11616, "display_filter": "frame.number == 11616", "timestamp_epoch": "1575413269.902094000" }, { "tcp_stream": 360, "frame_number": 13362, "display_filter": "frame.number == 13362", "timestamp_epoch": "1575413306.310531000" }, { "tcp_stream": 359, "frame_number": 13368, "display_filter": "frame.number == 13368", "timestamp_epoch": "1575413306.324693000" }, { "tcp_stream": 393, "frame_number": 14117, "display_filter": "frame.number == 14117", "timestamp_epoch": "1575413307.507969000" }, { "tcp_stream": 394, "frame_number": 14124, "display_filter": "frame.number == 14124", "timestamp_epoch": "1575413307.520512000" }, { "tcp_stream": 395, "frame_number": 14141, "display_filter": "frame.number == 14141", "timestamp_epoch": "1575413307.560586000" }, { "tcp_stream": 402, "frame_number": 14167, "display_filter": "frame.number == 14167", "timestamp_epoch": "1575413307.686141000" } ], "is_private": null, "observable_id": "observable-3cc26248f8bdc8df886e1f62", "last_seen_epoch": "1575413307.686141000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413267.846641000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "simage4.pubmatic.com", "evidence": [ { "udp_stream": 112, "frame_number": 11551, "display_filter": "frame.number == 11551", "timestamp_epoch": "1575413269.662704000" }, { "udp_stream": 112, "frame_number": 11592, "display_filter": "frame.number == 11592", "timestamp_epoch": "1575413269.831186000" }, { "tcp_stream": 295, "frame_number": 11628, "display_filter": "frame.number == 11628", "timestamp_epoch": "1575413269.978848000" }, { "tcp_stream": 296, "frame_number": 11632, "display_filter": "frame.number == 11632", "timestamp_epoch": "1575413269.996746000" }, { "tcp_stream": 410, "frame_number": 14362, "display_filter": "frame.number == 14362", "timestamp_epoch": "1575413308.270866000" }, { "tcp_stream": 409, "frame_number": 14368, "display_filter": "frame.number == 14368", "timestamp_epoch": "1575413308.278250000" } ], "is_private": null, "observable_id": "observable-f682e34ea79181f09aa6d5cb", "last_seen_epoch": "1575413308.278250000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413269.662704000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "sofa.bankofamerica.com", "evidence": [ { "udp_stream": 186, "frame_number": 17348, "display_filter": "frame.number == 17348", "timestamp_epoch": "1575414489.271248000" }, { "udp_stream": 186, "frame_number": 17389, "display_filter": "frame.number == 17389", "timestamp_epoch": "1575414489.558324000" }, { "tcp_stream": 464, "frame_number": 17654, "display_filter": "frame.number == 17654", "timestamp_epoch": "1575414489.980469000" }, { "tcp_stream": 463, "frame_number": 17660, "display_filter": "frame.number == 17660", "timestamp_epoch": "1575414489.980961000" } ], "is_private": null, "observable_id": "observable-dea853c8c094bf7b849dda99", "last_seen_epoch": "1575414489.980961000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414489.271248000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "spcms-global.pbp.gysm.yahoodns.net", "evidence": [ { "udp_stream": 28, "frame_number": 2224, "display_filter": "frame.number == 2224", "timestamp_epoch": "1575413165.993066000" } ], "is_private": null, "observable_id": "observable-2f8ad240a36ba423c8a32725", "last_seen_epoch": "1575413165.993066000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413165.993066000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "ssum-sec.casalemedia.com", "evidence": [ { "udp_stream": 76, "frame_number": 9290, "display_filter": "frame.number == 9290", "timestamp_epoch": "1575413262.576039000" }, { "udp_stream": 76, "frame_number": 9336, "display_filter": "frame.number == 9336", "timestamp_epoch": "1575413262.649448000" }, { "tcp_stream": 207, "frame_number": 9403, "display_filter": "frame.number == 9403", "timestamp_epoch": "1575413262.791698000" }, { "tcp_stream": 208, "frame_number": 9420, "display_filter": "frame.number == 9420", "timestamp_epoch": "1575413262.804217000" }, { "tcp_stream": 315, "frame_number": 12686, "display_filter": "frame.number == 12686", "timestamp_epoch": "1575413305.265959000" }, { "tcp_stream": 316, "frame_number": 12694, "display_filter": "frame.number == 12694", "timestamp_epoch": "1575413305.278976000" } ], "is_private": null, "observable_id": "observable-ba06596a16003e6588584551", "last_seen_epoch": "1575413305.278976000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.576039000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "sync-tm.everesttech.net", "evidence": [ { "udp_stream": 99, "frame_number": 10777, "display_filter": "frame.number == 10777", "timestamp_epoch": "1575413267.639995000" }, { "udp_stream": 99, "frame_number": 10840, "display_filter": "frame.number == 10840", "timestamp_epoch": "1575413267.869627000" }, { "tcp_stream": 261, "frame_number": 10940, "display_filter": "frame.number == 10940", "timestamp_epoch": "1575413268.281017000" }, { "tcp_stream": 260, "frame_number": 10941, "display_filter": "frame.number == 10941", "timestamp_epoch": "1575413268.281065000" } ], "is_private": null, "observable_id": "observable-eb2e495b91f621b99538d99b", "last_seen_epoch": "1575413268.281065000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413267.639995000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "sync.1rx.io", "evidence": [ { "udp_stream": 122, "frame_number": 13182, "display_filter": "frame.number == 13182", "timestamp_epoch": "1575413306.139497000" }, { "udp_stream": 122, "frame_number": 13288, "display_filter": "frame.number == 13288", "timestamp_epoch": "1575413306.271668000" }, { "tcp_stream": 370, "frame_number": 13508, "display_filter": "frame.number == 13508", "timestamp_epoch": "1575413306.454776000" }, { "tcp_stream": 369, "frame_number": 13510, "display_filter": "frame.number == 13510", "timestamp_epoch": "1575413306.454882000" } ], "is_private": null, "observable_id": "observable-d8c6efa893ddc5a548ed5994", "last_seen_epoch": "1575413306.454882000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413306.139497000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "sync.ipredictive.com", "evidence": [ { "udp_stream": 105, "frame_number": 10799, "display_filter": "frame.number == 10799", "timestamp_epoch": "1575413267.663441000" }, { "udp_stream": 105, "frame_number": 10876, "display_filter": "frame.number == 10876", "timestamp_epoch": "1575413268.026147000" }, { "tcp_stream": 273, "frame_number": 10986, "display_filter": "frame.number == 10986", "timestamp_epoch": "1575413268.346940000" }, { "tcp_stream": 272, "frame_number": 10987, "display_filter": "frame.number == 10987", "timestamp_epoch": "1575413268.347073000" } ], "is_private": null, "observable_id": "observable-49abd37753c4bd1fde9667be", "last_seen_epoch": "1575413268.347073000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413267.663441000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "sync.mathtag.com", "evidence": [ { "udp_stream": 77, "frame_number": 9291, "display_filter": "frame.number == 9291", "timestamp_epoch": "1575413262.579955000" }, { "udp_stream": 77, "frame_number": 9305, "display_filter": "frame.number == 9305", "timestamp_epoch": "1575413262.640867000" }, { "tcp_stream": 198, "frame_number": 9393, "display_filter": "frame.number == 9393", "timestamp_epoch": "1575413262.754707000" }, { "tcp_stream": 196, "frame_number": 9394, "display_filter": "frame.number == 9394", "timestamp_epoch": "1575413262.754778000" }, { "tcp_stream": 318, "frame_number": 12715, "display_filter": "frame.number == 12715", "timestamp_epoch": "1575413305.294515000" }, { "tcp_stream": 317, "frame_number": 12723, "display_filter": "frame.number == 12723", "timestamp_epoch": "1575413305.297035000" } ], "is_private": null, "observable_id": "observable-e780d2eb559368217c4935b4", "last_seen_epoch": "1575413305.297035000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.579955000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "sync.srv.stackadapt.com", "evidence": [ { "udp_stream": 110, "frame_number": 10887, "display_filter": "frame.number == 10887", "timestamp_epoch": "1575413268.077678000" }, { "udp_stream": 110, "frame_number": 10993, "display_filter": "frame.number == 10993", "timestamp_epoch": "1575413268.359202000" }, { "tcp_stream": 286, "frame_number": 11186, "display_filter": "frame.number == 11186", "timestamp_epoch": "1575413268.632096000" }, { "tcp_stream": 287, "frame_number": 11194, "display_filter": "frame.number == 11194", "timestamp_epoch": "1575413268.636240000" } ], "is_private": null, "observable_id": "observable-92632e260d68d24bc0ad84d0", "last_seen_epoch": "1575413268.636240000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413268.077678000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "t.myvisualiq.net", "evidence": [ { "udp_stream": 70, "frame_number": 9117, "display_filter": "frame.number == 9117", "timestamp_epoch": "1575413262.140958000" }, { "udp_stream": 70, "frame_number": 9126, "display_filter": "frame.number == 9126", "timestamp_epoch": "1575413262.266157000" }, { "tcp_stream": 189, "frame_number": 9161, "display_filter": "frame.number == 9161", "timestamp_epoch": "1575413262.345766000" }, { "tcp_stream": 190, "frame_number": 9165, "display_filter": "frame.number == 9165", "timestamp_epoch": "1575413262.358195000" } ], "is_private": null, "observable_id": "observable-b4fab1a373a658a89498600a", "last_seen_epoch": "1575413262.358195000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.140958000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "tag.idsync.analytics.yahoo.com", "evidence": [ { "udp_stream": 24, "frame_number": 1103, "display_filter": "frame.number == 1103", "timestamp_epoch": "1575413163.334867000" }, { "udp_stream": 24, "frame_number": 1144, "display_filter": "frame.number == 1144", "timestamp_epoch": "1575413163.522891000" }, { "tcp_stream": 49, "frame_number": 1227, "display_filter": "frame.number == 1227", "timestamp_epoch": "1575413163.806683000" }, { "tcp_stream": 50, "frame_number": 1264, "display_filter": "frame.number == 1264", "timestamp_epoch": "1575413163.881841000" }, { "tcp_stream": 192, "frame_number": 9171, "display_filter": "frame.number == 9171", "timestamp_epoch": "1575413262.403917000" }, { "tcp_stream": 191, "frame_number": 9175, "display_filter": "frame.number == 9175", "timestamp_epoch": "1575413262.406188000" } ], "is_private": null, "observable_id": "observable-38a2e63ff09d8ac03fef0a08", "last_seen_epoch": "1575413262.406188000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413163.334867000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "tag.sp.advertising.com", "evidence": [ { "udp_stream": 21, "frame_number": 921, "display_filter": "frame.number == 921", "timestamp_epoch": "1575413162.716337000" }, { "udp_stream": 21, "frame_number": 929, "display_filter": "frame.number == 929", "timestamp_epoch": "1575413162.912621000" }, { "tcp_stream": 39, "frame_number": 958, "display_filter": "frame.number == 958", "timestamp_epoch": "1575413162.970253000" }, { "tcp_stream": 41, "frame_number": 970, "display_filter": "frame.number == 970", "timestamp_epoch": "1575413162.992961000" } ], "is_private": null, "observable_id": "observable-29ee337d456e8a9bdce327b3", "last_seen_epoch": "1575413162.992961000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413162.716337000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "tags.bkrtx.com", "evidence": [ { "udp_stream": 62, "frame_number": 8074, "display_filter": "frame.number == 8074", "timestamp_epoch": "1575413257.791396000" }, { "udp_stream": 62, "frame_number": 8085, "display_filter": "frame.number == 8085", "timestamp_epoch": "1575413257.988658000" }, { "tcp_stream": 159, "frame_number": 8096, "display_filter": "frame.number == 8096", "timestamp_epoch": "1575413258.085108000" }, { "tcp_stream": 158, "frame_number": 8100, "display_filter": "frame.number == 8100", "timestamp_epoch": "1575413258.092454000" } ], "is_private": null, "observable_id": "observable-2e671db1746fe7483b24456a", "last_seen_epoch": "1575413258.092454000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413257.791396000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "tags.bluekai.com", "evidence": [ { "udp_stream": 30, "frame_number": 2643, "display_filter": "frame.number == 2643", "timestamp_epoch": "1575413167.102944000" }, { "udp_stream": 30, "frame_number": 2668, "display_filter": "frame.number == 2668", "timestamp_epoch": "1575413167.222296000" }, { "tcp_stream": 69, "frame_number": 2688, "display_filter": "frame.number == 2688", "timestamp_epoch": "1575413167.302056000" }, { "tcp_stream": 68, "frame_number": 2691, "display_filter": "frame.number == 2691", "timestamp_epoch": "1575413167.302925000" } ], "is_private": null, "observable_id": "observable-57adbb2de2b690c5cb8dc7cf", "last_seen_epoch": "1575413167.302925000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413167.102944000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "tpc.googlesyndication.com", "evidence": [ { "udp_stream": 58, "frame_number": 7806, "display_filter": "frame.number == 7806", "timestamp_epoch": "1575413255.813989000" }, { "udp_stream": 58, "frame_number": 7823, "display_filter": "frame.number == 7823", "timestamp_epoch": "1575413255.913526000" }, { "tcp_stream": 150, "frame_number": 7834, "display_filter": "frame.number == 7834", "timestamp_epoch": "1575413256.285928000" }, { "tcp_stream": 151, "frame_number": 7842, "display_filter": "frame.number == 7842", "timestamp_epoch": "1575413256.290477000" } ], "is_private": null, "observable_id": "observable-a84960ca6b5cc5fede9eb6ca", "last_seen_epoch": "1575413256.290477000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413255.813989000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "track-eu.adformnet.akadns.net", "evidence": [ { "udp_stream": 38, "frame_number": 3635, "display_filter": "frame.number == 3635", "timestamp_epoch": "1575413213.479991000" } ], "is_private": null, "observable_id": "observable-6dfd88579bb5f50bfa25b5fc", "last_seen_epoch": "1575413213.479991000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413213.479991000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "track.adform.net", "evidence": [ { "udp_stream": 38, "frame_number": 3632, "display_filter": "frame.number == 3632", "timestamp_epoch": "1575413213.379305000" }, { "udp_stream": 38, "frame_number": 3635, "display_filter": "frame.number == 3635", "timestamp_epoch": "1575413213.479991000" }, { "tcp_stream": 88, "frame_number": 3640, "display_filter": "frame.number == 3640", "timestamp_epoch": "1575413213.661480000" }, { "tcp_stream": 89, "frame_number": 3644, "display_filter": "frame.number == 3644", "timestamp_epoch": "1575413213.662436000" } ], "is_private": null, "observable_id": "observable-8ef21ddbdde08a4dae6d5fe5", "last_seen_epoch": "1575413213.662436000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413213.379305000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "trc.taboola.com", "evidence": [ { "udp_stream": 123, "frame_number": 13183, "display_filter": "frame.number == 13183", "timestamp_epoch": "1575413306.141232000" }, { "udp_stream": 123, "frame_number": 13306, "display_filter": "frame.number == 13306", "timestamp_epoch": "1575413306.288790000" }, { "tcp_stream": 374, "frame_number": 13502, "display_filter": "frame.number == 13502", "timestamp_epoch": "1575413306.454455000" }, { "tcp_stream": 376, "frame_number": 13506, "display_filter": "frame.number == 13506", "timestamp_epoch": "1575413306.454720000" } ], "is_private": null, "observable_id": "observable-2e87e4be4fb5eeaa5ded4ebd", "last_seen_epoch": "1575413306.454720000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413306.141232000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "trc.taboola.map.fastly.net", "evidence": [ { "udp_stream": 133, "frame_number": 14095, "display_filter": "frame.number == 14095", "timestamp_epoch": "1575413307.419283000" }, { "udp_stream": 134, "frame_number": 14321, "display_filter": "frame.number == 14321", "timestamp_epoch": "1575413308.123917000" } ], "is_private": null, "observable_id": "observable-a3f18b195b20258f249b38b4", "last_seen_epoch": "1575413308.123917000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413307.419283000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "uca20a5adbe8d64fd0c7a816e1ec.dl.dropboxusercontent.com", "evidence": [ { "udp_stream": 136, "frame_number": 14462, "display_filter": "frame.number == 14462", "timestamp_epoch": "1575413312.368596000" }, { "udp_stream": 136, "frame_number": 14467, "display_filter": "frame.number == 14467", "timestamp_epoch": "1575413312.488886000" }, { "tcp_stream": 417, "frame_number": 14472, "display_filter": "frame.number == 14472", "timestamp_epoch": "1575413312.544103000" }, { "tcp_stream": 418, "frame_number": 14476, "display_filter": "frame.number == 14476", "timestamp_epoch": "1575413312.558850000" } ], "is_private": null, "observable_id": "observable-ec835da501b440a7893751df", "last_seen_epoch": "1575413312.558850000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413312.368596000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "udc.yahoo.com", "evidence": [ { "udp_stream": 16, "frame_number": 639, "display_filter": "frame.number == 639", "timestamp_epoch": "1575413160.313364000" }, { "udp_stream": 16, "frame_number": 644, "display_filter": "frame.number == 644", "timestamp_epoch": "1575413160.441484000" }, { "tcp_stream": 34, "frame_number": 658, "display_filter": "frame.number == 658", "timestamp_epoch": "1575413160.625245000" } ], "is_private": null, "observable_id": "observable-249161752c98b681ba61fff5", "last_seen_epoch": "1575413160.625245000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413160.313364000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "uipus.semasio.net", "evidence": [ { "udp_stream": 37, "frame_number": 3572, "display_filter": "frame.number == 3572", "timestamp_epoch": "1575413212.793168000" }, { "udp_stream": 37, "frame_number": 3573, "display_filter": "frame.number == 3573", "timestamp_epoch": "1575413212.855201000" }, { "tcp_stream": 85, "frame_number": 3578, "display_filter": "frame.number == 3578", "timestamp_epoch": "1575413212.926880000" }, { "tcp_stream": 86, "frame_number": 3582, "display_filter": "frame.number == 3582", "timestamp_epoch": "1575413212.935659000" } ], "is_private": null, "observable_id": "observable-33d496bb4fcc17b08e2b8857", "last_seen_epoch": "1575413212.935659000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413212.793168000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "um.simpli.fi", "evidence": [ { "udp_stream": 103, "frame_number": 10791, "display_filter": "frame.number == 10791", "timestamp_epoch": "1575413267.658014000" }, { "udp_stream": 103, "frame_number": 10851, "display_filter": "frame.number == 10851", "timestamp_epoch": "1575413267.965671000" }, { "tcp_stream": 266, "frame_number": 10956, "display_filter": "frame.number == 10956", "timestamp_epoch": "1575413268.297506000" }, { "tcp_stream": 267, "frame_number": 10958, "display_filter": "frame.number == 10958", "timestamp_epoch": "1575413268.297953000" } ], "is_private": null, "observable_id": "observable-1a5e02e7cada0f4978dcc449", "last_seen_epoch": "1575413268.297953000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413267.658014000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "ups.analytics.yahoo.com", "evidence": [ { "udp_stream": 84, "frame_number": 9786, "display_filter": "frame.number == 9786", "timestamp_epoch": "1575413264.031399000" }, { "udp_stream": 84, "frame_number": 9864, "display_filter": "frame.number == 9864", "timestamp_epoch": "1575413264.518110000" }, { "tcp_stream": 226, "frame_number": 9945, "display_filter": "frame.number == 9945", "timestamp_epoch": "1575413264.761913000" }, { "tcp_stream": 225, "frame_number": 9949, "display_filter": "frame.number == 9949", "timestamp_epoch": "1575413264.767142000" }, { "tcp_stream": 227, "frame_number": 9958, "display_filter": "frame.number == 9958", "timestamp_epoch": "1575413264.781322000" }, { "tcp_stream": 228, "frame_number": 9967, "display_filter": "frame.number == 9967", "timestamp_epoch": "1575413264.809328000" }, { "tcp_stream": 231, "frame_number": 10046, "display_filter": "frame.number == 10046", "timestamp_epoch": "1575413265.135652000" }, { "tcp_stream": 232, "frame_number": 10075, "display_filter": "frame.number == 10075", "timestamp_epoch": "1575413265.180626000" }, { "tcp_stream": 339, "frame_number": 13088, "display_filter": "frame.number == 13088", "timestamp_epoch": "1575413306.076614000" }, { "tcp_stream": 340, "frame_number": 13090, "display_filter": "frame.number == 13090", "timestamp_epoch": "1575413306.076939000" }, { "tcp_stream": 347, "frame_number": 13212, "display_filter": "frame.number == 13212", "timestamp_epoch": "1575413306.180845000" }, { "tcp_stream": 350, "frame_number": 13240, "display_filter": "frame.number == 13240", "timestamp_epoch": "1575413306.232839000" }, { "tcp_stream": 363, "frame_number": 13384, "display_filter": "frame.number == 13384", "timestamp_epoch": "1575413306.357452000" }, { "tcp_stream": 364, "frame_number": 13421, "display_filter": "frame.number == 13421", "timestamp_epoch": "1575413306.394494000" } ], "is_private": null, "observable_id": "observable-dc0b04c8d6a2001f2dd19f7a", "last_seen_epoch": "1575413306.394494000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413264.031399000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "us-east-1.onemobile.yahoo.com", "evidence": [ { "udp_stream": 71, "frame_number": 9151, "display_filter": "frame.number == 9151", "timestamp_epoch": "1575413262.342123000" }, { "udp_stream": 71, "frame_number": 9152, "display_filter": "frame.number == 9152", "timestamp_epoch": "1575413262.342458000" }, { "tcp_stream": 194, "frame_number": 9223, "display_filter": "frame.number == 9223", "timestamp_epoch": "1575413262.518154000" }, { "tcp_stream": 193, "frame_number": 9230, "display_filter": "frame.number == 9230", "timestamp_epoch": "1575413262.519436000" }, { "tcp_stream": 302, "frame_number": 12576, "display_filter": "frame.number == 12576", "timestamp_epoch": "1575413304.669487000" }, { "tcp_stream": 301, "frame_number": 12577, "display_filter": "frame.number == 12577", "timestamp_epoch": "1575413304.669548000" } ], "is_private": null, "observable_id": "observable-67f0b87758e1e22aacf02a0b", "last_seen_epoch": "1575413304.669548000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.342123000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "us.y.atwola.com", "evidence": [ { "udp_stream": 19, "frame_number": 919, "display_filter": "frame.number == 919", "timestamp_epoch": "1575413162.712452000" }, { "udp_stream": 19, "frame_number": 934, "display_filter": "frame.number == 934", "timestamp_epoch": "1575413162.915618000" }, { "tcp_stream": 43, "frame_number": 974, "display_filter": "frame.number == 974", "timestamp_epoch": "1575413162.993239000" }, { "tcp_stream": 44, "frame_number": 978, "display_filter": "frame.number == 978", "timestamp_epoch": "1575413162.998330000" } ], "is_private": null, "observable_id": "observable-64816507c90535f8f2dc4861", "last_seen_epoch": "1575413162.998330000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413162.712452000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "w8.wensa.at", "evidence": [ { "udp_stream": 137, "frame_number": 15280, "display_filter": "frame.number == 15280", "timestamp_epoch": "1575413425.196289000" }, { "udp_stream": 137, "frame_number": 15281, "display_filter": "frame.number == 15281", "timestamp_epoch": "1575413425.403718000" }, { "udp_stream": 138, "frame_number": 15575, "display_filter": "frame.number == 15575", "timestamp_epoch": "1575413428.383528000" }, { "udp_stream": 138, "frame_number": 15576, "display_filter": "frame.number == 15576", "timestamp_epoch": "1575413428.584602000" }, { "udp_stream": 145, "frame_number": 15950, "display_filter": "frame.number == 15950", "timestamp_epoch": "1575413433.872759000" }, { "udp_stream": 145, "frame_number": 15951, "display_filter": "frame.number == 15951", "timestamp_epoch": "1575413434.109141000" }, { "tcp_stream": 420, "frame_number": 15288, "display_filter": "frame.number == 15288", "timestamp_epoch": "1575413425.959473000" }, { "tcp_stream": 422, "frame_number": 15581, "display_filter": "frame.number == 15581", "timestamp_epoch": "1575413428.857662000" }, { "tcp_stream": 424, "frame_number": 15956, "display_filter": "frame.number == 15956", "timestamp_epoch": "1575413434.456567000" } ], "is_private": null, "observable_id": "observable-92302ffc29d33e2ec022cabc", "last_seen_epoch": "1575413434.456567000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413425.196289000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "wpad.icemaiden.com", "evidence": [ { "udp_stream": 170, "frame_number": 16503, "display_filter": "frame.number == 16503", "timestamp_epoch": "1575414483.742573000" }, { "udp_stream": 170, "frame_number": 16504, "display_filter": "frame.number == 16504", "timestamp_epoch": "1575414483.742885000" } ], "is_private": null, "observable_id": "observable-31034cb0bf2481f4c9756fb1", "last_seen_epoch": "1575414483.742885000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414483.742573000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "wpad.localdomain", "evidence": [ { "udp_stream": 171, "frame_number": 16505, "display_filter": "frame.number == 16505", "timestamp_epoch": "1575414483.743130000" }, { "udp_stream": 171, "frame_number": 16509, "display_filter": "frame.number == 16509", "timestamp_epoch": "1575414483.793161000" } ], "is_private": null, "observable_id": "observable-401235d4cc9b6da23fe80a2e", "last_seen_epoch": "1575414483.793161000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414483.743130000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "www.aol.com", "evidence": [ { "udp_stream": 44, "frame_number": 4889, "display_filter": "frame.number == 4889", "timestamp_epoch": "1575413246.290389000" }, { "udp_stream": 44, "frame_number": 4922, "display_filter": "frame.number == 4922", "timestamp_epoch": "1575413246.488601000" }, { "tcp_stream": 111, "frame_number": 4971, "display_filter": "frame.number == 4971", "timestamp_epoch": "1575413246.594631000" }, { "tcp_stream": 112, "frame_number": 4972, "display_filter": "frame.number == 4972", "timestamp_epoch": "1575413246.594703000" } ], "is_private": null, "observable_id": "observable-b3a7449f7eb29dd256815c62", "last_seen_epoch": "1575413246.594703000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413246.290389000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "www.bankofamerica.com", "evidence": [ { "udp_stream": 188, "frame_number": 18643, "display_filter": "frame.number == 18643", "timestamp_epoch": "1575414491.729589000" }, { "udp_stream": 188, "frame_number": 18644, "display_filter": "frame.number == 18644", "timestamp_epoch": "1575414491.788534000" }, { "tcp_stream": 471, "frame_number": 18673, "display_filter": "frame.number == 18673", "timestamp_epoch": "1575414491.901387000" }, { "tcp_stream": 472, "frame_number": 18675, "display_filter": "frame.number == 18675", "timestamp_epoch": "1575414491.901956000" } ], "is_private": null, "observable_id": "observable-49c3a49e67450740ad70a995", "last_seen_epoch": "1575414491.901956000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414491.729589000" }, { "type": "domain", "roles": [ "dns-query", "http-host", "tls-sni" ], "value": "www.bing.com", "evidence": [ { "udp_stream": 10, "frame_number": 550, "display_filter": "frame.number == 550", "timestamp_epoch": "1575413159.406992000" }, { "udp_stream": 13, "frame_number": 553, "display_filter": "frame.number == 553", "timestamp_epoch": "1575413159.407451000" }, { "udp_stream": 14, "frame_number": 554, "display_filter": "frame.number == 554", "timestamp_epoch": "1575413159.407503000" }, { "udp_stream": 15, "frame_number": 555, "display_filter": "frame.number == 555", "timestamp_epoch": "1575413159.407726000" }, { "udp_stream": 13, "frame_number": 556, "display_filter": "frame.number == 556", "timestamp_epoch": "1575413159.571651000" }, { "udp_stream": 14, "frame_number": 557, "display_filter": "frame.number == 557", "timestamp_epoch": "1575413159.571721000" }, { "udp_stream": 15, "frame_number": 558, "display_filter": "frame.number == 558", "timestamp_epoch": "1575413159.571772000" }, { "udp_stream": 10, "frame_number": 559, "display_filter": "frame.number == 559", "timestamp_epoch": "1575413159.571825000" }, { "udp_stream": 113, "frame_number": 12656, "display_filter": "frame.number == 12656", "timestamp_epoch": "1575413305.238225000" }, { "udp_stream": 114, "frame_number": 12657, "display_filter": "frame.number == 12657", "timestamp_epoch": "1575413305.239167000" }, { "udp_stream": 115, "frame_number": 12662, "display_filter": "frame.number == 12662", "timestamp_epoch": "1575413305.242542000" }, { "udp_stream": 116, "frame_number": 12663, "display_filter": "frame.number == 12663", "timestamp_epoch": "1575413305.243188000" }, { "udp_stream": 114, "frame_number": 12765, "display_filter": "frame.number == 12765", "timestamp_epoch": "1575413305.326078000" }, { "udp_stream": 115, "frame_number": 12766, "display_filter": "frame.number == 12766", "timestamp_epoch": "1575413305.326160000" }, { "udp_stream": 116, "frame_number": 12767, "display_filter": "frame.number == 12767", "timestamp_epoch": "1575413305.326217000" }, { "udp_stream": 113, "frame_number": 12768, "display_filter": "frame.number == 12768", "timestamp_epoch": "1575413305.326272000" }, { "udp_stream": 141, "frame_number": 15896, "display_filter": "frame.number == 15896", "timestamp_epoch": "1575413432.610799000" }, { "udp_stream": 142, "frame_number": 15897, "display_filter": "frame.number == 15897", "timestamp_epoch": "1575413432.611022000" }, { "udp_stream": 143, "frame_number": 15900, "display_filter": "frame.number == 15900", "timestamp_epoch": "1575413432.612065000" }, { "udp_stream": 144, "frame_number": 15901, "display_filter": "frame.number == 15901", "timestamp_epoch": "1575413432.612721000" } ], "is_private": null, "observable_id": "observable-997e0546c817cbb378c61b65", "last_seen_epoch": "1575414488.801335000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413159.406992000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "www.download.windowsupdate.com", "evidence": [ { "udp_stream": 96, "frame_number": 10540, "display_filter": "frame.number == 10540", "timestamp_epoch": "1575413266.407974000" }, { "udp_stream": 97, "frame_number": 10559, "display_filter": "frame.number == 10559", "timestamp_epoch": "1575413266.470287000" }, { "udp_stream": 97, "frame_number": 10617, "display_filter": "frame.number == 10617", "timestamp_epoch": "1575413266.894861000" }, { "udp_stream": 96, "frame_number": 10618, "display_filter": "frame.number == 10618", "timestamp_epoch": "1575413266.894952000" }, { "tcp_stream": 256, "frame_number": 10681, "display_filter": "frame.number == 10681", "timestamp_epoch": "1575413267.275134000" }, { "tcp_stream": 257, "frame_number": 10684, "display_filter": "frame.number == 10684", "timestamp_epoch": "1575413267.275288000" }, { "tcp_stream": 256, "frame_number": 10744, "display_filter": "frame.number == 10744", "timestamp_epoch": "1575413267.573647000" }, { "tcp_stream": 257, "frame_number": 10746, "display_filter": "frame.number == 10746", "timestamp_epoch": "1575413267.574570000" } ], "is_private": null, "observable_id": "observable-b156e1af2781b5fd861b3b04", "last_seen_epoch": "1575413267.574570000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413266.407974000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "www.dropbox-dns.com", "evidence": [ { "udp_stream": 135, "frame_number": 14419, "display_filter": "frame.number == 14419", "timestamp_epoch": "1575413311.311989000" } ], "is_private": null, "observable_id": "observable-da4c633bb5911121aa3e0378", "last_seen_epoch": "1575413311.311989000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413311.311989000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "www.dropbox.com", "evidence": [ { "udp_stream": 135, "frame_number": 14418, "display_filter": "frame.number == 14418", "timestamp_epoch": "1575413311.212281000" }, { "udp_stream": 135, "frame_number": 14419, "display_filter": "frame.number == 14419", "timestamp_epoch": "1575413311.311989000" }, { "tcp_stream": 415, "frame_number": 14424, "display_filter": "frame.number == 14424", "timestamp_epoch": "1575413311.393541000" }, { "tcp_stream": 416, "frame_number": 14428, "display_filter": "frame.number == 14428", "timestamp_epoch": "1575413311.400103000" } ], "is_private": null, "observable_id": "observable-c49c5c1ffd8c15bc4d3ab37d", "last_seen_epoch": "1575413311.400103000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413311.212281000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "www.googletagservices.com", "evidence": [ { "udp_stream": 57, "frame_number": 7651, "display_filter": "frame.number == 7651", "timestamp_epoch": "1575413255.030588000" }, { "udp_stream": 57, "frame_number": 7658, "display_filter": "frame.number == 7658", "timestamp_epoch": "1575413255.123657000" }, { "tcp_stream": 147, "frame_number": 7673, "display_filter": "frame.number == 7673", "timestamp_epoch": "1575413255.177741000" }, { "tcp_stream": 146, "frame_number": 7675, "display_filter": "frame.number == 7675", "timestamp_epoch": "1575413255.177936000" } ], "is_private": null, "observable_id": "observable-4d779cc905bd60ec4ef799bd", "last_seen_epoch": "1575413255.177936000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413255.030588000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "wwwui.ecglb.bac.com", "evidence": [ { "udp_stream": 188, "frame_number": 18644, "display_filter": "frame.number == 18644", "timestamp_epoch": "1575414491.788534000" } ], "is_private": null, "observable_id": "observable-4ce79b1c2dc53deecfffa286", "last_seen_epoch": "1575414491.788534000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414491.788534000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "x.bidswitch.net", "evidence": [ { "udp_stream": 79, "frame_number": 9293, "display_filter": "frame.number == 9293", "timestamp_epoch": "1575413262.584920000" }, { "udp_stream": 79, "frame_number": 9350, "display_filter": "frame.number == 9350", "timestamp_epoch": "1575413262.658303000" }, { "tcp_stream": 213, "frame_number": 9446, "display_filter": "frame.number == 9446", "timestamp_epoch": "1575413262.859490000" }, { "tcp_stream": 214, "frame_number": 9463, "display_filter": "frame.number == 9463", "timestamp_epoch": "1575413262.866931000" }, { "tcp_stream": 321, "frame_number": 12748, "display_filter": "frame.number == 12748", "timestamp_epoch": "1575413305.323686000" }, { "tcp_stream": 322, "frame_number": 12750, "display_filter": "frame.number == 12750", "timestamp_epoch": "1575413305.323733000" } ], "is_private": null, "observable_id": "observable-a39a17d5bad1845605c59bca", "last_seen_epoch": "1575413305.323733000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.584920000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "z.moatads.com", "evidence": [ { "udp_stream": 54, "frame_number": 7490, "display_filter": "frame.number == 7490", "timestamp_epoch": "1575413254.183995000" }, { "udp_stream": 54, "frame_number": 7496, "display_filter": "frame.number == 7496", "timestamp_epoch": "1575413254.362555000" }, { "tcp_stream": 140, "frame_number": 7501, "display_filter": "frame.number == 7501", "timestamp_epoch": "1575413254.454880000" }, { "tcp_stream": 141, "frame_number": 7505, "display_filter": "frame.number == 7505", "timestamp_epoch": "1575413254.478688000" } ], "is_private": null, "observable_id": "observable-18bf3edf5097d06c55687782", "last_seen_epoch": "1575413254.478688000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413254.183995000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "10.18.20.255", "evidence": [], "is_private": true, "observable_id": "observable-ec64f490a016be45d2598e23", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "10.18.20.8", "evidence": [], "is_private": true, "observable_id": "observable-d31c7d261bf8696ac872b605", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "10.18.20.97", "evidence": [], "is_private": true, "observable_id": "observable-9224b2fac6a83caa6e9b14d0", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "100.24.88.255", "evidence": [ { "udp_stream": 70, "frame_number": 9126, "display_filter": "frame.number == 9126", "timestamp_epoch": "1575413262.266157000" } ], "is_private": false, "observable_id": "observable-abf73086dfc3da1242c2d051", "last_seen_epoch": "1575413262.266157000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.266157000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "101.226.79.205", "evidence": [ { "udp_stream": 137, "frame_number": 15281, "display_filter": "frame.number == 15281", "timestamp_epoch": "1575413425.403718000" }, { "udp_stream": 138, "frame_number": 15576, "display_filter": "frame.number == 15576", "timestamp_epoch": "1575413428.584602000" }, { "udp_stream": 145, "frame_number": 15951, "display_filter": "frame.number == 15951", "timestamp_epoch": "1575413434.109141000" }, { "udp_stream": 146, "frame_number": 15967, "display_filter": "frame.number == 15967", "timestamp_epoch": "1575413440.498835000" }, { "udp_stream": 159, "frame_number": 16149, "display_filter": "frame.number == 16149", "timestamp_epoch": "1575413455.357740000" }, { "udp_stream": 160, "frame_number": 16160, "display_filter": "frame.number == 16160", "timestamp_epoch": "1575413456.425216000" }, { "udp_stream": 161, "frame_number": 16179, "display_filter": "frame.number == 16179", "timestamp_epoch": "1575413457.526856000" }, { "udp_stream": 162, "frame_number": 16196, "display_filter": "frame.number == 16196", "timestamp_epoch": "1575413468.760703000" }, { "udp_stream": 163, "frame_number": 16209, "display_filter": "frame.number == 16209", "timestamp_epoch": "1575413469.819055000" }, { "udp_stream": 164, "frame_number": 16309, "display_filter": "frame.number == 16309", "timestamp_epoch": "1575413756.347599000" }, { "udp_stream": 165, "frame_number": 16432, "display_filter": "frame.number == 16432", "timestamp_epoch": "1575414056.349092000" }, { "udp_stream": 166, "frame_number": 16443, "display_filter": "frame.number == 16443", "timestamp_epoch": "1575414057.413839000" }, { "udp_stream": 168, "frame_number": 16487, "display_filter": "frame.number == 16487", "timestamp_epoch": "1575414357.417756000" }, { "udp_stream": 190, "frame_number": 21099, "display_filter": "frame.number == 21099", "timestamp_epoch": "1575414657.443819000" }, { "udp_stream": 191, "frame_number": 21110, "display_filter": "frame.number == 21110", "timestamp_epoch": "1575414658.500356000" }, { "udp_stream": 192, "frame_number": 21123, "display_filter": "frame.number == 21123", "timestamp_epoch": "1575414669.784425000" } ], "is_private": false, "observable_id": "observable-1626197846f93bd04777382f", "last_seen_epoch": "1575414669.784425000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413425.403718000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "104.17.119.107", "evidence": [ { "udp_stream": 125, "frame_number": 13293, "display_filter": "frame.number == 13293", "timestamp_epoch": "1575413306.272141000" } ], "is_private": false, "observable_id": "observable-b58a2df6f2b7daa30049a8ff", "last_seen_epoch": "1575413306.272141000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413306.272141000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "104.17.120.107", "evidence": [ { "udp_stream": 125, "frame_number": 13293, "display_filter": "frame.number == 13293", "timestamp_epoch": "1575413306.272141000" } ], "is_private": false, "observable_id": "observable-3a6d731eaa5b21ac0937494c", "last_seen_epoch": "1575413306.272141000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413306.272141000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "104.193.80.60", "evidence": [ { "udp_stream": 118, "frame_number": 13081, "display_filter": "frame.number == 13081", "timestamp_epoch": "1575413306.074332000" }, { "udp_stream": 129, "frame_number": 13307, "display_filter": "frame.number == 13307", "timestamp_epoch": "1575413306.288918000" } ], "is_private": false, "observable_id": "observable-7c48f815ef43b61f855afb4e", "last_seen_epoch": "1575413306.288918000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413306.074332000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "104.254.148.133", "evidence": [ { "udp_stream": 81, "frame_number": 9344, "display_filter": "frame.number == 9344", "timestamp_epoch": "1575413262.653946000" }, { "udp_stream": 131, "frame_number": 14067, "display_filter": "frame.number == 14067", "timestamp_epoch": "1575413307.383718000" } ], "is_private": false, "observable_id": "observable-e2123fe179d9a2574663aca9", "last_seen_epoch": "1575413307.383718000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.653946000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "104.254.148.165", "evidence": [ { "udp_stream": 81, "frame_number": 9344, "display_filter": "frame.number == 9344", "timestamp_epoch": "1575413262.653946000" }, { "udp_stream": 131, "frame_number": 14067, "display_filter": "frame.number == 14067", "timestamp_epoch": "1575413307.383718000" } ], "is_private": false, "observable_id": "observable-4d342cb1c4055ab826d4ef2e", "last_seen_epoch": "1575413307.383718000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.653946000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "104.254.148.196", "evidence": [ { "udp_stream": 81, "frame_number": 9344, "display_filter": "frame.number == 9344", "timestamp_epoch": "1575413262.653946000" }, { "udp_stream": 131, "frame_number": 14067, "display_filter": "frame.number == 14067", "timestamp_epoch": "1575413307.383718000" } ], "is_private": false, "observable_id": "observable-4852f1425157e3ac4c2381c6", "last_seen_epoch": "1575413307.383718000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.653946000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "104.254.148.198", "evidence": [ { "udp_stream": 81, "frame_number": 9344, "display_filter": "frame.number == 9344", "timestamp_epoch": "1575413262.653946000" }, { "udp_stream": 131, "frame_number": 14067, "display_filter": "frame.number == 14067", "timestamp_epoch": "1575413307.383718000" } ], "is_private": false, "observable_id": "observable-ecfce700c068823a4315cfed", "last_seen_epoch": "1575413307.383718000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.653946000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "104.254.149.100", "evidence": [ { "udp_stream": 81, "frame_number": 9344, "display_filter": "frame.number == 9344", "timestamp_epoch": "1575413262.653946000" }, { "udp_stream": 131, "frame_number": 14067, "display_filter": "frame.number == 14067", "timestamp_epoch": "1575413307.383718000" } ], "is_private": false, "observable_id": "observable-441def818ba878faa869f0a1", "last_seen_epoch": "1575413307.383718000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.653946000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "104.254.149.101", "evidence": [ { "udp_stream": 81, "frame_number": 9344, "display_filter": "frame.number == 9344", "timestamp_epoch": "1575413262.653946000" }, { "udp_stream": 131, "frame_number": 14067, "display_filter": "frame.number == 14067", "timestamp_epoch": "1575413307.383718000" } ], "is_private": false, "observable_id": "observable-f56ed31669039b387efa21e1", "last_seen_epoch": "1575413307.383718000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.653946000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "104.254.149.68", "evidence": [ { "udp_stream": 81, "frame_number": 9344, "display_filter": "frame.number == 9344", "timestamp_epoch": "1575413262.653946000" }, { "udp_stream": 131, "frame_number": 14067, "display_filter": "frame.number == 14067", "timestamp_epoch": "1575413307.383718000" } ], "is_private": false, "observable_id": "observable-911d93e6eadbdf909f7eb5b9", "last_seen_epoch": "1575413307.383718000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.653946000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "104.254.149.69", "evidence": [ { "udp_stream": 81, "frame_number": 9344, "display_filter": "frame.number == 9344", "timestamp_epoch": "1575413262.653946000" }, { "udp_stream": 131, "frame_number": 14067, "display_filter": "frame.number == 14067", "timestamp_epoch": "1575413307.383718000" } ], "is_private": false, "observable_id": "observable-2212c28fc2dff9f7e55dce5d", "last_seen_epoch": "1575413307.383718000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.653946000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "104.36.113.17", "evidence": [ { "udp_stream": 108, "frame_number": 10910, "display_filter": "frame.number == 10910", "timestamp_epoch": "1575413268.262916000" }, { "udp_stream": 109, "frame_number": 10931, "display_filter": "frame.number == 10931", "timestamp_epoch": "1575413268.278653000" } ], "is_private": false, "observable_id": "observable-cebc1da97b8c4e766d15bdd9", "last_seen_epoch": "1575413268.278653000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413268.262916000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "104.36.113.23", "evidence": [ { "udp_stream": 85, "frame_number": 9934, "display_filter": "frame.number == 9934", "timestamp_epoch": "1575413264.714628000" } ], "is_private": false, "observable_id": "observable-2d53ca4541325d978de539f3", "last_seen_epoch": "1575413264.714628000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413264.714628000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "104.36.113.24", "evidence": [ { "udp_stream": 107, "frame_number": 10924, "display_filter": "frame.number == 10924", "timestamp_epoch": "1575413268.273846000" }, { "udp_stream": 112, "frame_number": 11592, "display_filter": "frame.number == 11592", "timestamp_epoch": "1575413269.831186000" } ], "is_private": false, "observable_id": "observable-e46cafa851fdbebecbca94bc", "last_seen_epoch": "1575413269.831186000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413268.273846000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "104.69.23.209", "evidence": [ { "udp_stream": 117, "frame_number": 12826, "display_filter": "frame.number == 12826", "timestamp_epoch": "1575413305.449366000" } ], "is_private": false, "observable_id": "observable-4626bfafbad8683a0e5dae17", "last_seen_epoch": "1575413305.449366000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413305.449366000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "107.178.246.49", "evidence": [ { "udp_stream": 132, "frame_number": 14090, "display_filter": "frame.number == 14090", "timestamp_epoch": "1575413307.406763000" } ], "is_private": false, "observable_id": "observable-4ceaeeecaef2130a058af2d2", "last_seen_epoch": "1575413307.406763000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413307.406763000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "107.23.111.253", "evidence": [ { "udp_stream": 70, "frame_number": 9126, "display_filter": "frame.number == 9126", "timestamp_epoch": "1575413262.266157000" } ], "is_private": false, "observable_id": "observable-3b4157b52c5b538a2715f5c1", "last_seen_epoch": "1575413262.266157000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.266157000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "107.23.112.106", "evidence": [ { "udp_stream": 52, "frame_number": 7233, "display_filter": "frame.number == 7233", "timestamp_epoch": "1575413253.235151000" }, { "udp_stream": 56, "frame_number": 7655, "display_filter": "frame.number == 7655", "timestamp_epoch": "1575413255.099136000" }, { "udp_stream": 71, "frame_number": 9152, "display_filter": "frame.number == 9152", "timestamp_epoch": "1575413262.342458000" } ], "is_private": false, "observable_id": "observable-3bf55c691ba6a14f147f37db", "last_seen_epoch": "1575413262.342458000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413253.235151000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "107.23.26.245", "evidence": [ { "udp_stream": 84, "frame_number": 9864, "display_filter": "frame.number == 9864", "timestamp_epoch": "1575413264.518110000" } ], "is_private": false, "observable_id": "observable-295a8bfb49942cf0b0951cd1", "last_seen_epoch": "1575413264.518110000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413264.518110000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "107.23.4.236", "evidence": [ { "udp_stream": 92, "frame_number": 9982, "display_filter": "frame.number == 9982", "timestamp_epoch": "1575413264.913423000" } ], "is_private": false, "observable_id": "observable-38c6ad687751a49e7297ec5c", "last_seen_epoch": "1575413264.913423000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413264.913423000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "107.23.73.96", "evidence": [ { "udp_stream": 39, "frame_number": 3795, "display_filter": "frame.number == 3795", "timestamp_epoch": "1575413237.897960000" }, { "udp_stream": 40, "frame_number": 3837, "display_filter": "frame.number == 3837", "timestamp_epoch": "1575413238.558263000" } ], "is_private": false, "observable_id": "observable-e84b57f76ea13b0ef5fae632", "last_seen_epoch": "1575413238.558263000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413237.897960000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "119.28.48.231", "evidence": [ { "udp_stream": 137, "frame_number": 15281, "display_filter": "frame.number == 15281", "timestamp_epoch": "1575413425.403718000" }, { "udp_stream": 138, "frame_number": 15576, "display_filter": "frame.number == 15576", "timestamp_epoch": "1575413428.584602000" }, { "udp_stream": 145, "frame_number": 15951, "display_filter": "frame.number == 15951", "timestamp_epoch": "1575413434.109141000" }, { "udp_stream": 146, "frame_number": 15967, "display_filter": "frame.number == 15967", "timestamp_epoch": "1575413440.498835000" }, { "udp_stream": 159, "frame_number": 16149, "display_filter": "frame.number == 16149", "timestamp_epoch": "1575413455.357740000" }, { "udp_stream": 160, "frame_number": 16160, "display_filter": "frame.number == 16160", "timestamp_epoch": "1575413456.425216000" }, { "udp_stream": 161, "frame_number": 16179, "display_filter": "frame.number == 16179", "timestamp_epoch": "1575413457.526856000" }, { "udp_stream": 162, "frame_number": 16196, "display_filter": "frame.number == 16196", "timestamp_epoch": "1575413468.760703000" }, { "udp_stream": 163, "frame_number": 16209, "display_filter": "frame.number == 16209", "timestamp_epoch": "1575413469.819055000" }, { "udp_stream": 164, "frame_number": 16309, "display_filter": "frame.number == 16309", "timestamp_epoch": "1575413756.347599000" }, { "udp_stream": 165, "frame_number": 16432, "display_filter": "frame.number == 16432", "timestamp_epoch": "1575414056.349092000" }, { "udp_stream": 166, "frame_number": 16443, "display_filter": "frame.number == 16443", "timestamp_epoch": "1575414057.413839000" }, { "udp_stream": 168, "frame_number": 16487, "display_filter": "frame.number == 16487", "timestamp_epoch": "1575414357.417756000" }, { "udp_stream": 190, "frame_number": 21099, "display_filter": "frame.number == 21099", "timestamp_epoch": "1575414657.443819000" }, { "udp_stream": 191, "frame_number": 21110, "display_filter": "frame.number == 21110", "timestamp_epoch": "1575414658.500356000" }, { "udp_stream": 192, "frame_number": 21123, "display_filter": "frame.number == 21123", "timestamp_epoch": "1575414669.784425000" } ], "is_private": false, "observable_id": "observable-0fbd669116dceddddeacc579", "last_seen_epoch": "1575414669.784425000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413425.403718000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "129.33.138.31", "evidence": [ { "udp_stream": 187, "frame_number": 18068, "display_filter": "frame.number == 18068", "timestamp_epoch": "1575414490.617736000" } ], "is_private": false, "observable_id": "observable-83b3fc5871fc74b10b2d759e", "last_seen_epoch": "1575414490.617736000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414490.617736000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "13.107.21.200", "evidence": [ { "udp_stream": 13, "frame_number": 556, "display_filter": "frame.number == 556", "timestamp_epoch": "1575413159.571651000" }, { "udp_stream": 14, "frame_number": 557, "display_filter": "frame.number == 557", "timestamp_epoch": "1575413159.571721000" }, { "udp_stream": 15, "frame_number": 558, "display_filter": "frame.number == 558", "timestamp_epoch": "1575413159.571772000" }, { "udp_stream": 10, "frame_number": 559, "display_filter": "frame.number == 559", "timestamp_epoch": "1575413159.571825000" }, { "udp_stream": 114, "frame_number": 12765, "display_filter": "frame.number == 12765", "timestamp_epoch": "1575413305.326078000" }, { "udp_stream": 115, "frame_number": 12766, "display_filter": "frame.number == 12766", "timestamp_epoch": "1575413305.326160000" }, { "udp_stream": 116, "frame_number": 12767, "display_filter": "frame.number == 12767", "timestamp_epoch": "1575413305.326217000" }, { "udp_stream": 113, "frame_number": 12768, "display_filter": "frame.number == 12768", "timestamp_epoch": "1575413305.326272000" }, { "udp_stream": 142, "frame_number": 15930, "display_filter": "frame.number == 15930", "timestamp_epoch": "1575413432.778153000" }, { "udp_stream": 143, "frame_number": 15931, "display_filter": "frame.number == 15931", "timestamp_epoch": "1575413432.778226000" }, { "udp_stream": 144, "frame_number": 15932, "display_filter": "frame.number == 15932", "timestamp_epoch": "1575413432.778283000" }, { "udp_stream": 141, "frame_number": 15933, "display_filter": "frame.number == 15933", "timestamp_epoch": "1575413432.778338000" }, { "udp_stream": 176, "frame_number": 17248, "display_filter": "frame.number == 17248", "timestamp_epoch": "1575414487.898629000" }, { "udp_stream": 178, "frame_number": 17249, "display_filter": "frame.number == 17249", "timestamp_epoch": "1575414487.898713000" }, { "udp_stream": 179, "frame_number": 17250, "display_filter": "frame.number == 17250", "timestamp_epoch": "1575414487.898793000" }, { "udp_stream": 175, "frame_number": 17251, "display_filter": "frame.number == 17251", "timestamp_epoch": "1575414487.898873000" } ], "is_private": false, "observable_id": "observable-5777453edd2690d75fad9b05", "last_seen_epoch": "1575414487.898873000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413159.571651000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "13.107.5.80", "evidence": [ { "udp_stream": 11, "frame_number": 560, "display_filter": "frame.number == 560", "timestamp_epoch": "1575413159.571932000" }, { "udp_stream": 12, "frame_number": 561, "display_filter": "frame.number == 561", "timestamp_epoch": "1575413159.572020000" }, { "udp_stream": 140, "frame_number": 15924, "display_filter": "frame.number == 15924", "timestamp_epoch": "1575413432.761525000" }, { "udp_stream": 139, "frame_number": 15925, "display_filter": "frame.number == 15925", "timestamp_epoch": "1575413432.761612000" }, { "udp_stream": 180, "frame_number": 17245, "display_filter": "frame.number == 17245", "timestamp_epoch": "1575414487.898383000" }, { "udp_stream": 177, "frame_number": 17247, "display_filter": "frame.number == 17247", "timestamp_epoch": "1575414487.898510000" } ], "is_private": false, "observable_id": "observable-444fae800ecdaeb798557f74", "last_seen_epoch": "1575414487.898510000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413159.571932000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "13.249.22.105", "evidence": [ { "udp_stream": 64, "frame_number": 8202, "display_filter": "frame.number == 8202", "timestamp_epoch": "1575413258.371041000" } ], "is_private": false, "observable_id": "observable-019e7520dd77dc655c14b706", "last_seen_epoch": "1575413258.371041000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413258.371041000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "13.249.22.83", "evidence": [ { "udp_stream": 64, "frame_number": 8202, "display_filter": "frame.number == 8202", "timestamp_epoch": "1575413258.371041000" } ], "is_private": false, "observable_id": "observable-514300caa1e6feec3bd00c0c", "last_seen_epoch": "1575413258.371041000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413258.371041000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "13.249.22.84", "evidence": [ { "udp_stream": 64, "frame_number": 8202, "display_filter": "frame.number == 8202", "timestamp_epoch": "1575413258.371041000" } ], "is_private": false, "observable_id": "observable-8d95d7e6db80bd76409691f9", "last_seen_epoch": "1575413258.371041000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413258.371041000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "13.249.22.87", "evidence": [ { "udp_stream": 64, "frame_number": 8202, "display_filter": "frame.number == 8202", "timestamp_epoch": "1575413258.371041000" } ], "is_private": false, "observable_id": "observable-697c4a7feb91fdfd1b25450a", "last_seen_epoch": "1575413258.371041000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413258.371041000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "130.248.144.16", "evidence": [ { "udp_stream": 181, "frame_number": 17335, "display_filter": "frame.number == 17335", "timestamp_epoch": "1575414489.184029000" } ], "is_private": false, "observable_id": "observable-2bce9bb7a1bcdd51ffbdfcb2", "last_seen_epoch": "1575414489.184029000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414489.184029000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "130.248.144.17", "evidence": [ { "udp_stream": 181, "frame_number": 17335, "display_filter": "frame.number == 17335", "timestamp_epoch": "1575414489.184029000" } ], "is_private": false, "observable_id": "observable-8bf3732fa5d71b4098955de5", "last_seen_epoch": "1575414489.184029000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414489.184029000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "130.248.144.18", "evidence": [ { "udp_stream": 181, "frame_number": 17335, "display_filter": "frame.number == 17335", "timestamp_epoch": "1575414489.184029000" } ], "is_private": false, "observable_id": "observable-ded2b8249a70d699f9fe94dc", "last_seen_epoch": "1575414489.184029000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414489.184029000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "130.248.144.19", "evidence": [ { "udp_stream": 181, "frame_number": 17335, "display_filter": "frame.number == 17335", "timestamp_epoch": "1575414489.184029000" } ], "is_private": false, "observable_id": "observable-c3102a39d68eee7a8e413128", "last_seen_epoch": "1575414489.184029000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414489.184029000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "130.248.144.23", "evidence": [ { "udp_stream": 181, "frame_number": 17335, "display_filter": "frame.number == 17335", "timestamp_epoch": "1575414489.184029000" } ], "is_private": false, "observable_id": "observable-4ecf0a0b046b5bb5c46d7481", "last_seen_epoch": "1575414489.184029000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414489.184029000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "131.107.255.255", "evidence": [ { "udp_stream": 2, "frame_number": 257, "display_filter": "frame.number == 257", "timestamp_epoch": "1575413123.352446000" } ], "is_private": false, "observable_id": "observable-cd312c13da125f8c4c1f02c8", "last_seen_epoch": "1575413123.352446000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413123.352446000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "134.209.129.254", "evidence": [ { "udp_stream": 128, "frame_number": 13344, "display_filter": "frame.number == 13344", "timestamp_epoch": "1575413306.297988000" } ], "is_private": false, "observable_id": "observable-8dc2b8aa2d347bb415f91cc8", "last_seen_epoch": "1575413306.297988000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413306.297988000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "151.101.0.166", "evidence": [ { "udp_stream": 16, "frame_number": 13337, "display_filter": "frame.number == 13337", "timestamp_epoch": "1575413306.294911000" } ], "is_private": false, "observable_id": "observable-b52f047ac24984f0adc15af4", "last_seen_epoch": "1575413306.294911000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413306.294911000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "151.101.128.166", "evidence": [ { "udp_stream": 16, "frame_number": 13337, "display_filter": "frame.number == 13337", "timestamp_epoch": "1575413306.294911000" } ], "is_private": false, "observable_id": "observable-f6ee905a2676b897eb906ba0", "last_seen_epoch": "1575413306.294911000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413306.294911000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "151.101.130.2", "evidence": [ { "udp_stream": 123, "frame_number": 13306, "display_filter": "frame.number == 13306", "timestamp_epoch": "1575413306.288790000" } ], "is_private": false, "observable_id": "observable-9d55340d034c37eaf0e2803b", "last_seen_epoch": "1575413306.288790000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413306.288790000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "151.101.130.49", "evidence": [ { "udp_stream": 99, "frame_number": 10840, "display_filter": "frame.number == 10840", "timestamp_epoch": "1575413267.869627000" }, { "udp_stream": 133, "frame_number": 14095, "display_filter": "frame.number == 14095", "timestamp_epoch": "1575413307.419283000" }, { "udp_stream": 134, "frame_number": 14321, "display_filter": "frame.number == 14321", "timestamp_epoch": "1575413308.123917000" } ], "is_private": false, "observable_id": "observable-ef52dadc716702ec36a69e7e", "last_seen_epoch": "1575413308.123917000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413267.869627000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "151.101.192.166", "evidence": [ { "udp_stream": 16, "frame_number": 13337, "display_filter": "frame.number == 13337", "timestamp_epoch": "1575413306.294911000" } ], "is_private": false, "observable_id": "observable-8db610826d35e418eb0434b2", "last_seen_epoch": "1575413306.294911000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413306.294911000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "151.101.194.2", "evidence": [ { "udp_stream": 123, "frame_number": 13306, "display_filter": "frame.number == 13306", "timestamp_epoch": "1575413306.288790000" } ], "is_private": false, "observable_id": "observable-8281da5f1499ae8725bd39d6", "last_seen_epoch": "1575413306.288790000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413306.288790000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "151.101.194.49", "evidence": [ { "udp_stream": 99, "frame_number": 10840, "display_filter": "frame.number == 10840", "timestamp_epoch": "1575413267.869627000" }, { "udp_stream": 133, "frame_number": 14095, "display_filter": "frame.number == 14095", "timestamp_epoch": "1575413307.419283000" }, { "udp_stream": 134, "frame_number": 14321, "display_filter": "frame.number == 14321", "timestamp_epoch": "1575413308.123917000" } ], "is_private": false, "observable_id": "observable-12f75831784690ec4c0544ea", "last_seen_epoch": "1575413308.123917000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413267.869627000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "151.101.2.2", "evidence": [ { "udp_stream": 123, "frame_number": 13306, "display_filter": "frame.number == 13306", "timestamp_epoch": "1575413306.288790000" } ], "is_private": false, "observable_id": "observable-3780aaaeafee23ffabe8c9f0", "last_seen_epoch": "1575413306.288790000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413306.288790000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "151.101.2.49", "evidence": [ { "udp_stream": 99, "frame_number": 10840, "display_filter": "frame.number == 10840", "timestamp_epoch": "1575413267.869627000" }, { "udp_stream": 133, "frame_number": 14095, "display_filter": "frame.number == 14095", "timestamp_epoch": "1575413307.419283000" }, { "udp_stream": 134, "frame_number": 14321, "display_filter": "frame.number == 14321", "timestamp_epoch": "1575413308.123917000" } ], "is_private": false, "observable_id": "observable-2dacfd2063f084a073586c6d", "last_seen_epoch": "1575413308.123917000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413267.869627000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "151.101.64.166", "evidence": [ { "udp_stream": 16, "frame_number": 13337, "display_filter": "frame.number == 13337", "timestamp_epoch": "1575413306.294911000" } ], "is_private": false, "observable_id": "observable-bd3bc059462cd6c537490550", "last_seen_epoch": "1575413306.294911000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413306.294911000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "151.101.66.2", "evidence": [ { "udp_stream": 123, "frame_number": 13306, "display_filter": "frame.number == 13306", "timestamp_epoch": "1575413306.288790000" } ], "is_private": false, "observable_id": "observable-d2b494563fd89c0b32284de2", "last_seen_epoch": "1575413306.288790000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413306.288790000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "151.101.66.49", "evidence": [ { "udp_stream": 99, "frame_number": 10840, "display_filter": "frame.number == 10840", "timestamp_epoch": "1575413267.869627000" }, { "udp_stream": 133, "frame_number": 14095, "display_filter": "frame.number == 14095", "timestamp_epoch": "1575413307.419283000" }, { "udp_stream": 134, "frame_number": 14321, "display_filter": "frame.number == 14321", "timestamp_epoch": "1575413308.123917000" } ], "is_private": false, "observable_id": "observable-7c79a5ea695879350448e5da", "last_seen_epoch": "1575413308.123917000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413267.869627000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "152.195.14.41", "evidence": [ { "udp_stream": 24, "frame_number": 1144, "display_filter": "frame.number == 1144", "timestamp_epoch": "1575413163.522891000" } ], "is_private": false, "observable_id": "observable-b345365ded2c8f9b851755bf", "last_seen_epoch": "1575413163.522891000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413163.522891000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "152.195.32.163", "evidence": [ { "udp_stream": 21, "frame_number": 929, "display_filter": "frame.number == 929", "timestamp_epoch": "1575413162.912621000" } ], "is_private": false, "observable_id": "observable-1f53c052aec38f4bac302b18", "last_seen_epoch": "1575413162.912621000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413162.912621000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "152.195.55.192", "evidence": [ { "udp_stream": 42, "frame_number": 4187, "display_filter": "frame.number == 4187", "timestamp_epoch": "1575413244.607312000" } ], "is_private": false, "observable_id": "observable-7ae363b7060bc984ac75344f", "last_seen_epoch": "1575413244.607312000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413244.607312000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "152.199.24.48", "evidence": [ { "udp_stream": 20, "frame_number": 928, "display_filter": "frame.number == 928", "timestamp_epoch": "1575413162.912415000" } ], "is_private": false, "observable_id": "observable-edbd045df04e0ba0a1c10e1d", "last_seen_epoch": "1575413162.912415000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413162.912415000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "152.199.6.11", "evidence": [ { "udp_stream": 22, "frame_number": 1072, "display_filter": "frame.number == 1072", "timestamp_epoch": "1575413163.219942000" } ], "is_private": false, "observable_id": "observable-ec543c049dedd0606b4cc346", "last_seen_epoch": "1575413163.219942000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413163.219942000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "152.199.6.14", "evidence": [ { "udp_stream": 19, "frame_number": 934, "display_filter": "frame.number == 934", "timestamp_epoch": "1575413162.915618000" }, { "udp_stream": 48, "frame_number": 5656, "display_filter": "frame.number == 5656", "timestamp_epoch": "1575413248.903560000" } ], "is_private": false, "observable_id": "observable-7265c12fe24ef62c7910de21", "last_seen_epoch": "1575413248.903560000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413162.915618000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "152.199.6.24", "evidence": [ { "udp_stream": 50, "frame_number": 6899, "display_filter": "frame.number == 6899", "timestamp_epoch": "1575413251.062084000" } ], "is_private": false, "observable_id": "observable-cd1486b21b81e91390b9d8d7", "last_seen_epoch": "1575413251.062084000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413251.062084000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "156.154.136.36", "evidence": [ { "udp_stream": 31, "frame_number": 2659, "display_filter": "frame.number == 2659", "timestamp_epoch": "1575413167.210776000" } ], "is_private": false, "observable_id": "observable-6d6679e5a03ae654a7dd134f", "last_seen_epoch": "1575413167.210776000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413167.210776000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "156.154.202.36", "evidence": [ { "udp_stream": 31, "frame_number": 2659, "display_filter": "frame.number == 2659", "timestamp_epoch": "1575413167.210776000" } ], "is_private": false, "observable_id": "observable-40e90a0eb9c1ca963aac1043", "last_seen_epoch": "1575413167.210776000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413167.210776000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "162.125.8.1", "evidence": [ { "udp_stream": 135, "frame_number": 14419, "display_filter": "frame.number == 14419", "timestamp_epoch": "1575413311.311989000" } ], "is_private": false, "observable_id": "observable-e521cc1e5c5ffc7900caee8c", "last_seen_epoch": "1575413311.311989000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413311.311989000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "162.125.8.6", "evidence": [ { "udp_stream": 136, "frame_number": 14467, "display_filter": "frame.number == 14467", "timestamp_epoch": "1575413312.488886000" } ], "is_private": false, "observable_id": "observable-dbb7647a68b9557e4ce3aea8", "last_seen_epoch": "1575413312.488886000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413312.488886000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "169.62.192.207", "evidence": [ { "udp_stream": 103, "frame_number": 10851, "display_filter": "frame.number == 10851", "timestamp_epoch": "1575413267.965671000" } ], "is_private": false, "observable_id": "observable-56e9638f5ae4fa161c868a5b", "last_seen_epoch": "1575413267.965671000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413267.965671000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "171.161.198.200", "evidence": [ { "udp_stream": 169, "frame_number": 16502, "display_filter": "frame.number == 16502", "timestamp_epoch": "1575414483.604203000" } ], "is_private": false, "observable_id": "observable-d9a0ceb19a8a0a575d607ace", "last_seen_epoch": "1575414483.604203000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414483.604203000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "171.161.202.100", "evidence": [ { "udp_stream": 188, "frame_number": 18644, "display_filter": "frame.number == 18644", "timestamp_epoch": "1575414491.788534000" } ], "is_private": false, "observable_id": "observable-6a4ce0958aa0de1b0433a911", "last_seen_epoch": "1575414491.788534000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414491.788534000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "172.217.1.130", "evidence": [ { "udp_stream": 57, "frame_number": 7658, "display_filter": "frame.number == 7658", "timestamp_epoch": "1575413255.123657000" }, { "udp_stream": 59, "frame_number": 7972, "display_filter": "frame.number == 7972", "timestamp_epoch": "1575413257.008584000" }, { "udp_stream": 74, "frame_number": 9306, "display_filter": "frame.number == 9306", "timestamp_epoch": "1575413262.640954000" } ], "is_private": false, "observable_id": "observable-550aa9326df0c8efce222f13", "last_seen_epoch": "1575413262.640954000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413255.123657000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "172.217.12.38", "evidence": [ { "udp_stream": 25, "frame_number": 1448, "display_filter": "frame.number == 1448", "timestamp_epoch": "1575413164.452822000" } ], "is_private": false, "observable_id": "observable-cc3c93d60f7ea73c07ad7d20", "last_seen_epoch": "1575413164.452822000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413164.452822000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "172.217.12.65", "evidence": [ { "udp_stream": 58, "frame_number": 7823, "display_filter": "frame.number == 7823", "timestamp_epoch": "1575413255.913526000" } ], "is_private": false, "observable_id": "observable-573007f493d45b464f5bdb1e", "last_seen_epoch": "1575413255.913526000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413255.913526000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "172.217.12.67", "evidence": [ { "udp_stream": 67, "frame_number": 8615, "display_filter": "frame.number == 8615", "timestamp_epoch": "1575413260.271166000" } ], "is_private": false, "observable_id": "observable-269d6bfdf7f801ab5d5b96fc", "last_seen_epoch": "1575413260.271166000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413260.271166000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "172.217.14.166", "evidence": [ { "udp_stream": 23, "frame_number": 1069, "display_filter": "frame.number == 1069", "timestamp_epoch": "1575413163.198550000" } ], "is_private": false, "observable_id": "observable-6c6d7cc79d29283d5ceda043", "last_seen_epoch": "1575413163.198550000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413163.198550000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "173.231.184.20", "evidence": [ { "udp_stream": 91, "frame_number": 9990, "display_filter": "frame.number == 9990", "timestamp_epoch": "1575413264.924248000" } ], "is_private": false, "observable_id": "observable-5caf8dc4f2de755244e1d53c", "last_seen_epoch": "1575413264.924248000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413264.924248000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "174.129.98.238", "evidence": [ { "udp_stream": 189, "frame_number": 18913, "display_filter": "frame.number == 18913", "timestamp_epoch": "1575414494.106735000" } ], "is_private": false, "observable_id": "observable-78cdea9642dc3164d8528b0c", "last_seen_epoch": "1575414494.106735000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414494.106735000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "18.190.121.125", "evidence": [ { "udp_stream": 26, "frame_number": 2223, "display_filter": "frame.number == 2223", "timestamp_epoch": "1575413165.992964000" } ], "is_private": false, "observable_id": "observable-f7cacf564d4c0a88d8a2784e", "last_seen_epoch": "1575413165.992964000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413165.992964000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "18.207.32.160", "evidence": [ { "udp_stream": 184, "frame_number": 17359, "display_filter": "frame.number == 17359", "timestamp_epoch": "1575414489.334625000" }, { "udp_stream": 185, "frame_number": 17386, "display_filter": "frame.number == 17386", "timestamp_epoch": "1575414489.544905000" } ], "is_private": false, "observable_id": "observable-afb03954389d024b342587c7", "last_seen_epoch": "1575414489.544905000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414489.334625000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "18.208.41.141", "evidence": [ { "udp_stream": 39, "frame_number": 3795, "display_filter": "frame.number == 3795", "timestamp_epoch": "1575413237.897960000" }, { "udp_stream": 40, "frame_number": 3837, "display_filter": "frame.number == 3837", "timestamp_epoch": "1575413238.558263000" } ], "is_private": false, "observable_id": "observable-24ce2f21c1e572e120cbe3ca", "last_seen_epoch": "1575413238.558263000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413237.897960000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "18.209.186.85", "evidence": [ { "udp_stream": 70, "frame_number": 9126, "display_filter": "frame.number == 9126", "timestamp_epoch": "1575413262.266157000" } ], "is_private": false, "observable_id": "observable-89256dea8f119075b7a778ee", "last_seen_epoch": "1575413262.266157000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.266157000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "18.210.147.153", "evidence": [ { "udp_stream": 70, "frame_number": 9126, "display_filter": "frame.number == 9126", "timestamp_epoch": "1575413262.266157000" } ], "is_private": false, "observable_id": "observable-dd9581387a14bb8410678c7c", "last_seen_epoch": "1575413262.266157000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.266157000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "18.211.132.79", "evidence": [ { "udp_stream": 70, "frame_number": 9126, "display_filter": "frame.number == 9126", "timestamp_epoch": "1575413262.266157000" } ], "is_private": false, "observable_id": "observable-4cfc9267cf64704e5af6829f", "last_seen_epoch": "1575413262.266157000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.266157000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "18.214.122.84", "evidence": [ { "udp_stream": 184, "frame_number": 17359, "display_filter": "frame.number == 17359", "timestamp_epoch": "1575414489.334625000" }, { "udp_stream": 185, "frame_number": 17386, "display_filter": "frame.number == 17386", "timestamp_epoch": "1575414489.544905000" } ], "is_private": false, "observable_id": "observable-c8d40ffb1f0996dfb1ff5450", "last_seen_epoch": "1575414489.544905000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414489.334625000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "18.215.90.62", "evidence": [ { "udp_stream": 182, "frame_number": 17363, "display_filter": "frame.number == 17363", "timestamp_epoch": "1575414489.352624000" } ], "is_private": false, "observable_id": "observable-a6bba22da108d9081179911c", "last_seen_epoch": "1575414489.352624000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414489.352624000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "18.232.193.181", "evidence": [ { "udp_stream": 39, "frame_number": 3795, "display_filter": "frame.number == 3795", "timestamp_epoch": "1575413237.897960000" }, { "udp_stream": 40, "frame_number": 3837, "display_filter": "frame.number == 3837", "timestamp_epoch": "1575413238.558263000" } ], "is_private": false, "observable_id": "observable-824c188a20227041c456f31f", "last_seen_epoch": "1575413238.558263000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413237.897960000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "18.233.175.78", "evidence": [ { "udp_stream": 70, "frame_number": 9126, "display_filter": "frame.number == 9126", "timestamp_epoch": "1575413262.266157000" } ], "is_private": false, "observable_id": "observable-48de171fac5d1f0325515e48", "last_seen_epoch": "1575413262.266157000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.266157000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "18.233.219.152", "evidence": [ { "udp_stream": 70, "frame_number": 9126, "display_filter": "frame.number == 9126", "timestamp_epoch": "1575413262.266157000" } ], "is_private": false, "observable_id": "observable-951e65f6e507a2c584b23275", "last_seen_epoch": "1575413262.266157000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.266157000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "18.235.19.208", "evidence": [ { "udp_stream": 87, "frame_number": 9974, "display_filter": "frame.number == 9974", "timestamp_epoch": "1575413264.859950000" } ], "is_private": false, "observable_id": "observable-f64ea3ee382d988de68251db", "last_seen_epoch": "1575413264.859950000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413264.859950000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "18.235.25.252", "evidence": [ { "udp_stream": 70, "frame_number": 9126, "display_filter": "frame.number == 9126", "timestamp_epoch": "1575413262.266157000" } ], "is_private": false, "observable_id": "observable-4b9ef054aab81ab8a6fb6b9c", "last_seen_epoch": "1575413262.266157000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.266157000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "180.163.8.114", "evidence": [ { "udp_stream": 137, "frame_number": 15281, "display_filter": "frame.number == 15281", "timestamp_epoch": "1575413425.403718000" }, { "udp_stream": 138, "frame_number": 15576, "display_filter": "frame.number == 15576", "timestamp_epoch": "1575413428.584602000" }, { "udp_stream": 145, "frame_number": 15951, "display_filter": "frame.number == 15951", "timestamp_epoch": "1575413434.109141000" }, { "udp_stream": 146, "frame_number": 15967, "display_filter": "frame.number == 15967", "timestamp_epoch": "1575413440.498835000" }, { "udp_stream": 159, "frame_number": 16149, "display_filter": "frame.number == 16149", "timestamp_epoch": "1575413455.357740000" }, { "udp_stream": 160, "frame_number": 16160, "display_filter": "frame.number == 16160", "timestamp_epoch": "1575413456.425216000" }, { "udp_stream": 161, "frame_number": 16179, "display_filter": "frame.number == 16179", "timestamp_epoch": "1575413457.526856000" }, { "udp_stream": 162, "frame_number": 16196, "display_filter": "frame.number == 16196", "timestamp_epoch": "1575413468.760703000" }, { "udp_stream": 163, "frame_number": 16209, "display_filter": "frame.number == 16209", "timestamp_epoch": "1575413469.819055000" }, { "udp_stream": 164, "frame_number": 16309, "display_filter": "frame.number == 16309", "timestamp_epoch": "1575413756.347599000" }, { "udp_stream": 165, "frame_number": 16432, "display_filter": "frame.number == 16432", "timestamp_epoch": "1575414056.349092000" }, { "udp_stream": 166, "frame_number": 16443, "display_filter": "frame.number == 16443", "timestamp_epoch": "1575414057.413839000" }, { "udp_stream": 168, "frame_number": 16487, "display_filter": "frame.number == 16487", "timestamp_epoch": "1575414357.417756000" }, { "udp_stream": 190, "frame_number": 21099, "display_filter": "frame.number == 21099", "timestamp_epoch": "1575414657.443819000" }, { "udp_stream": 191, "frame_number": 21110, "display_filter": "frame.number == 21110", "timestamp_epoch": "1575414658.500356000" }, { "udp_stream": 192, "frame_number": 21123, "display_filter": "frame.number == 21123", "timestamp_epoch": "1575414669.784425000" } ], "is_private": false, "observable_id": "observable-cb5862ade133b232d2ffa802", "last_seen_epoch": "1575414669.784425000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413425.403718000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "184.172.48.71", "evidence": [ { "udp_stream": 103, "frame_number": 10851, "display_filter": "frame.number == 10851", "timestamp_epoch": "1575413267.965671000" } ], "is_private": false, "observable_id": "observable-3bb361ff3506a9e1771f8d91", "last_seen_epoch": "1575413267.965671000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413267.965671000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "184.203.37.188", "evidence": [ { "udp_stream": 155, "frame_number": 16142, "display_filter": "frame.number == 16142", "timestamp_epoch": "1575413455.067315000" }, { "udp_stream": 156, "frame_number": 16144, "display_filter": "frame.number == 16144", "timestamp_epoch": "1575413455.075680000" } ], "is_private": false, "observable_id": "observable-c9fb67f0dae058f4624cb71e", "last_seen_epoch": "1575413455.075680000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413455.067315000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "184.86.155.127", "evidence": [ { "udp_stream": 45, "frame_number": 5073, "display_filter": "frame.number == 5073", "timestamp_epoch": "1575413247.091636000" } ], "is_private": false, "observable_id": "observable-67bdef73c947d1c9995eeaff", "last_seen_epoch": "1575413247.091636000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413247.091636000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "185.167.164.42", "evidence": [ { "udp_stream": 90, "frame_number": 9997, "display_filter": "frame.number == 9997", "timestamp_epoch": "1575413264.964593000" } ], "is_private": false, "observable_id": "observable-bba1d7785044d632c3212dc4", "last_seen_epoch": "1575413264.964593000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413264.964593000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "185.167.164.43", "evidence": [ { "udp_stream": 90, "frame_number": 9997, "display_filter": "frame.number == 9997", "timestamp_epoch": "1575413264.964593000" } ], "is_private": false, "observable_id": "observable-51dac8e51a0d5350ce4cfaa6", "last_seen_epoch": "1575413264.964593000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413264.964593000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "185.167.164.49", "evidence": [ { "udp_stream": 90, "frame_number": 9997, "display_filter": "frame.number == 9997", "timestamp_epoch": "1575413264.964593000" } ], "is_private": false, "observable_id": "observable-6d1006ebcd51ca7f504849c0", "last_seen_epoch": "1575413264.964593000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413264.964593000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "185.167.164.51", "evidence": [ { "udp_stream": 90, "frame_number": 9997, "display_filter": "frame.number == 9997", "timestamp_epoch": "1575413264.964593000" } ], "is_private": false, "observable_id": "observable-b8ea62a680c21db4d49943a7", "last_seen_epoch": "1575413264.964593000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413264.964593000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "192.184.69.155", "evidence": [ { "udp_stream": 82, "frame_number": 9360, "display_filter": "frame.number == 9360", "timestamp_epoch": "1575413262.717743000" } ], "is_private": false, "observable_id": "observable-6ab63c6c4a700e1d46163e67", "last_seen_epoch": "1575413262.717743000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.717743000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "192.184.69.156", "evidence": [ { "udp_stream": 82, "frame_number": 9360, "display_filter": "frame.number == 9360", "timestamp_epoch": "1575413262.717743000" } ], "is_private": false, "observable_id": "observable-fc204f7e0082b0be14f6af0a", "last_seen_epoch": "1575413262.717743000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.717743000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "192.184.69.183", "evidence": [ { "udp_stream": 82, "frame_number": 9360, "display_filter": "frame.number == 9360", "timestamp_epoch": "1575413262.717743000" } ], "is_private": false, "observable_id": "observable-6bd85929f84b67ef2a4a7bae", "last_seen_epoch": "1575413262.717743000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.717743000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "192.184.69.197", "evidence": [ { "udp_stream": 82, "frame_number": 9360, "display_filter": "frame.number == 9360", "timestamp_epoch": "1575413262.717743000" } ], "is_private": false, "observable_id": "observable-b9db4f1c1937872982f91cd1", "last_seen_epoch": "1575413262.717743000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.717743000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "192.184.69.204", "evidence": [ { "udp_stream": 82, "frame_number": 9360, "display_filter": "frame.number == 9360", "timestamp_epoch": "1575413262.717743000" } ], "is_private": false, "observable_id": "observable-4b99db10171e4428e06c07a4", "last_seen_epoch": "1575413262.717743000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.717743000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "192.184.69.225", "evidence": [ { "udp_stream": 82, "frame_number": 9360, "display_filter": "frame.number == 9360", "timestamp_epoch": "1575413262.717743000" } ], "is_private": false, "observable_id": "observable-0cafb19380d920cd90022381", "last_seen_epoch": "1575413262.717743000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.717743000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "192.184.69.243", "evidence": [ { "udp_stream": 82, "frame_number": 9360, "display_filter": "frame.number == 9360", "timestamp_epoch": "1575413262.717743000" } ], "is_private": false, "observable_id": "observable-6f15b5822ed3d9ee61dcc305", "last_seen_epoch": "1575413262.717743000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.717743000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "192.184.69.244", "evidence": [ { "udp_stream": 82, "frame_number": 9360, "display_filter": "frame.number == 9360", "timestamp_epoch": "1575413262.717743000" } ], "is_private": false, "observable_id": "observable-5a76df3445c61f8d08ee6c23", "last_seen_epoch": "1575413262.717743000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.717743000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "192.229.210.141", "evidence": [ { "udp_stream": 46, "frame_number": 5225, "display_filter": "frame.number == 5225", "timestamp_epoch": "1575413248.059796000" } ], "is_private": false, "observable_id": "observable-ab5b144237527f61d800146c", "last_seen_epoch": "1575413248.059796000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413248.059796000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "192.229.211.36", "evidence": [ { "udp_stream": 41, "frame_number": 4184, "display_filter": "frame.number == 4184", "timestamp_epoch": "1575413244.602338000" }, { "udp_stream": 47, "frame_number": 5418, "display_filter": "frame.number == 5418", "timestamp_epoch": "1575413248.467142000" } ], "is_private": false, "observable_id": "observable-5a9a5ecbf9b0051bb88859e2", "last_seen_epoch": "1575413248.467142000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413244.602338000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "193.183.98.66", "evidence": [], "is_private": false, "observable_id": "observable-86985aa49b1a045aa11fd98c", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "198.70.69.154", "evidence": [ { "udp_stream": 97, "frame_number": 10617, "display_filter": "frame.number == 10617", "timestamp_epoch": "1575413266.894861000" }, { "udp_stream": 96, "frame_number": 10618, "display_filter": "frame.number == 10618", "timestamp_epoch": "1575413266.894952000" } ], "is_private": false, "observable_id": "observable-ba7483382bc3edd59f2f7b3a", "last_seen_epoch": "1575413266.894952000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413266.894861000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "198.70.69.161", "evidence": [ { "udp_stream": 97, "frame_number": 10617, "display_filter": "frame.number == 10617", "timestamp_epoch": "1575413266.894861000" }, { "udp_stream": 96, "frame_number": 10618, "display_filter": "frame.number == 10618", "timestamp_epoch": "1575413266.894952000" } ], "is_private": false, "observable_id": "observable-ef01ebc7bef18dec2ec44f43", "last_seen_epoch": "1575413266.894952000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413266.894861000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "198.8.70.128", "evidence": [ { "udp_stream": 86, "frame_number": 9983, "display_filter": "frame.number == 9983", "timestamp_epoch": "1575413264.913538000" } ], "is_private": false, "observable_id": "observable-fad8af9fc558dee4cc3c425f", "last_seen_epoch": "1575413264.913538000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413264.913538000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "199.255.32.89", "evidence": [ { "udp_stream": 186, "frame_number": 17389, "display_filter": "frame.number == 17389", "timestamp_epoch": "1575414489.558324000" } ], "is_private": false, "observable_id": "observable-157882c01902966bc15b9402", "last_seen_epoch": "1575414489.558324000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414489.558324000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "204.74.252.20", "evidence": [ { "udp_stream": 126, "frame_number": 13408, "display_filter": "frame.number == 13408", "timestamp_epoch": "1575413306.386965000" } ], "is_private": false, "observable_id": "observable-a70a0e2a4468089d022b60c8", "last_seen_epoch": "1575413306.386965000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413306.386965000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "204.74.252.28", "evidence": [ { "udp_stream": 126, "frame_number": 13408, "display_filter": "frame.number == 13408", "timestamp_epoch": "1575413306.386965000" } ], "is_private": false, "observable_id": "observable-5fe6de0b69ec58f1575ac0bc", "last_seen_epoch": "1575413306.386965000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413306.386965000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "204.79.197.200", "evidence": [ { "udp_stream": 13, "frame_number": 556, "display_filter": "frame.number == 556", "timestamp_epoch": "1575413159.571651000" }, { "udp_stream": 14, "frame_number": 557, "display_filter": "frame.number == 557", "timestamp_epoch": "1575413159.571721000" }, { "udp_stream": 15, "frame_number": 558, "display_filter": "frame.number == 558", "timestamp_epoch": "1575413159.571772000" }, { "udp_stream": 10, "frame_number": 559, "display_filter": "frame.number == 559", "timestamp_epoch": "1575413159.571825000" }, { "udp_stream": 114, "frame_number": 12765, "display_filter": "frame.number == 12765", "timestamp_epoch": "1575413305.326078000" }, { "udp_stream": 115, "frame_number": 12766, "display_filter": "frame.number == 12766", "timestamp_epoch": "1575413305.326160000" }, { "udp_stream": 116, "frame_number": 12767, "display_filter": "frame.number == 12767", "timestamp_epoch": "1575413305.326217000" }, { "udp_stream": 113, "frame_number": 12768, "display_filter": "frame.number == 12768", "timestamp_epoch": "1575413305.326272000" }, { "udp_stream": 142, "frame_number": 15930, "display_filter": "frame.number == 15930", "timestamp_epoch": "1575413432.778153000" }, { "udp_stream": 143, "frame_number": 15931, "display_filter": "frame.number == 15931", "timestamp_epoch": "1575413432.778226000" }, { "udp_stream": 144, "frame_number": 15932, "display_filter": "frame.number == 15932", "timestamp_epoch": "1575413432.778283000" }, { "udp_stream": 141, "frame_number": 15933, "display_filter": "frame.number == 15933", "timestamp_epoch": "1575413432.778338000" }, { "udp_stream": 176, "frame_number": 17248, "display_filter": "frame.number == 17248", "timestamp_epoch": "1575414487.898629000" }, { "udp_stream": 178, "frame_number": 17249, "display_filter": "frame.number == 17249", "timestamp_epoch": "1575414487.898713000" }, { "udp_stream": 179, "frame_number": 17250, "display_filter": "frame.number == 17250", "timestamp_epoch": "1575414487.898793000" }, { "udp_stream": 175, "frame_number": 17251, "display_filter": "frame.number == 17251", "timestamp_epoch": "1575414487.898873000" } ], "is_private": false, "observable_id": "observable-04e2557fec513ca02ec4c652", "last_seen_epoch": "1575414487.898873000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413159.571651000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "205.180.86.172", "evidence": [ { "udp_stream": 88, "frame_number": 10032, "display_filter": "frame.number == 10032", "timestamp_epoch": "1575413265.132382000" }, { "udp_stream": 102, "frame_number": 10873, "display_filter": "frame.number == 10873", "timestamp_epoch": "1575413268.023538000" } ], "is_private": false, "observable_id": "observable-8918a982f46c7d6289576bb5", "last_seen_epoch": "1575413268.023538000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413265.132382000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "208.67.222.222", "evidence": [ { "udp_stream": 148, "frame_number": 16130, "display_filter": "frame.number == 16130", "timestamp_epoch": "1575413450.595849000" }, { "udp_stream": 147, "frame_number": 16131, "display_filter": "frame.number == 16131", "timestamp_epoch": "1575413450.595932000" } ], "is_private": false, "observable_id": "observable-c90673b3b9499536abac2604", "last_seen_epoch": "1575413450.595932000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413450.595849000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "209.15.36.35", "evidence": [ { "udp_stream": 101, "frame_number": 10850, "display_filter": "frame.number == 10850", "timestamp_epoch": "1575413267.965591000" } ], "is_private": false, "observable_id": "observable-6276f5efb51efa07442bea52", "last_seen_epoch": "1575413267.965591000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413267.965591000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "216.200.232.201", "evidence": [ { "udp_stream": 77, "frame_number": 9305, "display_filter": "frame.number == 9305", "timestamp_epoch": "1575413262.640867000" } ], "is_private": false, "observable_id": "observable-9a29e85c628ac3181db74d76", "last_seen_epoch": "1575413262.640867000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.640867000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "216.200.232.221", "evidence": [ { "udp_stream": 77, "frame_number": 9305, "display_filter": "frame.number == 9305", "timestamp_epoch": "1575413262.640867000" } ], "is_private": false, "observable_id": "observable-a7199643c60390b3b4771e2e", "last_seen_epoch": "1575413262.640867000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.640867000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "216.58.193.130", "evidence": [ { "udp_stream": 63, "frame_number": 8199, "display_filter": "frame.number == 8199", "timestamp_epoch": "1575413258.370803000" }, { "udp_stream": 72, "frame_number": 9322, "display_filter": "frame.number == 9322", "timestamp_epoch": "1575413262.643180000" } ], "is_private": false, "observable_id": "observable-09295d5e01b2eb4cf020d04b", "last_seen_epoch": "1575413262.643180000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413258.370803000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "216.58.194.106", "evidence": [ { "udp_stream": 65, "frame_number": 8315, "display_filter": "frame.number == 8315", "timestamp_epoch": "1575413258.762246000" } ], "is_private": false, "observable_id": "observable-7f9f6575f2a0ea01ee52a552", "last_seen_epoch": "1575413258.762246000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413258.762246000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "224.0.0.22", "evidence": [], "is_private": false, "observable_id": "observable-936831f168096fa700c90659", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "224.0.0.252", "evidence": [], "is_private": false, "observable_id": "observable-d6357c0371ba87f642b89d1f", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.11.217.11", "evidence": [ { "udp_stream": 80, "frame_number": 9345, "display_filter": "frame.number == 9345", "timestamp_epoch": "1575413262.654064000" } ], "is_private": false, "observable_id": "observable-10e6b7b280ccc73ee40f0b33", "last_seen_epoch": "1575413262.654064000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.654064000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.11.217.71", "evidence": [ { "udp_stream": 76, "frame_number": 9336, "display_filter": "frame.number == 9336", "timestamp_epoch": "1575413262.649448000" }, { "udp_stream": 93, "frame_number": 10059, "display_filter": "frame.number == 10059", "timestamp_epoch": "1575413265.173234000" }, { "udp_stream": 111, "frame_number": 11250, "display_filter": "frame.number == 11250", "timestamp_epoch": "1575413268.813668000" } ], "is_private": false, "observable_id": "observable-4f6925b684b68889408ecbcb", "last_seen_epoch": "1575413268.813668000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.649448000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.11.218.15", "evidence": [ { "udp_stream": 54, "frame_number": 7496, "display_filter": "frame.number == 7496", "timestamp_epoch": "1575413254.362555000" }, { "udp_stream": 55, "frame_number": 7652, "display_filter": "frame.number == 7652", "timestamp_epoch": "1575413255.067988000" } ], "is_private": false, "observable_id": "observable-d9c3b73862ec72f1aef5ee1f", "last_seen_epoch": "1575413255.067988000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413254.362555000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.67.118.68", "evidence": [ { "udp_stream": 62, "frame_number": 8085, "display_filter": "frame.number == 8085", "timestamp_epoch": "1575413257.988658000" } ], "is_private": false, "observable_id": "observable-cdffad18321c16dfc0d95b4e", "last_seen_epoch": "1575413257.988658000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413257.988658000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.67.120.135", "evidence": [ { "udp_stream": 121, "frame_number": 13263, "display_filter": "frame.number == 13263", "timestamp_epoch": "1575413306.258315000" } ], "is_private": false, "observable_id": "observable-8729e07b290f08394fcdb12d", "last_seen_epoch": "1575413306.258315000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413306.258315000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.7.93.115", "evidence": [ { "udp_stream": 124, "frame_number": 13357, "display_filter": "frame.number == 13357", "timestamp_epoch": "1575413306.307779000" } ], "is_private": false, "observable_id": "observable-d4183688314d4160d7893aa1", "last_seen_epoch": "1575413306.307779000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413306.307779000" }, { "type": "ipv4", "roles": [ "http-host", "network-endpoint" ], "value": "239.255.255.250", "evidence": [ { "frame_number": 3182, "display_filter": "frame.number == 3182", "timestamp_epoch": "1575413205.860754000" }, { "frame_number": 3184, "display_filter": "frame.number == 3184", "timestamp_epoch": "1575413206.181964000" }, { "frame_number": 3199, "display_filter": "frame.number == 3199", "timestamp_epoch": "1575413208.859570000" }, { "frame_number": 3218, "display_filter": "frame.number == 3218", "timestamp_epoch": "1575413209.186580000" }, { "frame_number": 3498, "display_filter": "frame.number == 3498", "timestamp_epoch": "1575413211.874717000" }, { "frame_number": 3534, "display_filter": "frame.number == 3534", "timestamp_epoch": "1575413212.187013000" } ], "is_private": false, "observable_id": "observable-856c8a5eb0af5a409dd1322c", "last_seen_epoch": "1575413212.187013000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413205.860754000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "255.255.255.255", "evidence": [], "is_private": true, "observable_id": "observable-a6d3b339b7275673bb60b70b", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "3.13.100.77", "evidence": [ { "udp_stream": 26, "frame_number": 2223, "display_filter": "frame.number == 2223", "timestamp_epoch": "1575413165.992964000" } ], "is_private": false, "observable_id": "observable-ded7f05c1af8b2cb1cdf8b90", "last_seen_epoch": "1575413165.992964000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413165.992964000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "3.135.8.221", "evidence": [ { "udp_stream": 26, "frame_number": 2223, "display_filter": "frame.number == 2223", "timestamp_epoch": "1575413165.992964000" } ], "is_private": false, "observable_id": "observable-8da81b0fa6a3f4365386b297", "last_seen_epoch": "1575413165.992964000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413165.992964000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "3.136.2.145", "evidence": [ { "udp_stream": 26, "frame_number": 2223, "display_filter": "frame.number == 2223", "timestamp_epoch": "1575413165.992964000" } ], "is_private": false, "observable_id": "observable-192652a35367578be005b5ac", "last_seen_epoch": "1575413165.992964000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413165.992964000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "3.136.4.126", "evidence": [ { "udp_stream": 26, "frame_number": 2223, "display_filter": "frame.number == 2223", "timestamp_epoch": "1575413165.992964000" } ], "is_private": false, "observable_id": "observable-9aa105d2bd26e51b3f7ebe5d", "last_seen_epoch": "1575413165.992964000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413165.992964000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "3.136.40.187", "evidence": [ { "udp_stream": 26, "frame_number": 2223, "display_filter": "frame.number == 2223", "timestamp_epoch": "1575413165.992964000" } ], "is_private": false, "observable_id": "observable-f904f658e186e1247f183a21", "last_seen_epoch": "1575413165.992964000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413165.992964000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "3.18.142.126", "evidence": [ { "udp_stream": 26, "frame_number": 2223, "display_filter": "frame.number == 2223", "timestamp_epoch": "1575413165.992964000" } ], "is_private": false, "observable_id": "observable-69d9da9f83d1c34812bfe04a", "last_seen_epoch": "1575413165.992964000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413165.992964000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "3.19.254.171", "evidence": [ { "udp_stream": 26, "frame_number": 2223, "display_filter": "frame.number == 2223", "timestamp_epoch": "1575413165.992964000" } ], "is_private": false, "observable_id": "observable-aac52f7d6086501ac050cdd8", "last_seen_epoch": "1575413165.992964000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413165.992964000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "3.213.234.38", "evidence": [ { "udp_stream": 110, "frame_number": 10993, "display_filter": "frame.number == 10993", "timestamp_epoch": "1575413268.359202000" } ], "is_private": false, "observable_id": "observable-64b84e4d1f087491d6e946f5", "last_seen_epoch": "1575413268.359202000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413268.359202000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "3.213.8.28", "evidence": [ { "udp_stream": 73, "frame_number": 9324, "display_filter": "frame.number == 9324", "timestamp_epoch": "1575413262.643694000" } ], "is_private": false, "observable_id": "observable-2183f1c9baa6f81b76680f2a", "last_seen_epoch": "1575413262.643694000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.643694000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "3.215.246.105", "evidence": [ { "udp_stream": 73, "frame_number": 9324, "display_filter": "frame.number == 9324", "timestamp_epoch": "1575413262.643694000" } ], "is_private": false, "observable_id": "observable-d03cd857bfaf77e48a44d60a", "last_seen_epoch": "1575413262.643694000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.643694000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "3.216.103.132", "evidence": [ { "udp_stream": 84, "frame_number": 9864, "display_filter": "frame.number == 9864", "timestamp_epoch": "1575413264.518110000" } ], "is_private": false, "observable_id": "observable-74db95b279ca3f5d493acf22", "last_seen_epoch": "1575413264.518110000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413264.518110000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "3.218.16.73", "evidence": [ { "udp_stream": 43, "frame_number": 4892, "display_filter": "frame.number == 4892", "timestamp_epoch": "1575413246.304051000" } ], "is_private": false, "observable_id": "observable-dd0110cdbfa1a521cd565eab", "last_seen_epoch": "1575413246.304051000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413246.304051000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "3.220.227.225", "evidence": [ { "udp_stream": 29, "frame_number": 2546, "display_filter": "frame.number == 2546", "timestamp_epoch": "1575413166.668934000" } ], "is_private": false, "observable_id": "observable-3e4244f35fc1b0cef3b0f8ff", "last_seen_epoch": "1575413166.668934000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413166.668934000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "3.221.250.206", "evidence": [ { "udp_stream": 105, "frame_number": 10876, "display_filter": "frame.number == 10876", "timestamp_epoch": "1575413268.026147000" } ], "is_private": false, "observable_id": "observable-dc8b6c49110ac26100310901", "last_seen_epoch": "1575413268.026147000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413268.026147000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "3.223.16.87", "evidence": [ { "udp_stream": 105, "frame_number": 10876, "display_filter": "frame.number == 10876", "timestamp_epoch": "1575413268.026147000" } ], "is_private": false, "observable_id": "observable-18840df1b8deb0796581255d", "last_seen_epoch": "1575413268.026147000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413268.026147000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "3.225.187.149", "evidence": [ { "udp_stream": 39, "frame_number": 3795, "display_filter": "frame.number == 3795", "timestamp_epoch": "1575413237.897960000" }, { "udp_stream": 40, "frame_number": 3837, "display_filter": "frame.number == 3837", "timestamp_epoch": "1575413238.558263000" } ], "is_private": false, "observable_id": "observable-f02543800ff642450668612a", "last_seen_epoch": "1575413238.558263000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413237.897960000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "3.226.23.55", "evidence": [ { "udp_stream": 189, "frame_number": 18913, "display_filter": "frame.number == 18913", "timestamp_epoch": "1575414494.106735000" } ], "is_private": false, "observable_id": "observable-2e7c5447282fa8b33d185a2d", "last_seen_epoch": "1575414494.106735000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414494.106735000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "3.232.65.116", "evidence": [ { "udp_stream": 84, "frame_number": 9864, "display_filter": "frame.number == 9864", "timestamp_epoch": "1575413264.518110000" } ], "is_private": false, "observable_id": "observable-47de3f25a2ddb3bd5afb9ab6", "last_seen_epoch": "1575413264.518110000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413264.518110000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "3.83.197.207", "evidence": [ { "udp_stream": 184, "frame_number": 17359, "display_filter": "frame.number == 17359", "timestamp_epoch": "1575414489.334625000" }, { "udp_stream": 185, "frame_number": 17386, "display_filter": "frame.number == 17386", "timestamp_epoch": "1575414489.544905000" } ], "is_private": false, "observable_id": "observable-7fd9626ab2eaca439b748d59", "last_seen_epoch": "1575414489.544905000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414489.334625000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "34.193.46.35", "evidence": [ { "udp_stream": 84, "frame_number": 9864, "display_filter": "frame.number == 9864", "timestamp_epoch": "1575413264.518110000" } ], "is_private": false, "observable_id": "observable-7a407b4c4e726429adae9b13", "last_seen_epoch": "1575413264.518110000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413264.518110000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.194.106.87", "evidence": [ { "udp_stream": 189, "frame_number": 18913, "display_filter": "frame.number == 18913", "timestamp_epoch": "1575414494.106735000" } ], "is_private": false, "observable_id": "observable-4561f8f4a23dca047d0cdebe", "last_seen_epoch": "1575414494.106735000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414494.106735000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.196.158.70", "evidence": [ { "udp_stream": 75, "frame_number": 9334, "display_filter": "frame.number == 9334", "timestamp_epoch": "1575413262.647446000" } ], "is_private": false, "observable_id": "observable-4c596c56ca45be56de843fe4", "last_seen_epoch": "1575413262.647446000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.647446000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.197.7.23", "evidence": [ { "udp_stream": 183, "frame_number": 17364, "display_filter": "frame.number == 17364", "timestamp_epoch": "1575414489.352724000" } ], "is_private": false, "observable_id": "observable-4738f80700305ad4f18f476a", "last_seen_epoch": "1575414489.352724000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414489.352724000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.199.169.142", "evidence": [ { "udp_stream": 182, "frame_number": 17363, "display_filter": "frame.number == 17363", "timestamp_epoch": "1575414489.352624000" } ], "is_private": false, "observable_id": "observable-a17726e1629ed9d42802f8b8", "last_seen_epoch": "1575414489.352624000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414489.352624000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.200.67.128", "evidence": [ { "udp_stream": 105, "frame_number": 10876, "display_filter": "frame.number == 10876", "timestamp_epoch": "1575413268.026147000" } ], "is_private": false, "observable_id": "observable-e568cace9dd4d659e37f2c10", "last_seen_epoch": "1575413268.026147000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413268.026147000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.201.90.208", "evidence": [ { "udp_stream": 60, "frame_number": 8009, "display_filter": "frame.number == 8009", "timestamp_epoch": "1575413257.314055000" } ], "is_private": false, "observable_id": "observable-e8179306bab887a89dd62e32", "last_seen_epoch": "1575413257.314055000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413257.314055000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.204.123.32", "evidence": [ { "udp_stream": 52, "frame_number": 7233, "display_filter": "frame.number == 7233", "timestamp_epoch": "1575413253.235151000" }, { "udp_stream": 56, "frame_number": 7655, "display_filter": "frame.number == 7655", "timestamp_epoch": "1575413255.099136000" }, { "udp_stream": 71, "frame_number": 9152, "display_filter": "frame.number == 9152", "timestamp_epoch": "1575413262.342458000" } ], "is_private": false, "observable_id": "observable-16d51c4c455b18a1cf566957", "last_seen_epoch": "1575413262.342458000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413253.235151000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "34.204.232.247", "evidence": [ { "udp_stream": 60, "frame_number": 8009, "display_filter": "frame.number == 8009", "timestamp_epoch": "1575413257.314055000" } ], "is_private": false, "observable_id": "observable-5c244ab5be8b670656954256", "last_seen_epoch": "1575413257.314055000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413257.314055000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "34.204.4.212", "evidence": [ { "udp_stream": 52, "frame_number": 7233, "display_filter": "frame.number == 7233", "timestamp_epoch": "1575413253.235151000" }, { "udp_stream": 56, "frame_number": 7655, "display_filter": "frame.number == 7655", "timestamp_epoch": "1575413255.099136000" }, { "udp_stream": 71, "frame_number": 9152, "display_filter": "frame.number == 9152", "timestamp_epoch": "1575413262.342458000" } ], "is_private": false, "observable_id": "observable-3a8fe68b8d94e7e662dd1023", "last_seen_epoch": "1575413262.342458000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413253.235151000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.224.172.188", "evidence": [ { "udp_stream": 75, "frame_number": 9334, "display_filter": "frame.number == 9334", "timestamp_epoch": "1575413262.647446000" } ], "is_private": false, "observable_id": "observable-cdacb4f9e120baac8e1faf98", "last_seen_epoch": "1575413262.647446000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.647446000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.225.20.218", "evidence": [ { "udp_stream": 84, "frame_number": 9864, "display_filter": "frame.number == 9864", "timestamp_epoch": "1575413264.518110000" } ], "is_private": false, "observable_id": "observable-46865c1bff4f250db2ebc543", "last_seen_epoch": "1575413264.518110000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413264.518110000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.226.173.88", "evidence": [ { "udp_stream": 105, "frame_number": 10876, "display_filter": "frame.number == 10876", "timestamp_epoch": "1575413268.026147000" } ], "is_private": false, "observable_id": "observable-248bb3ba8c3170487aa3128c", "last_seen_epoch": "1575413268.026147000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413268.026147000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.228.100.37", "evidence": [ { "udp_stream": 75, "frame_number": 9334, "display_filter": "frame.number == 9334", "timestamp_epoch": "1575413262.647446000" } ], "is_private": false, "observable_id": "observable-82e5d34d6fbf46d48bc84a23", "last_seen_epoch": "1575413262.647446000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.647446000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "34.231.235.125", "evidence": [ { "udp_stream": 52, "frame_number": 7233, "display_filter": "frame.number == 7233", "timestamp_epoch": "1575413253.235151000" }, { "udp_stream": 56, "frame_number": 7655, "display_filter": "frame.number == 7655", "timestamp_epoch": "1575413255.099136000" }, { "udp_stream": 71, "frame_number": 9152, "display_filter": "frame.number == 9152", "timestamp_epoch": "1575413262.342458000" } ], "is_private": false, "observable_id": "observable-ed97a160dd745ca9c6cfa22e", "last_seen_epoch": "1575413262.342458000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413253.235151000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.232.21.42", "evidence": [ { "udp_stream": 182, "frame_number": 17363, "display_filter": "frame.number == 17363", "timestamp_epoch": "1575414489.352624000" } ], "is_private": false, "observable_id": "observable-cfc7a909fecb4943454d7df4", "last_seen_epoch": "1575414489.352624000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414489.352624000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "34.232.64.168", "evidence": [ { "udp_stream": 27, "frame_number": 2214, "display_filter": "frame.number == 2214", "timestamp_epoch": "1575413165.990675000" } ], "is_private": false, "observable_id": "observable-762b37d8975c5a28b351cf61", "last_seen_epoch": "1575413165.990675000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413165.990675000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.233.8.16", "evidence": [ { "udp_stream": 105, "frame_number": 10876, "display_filter": "frame.number == 10876", "timestamp_epoch": "1575413268.026147000" } ], "is_private": false, "observable_id": "observable-0a8d5aad0aac5f6519e808b1", "last_seen_epoch": "1575413268.026147000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413268.026147000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.235.254.111", "evidence": [ { "udp_stream": 75, "frame_number": 9334, "display_filter": "frame.number == 9334", "timestamp_epoch": "1575413262.647446000" } ], "is_private": false, "observable_id": "observable-c6b83ead36aa14ab20a92fe9", "last_seen_epoch": "1575413262.647446000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.647446000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "34.235.45.38", "evidence": [ { "udp_stream": 105, "frame_number": 10876, "display_filter": "frame.number == 10876", "timestamp_epoch": "1575413268.026147000" } ], "is_private": false, "observable_id": "observable-caf874f62f1debebf188d945", "last_seen_epoch": "1575413268.026147000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413268.026147000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.236.118.184", "evidence": [ { "udp_stream": 105, "frame_number": 10876, "display_filter": "frame.number == 10876", "timestamp_epoch": "1575413268.026147000" } ], "is_private": false, "observable_id": "observable-f19c6e4bf437ca585475550e", "last_seen_epoch": "1575413268.026147000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413268.026147000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.236.135.105", "evidence": [ { "udp_stream": 105, "frame_number": 10876, "display_filter": "frame.number == 10876", "timestamp_epoch": "1575413268.026147000" } ], "is_private": false, "observable_id": "observable-1979d5f40f68ae20ab92cffb", "last_seen_epoch": "1575413268.026147000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413268.026147000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.236.202.21", "evidence": [ { "udp_stream": 98, "frame_number": 10815, "display_filter": "frame.number == 10815", "timestamp_epoch": "1575413267.789823000" } ], "is_private": false, "observable_id": "observable-cd34721d9896b91c1c39e734", "last_seen_epoch": "1575413267.789823000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413267.789823000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.237.248.89", "evidence": [ { "udp_stream": 87, "frame_number": 9974, "display_filter": "frame.number == 9974", "timestamp_epoch": "1575413264.859950000" } ], "is_private": false, "observable_id": "observable-950d101c75f49a4add508aee", "last_seen_epoch": "1575413264.859950000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413264.859950000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.238.112.88", "evidence": [ { "udp_stream": 110, "frame_number": 10993, "display_filter": "frame.number == 10993", "timestamp_epoch": "1575413268.359202000" } ], "is_private": false, "observable_id": "observable-87b928c885a26d9a8322cdb7", "last_seen_epoch": "1575413268.359202000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413268.359202000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "34.239.215.228", "evidence": [ { "udp_stream": 106, "frame_number": 10888, "display_filter": "frame.number == 10888", "timestamp_epoch": "1575413268.087189000" } ], "is_private": false, "observable_id": "observable-4cae5e558c99338b67eae5fd", "last_seen_epoch": "1575413268.087189000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413268.087189000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "35.153.187.227", "evidence": [ { "udp_stream": 52, "frame_number": 7233, "display_filter": "frame.number == 7233", "timestamp_epoch": "1575413253.235151000" }, { "udp_stream": 56, "frame_number": 7655, "display_filter": "frame.number == 7655", "timestamp_epoch": "1575413255.099136000" }, { "udp_stream": 71, "frame_number": 9152, "display_filter": "frame.number == 9152", "timestamp_epoch": "1575413262.342458000" } ], "is_private": false, "observable_id": "observable-315408110d5353a97523afb7", "last_seen_epoch": "1575413262.342458000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413253.235151000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "35.153.21.25", "evidence": [ { "udp_stream": 87, "frame_number": 9974, "display_filter": "frame.number == 9974", "timestamp_epoch": "1575413264.859950000" } ], "is_private": false, "observable_id": "observable-36780b13b2284b1ad59d4795", "last_seen_epoch": "1575413264.859950000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413264.859950000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "35.153.252.120", "evidence": [ { "udp_stream": 184, "frame_number": 17359, "display_filter": "frame.number == 17359", "timestamp_epoch": "1575414489.334625000" }, { "udp_stream": 185, "frame_number": 17386, "display_filter": "frame.number == 17386", "timestamp_epoch": "1575414489.544905000" } ], "is_private": false, "observable_id": "observable-45c1ae8921fcb2172f7f780f", "last_seen_epoch": "1575414489.544905000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414489.334625000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "35.161.118.229", "evidence": [ { "udp_stream": 33, "frame_number": 2703, "display_filter": "frame.number == 2703", "timestamp_epoch": "1575413167.311200000" } ], "is_private": false, "observable_id": "observable-28b874b6e587e64fce09a17f", "last_seen_epoch": "1575413167.311200000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413167.311200000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "35.165.180.187", "evidence": [ { "udp_stream": 33, "frame_number": 2703, "display_filter": "frame.number == 2703", "timestamp_epoch": "1575413167.311200000" } ], "is_private": false, "observable_id": "observable-fd06130632e2745eeda62977", "last_seen_epoch": "1575413167.311200000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413167.311200000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "35.169.207.73", "evidence": [ { "udp_stream": 92, "frame_number": 9982, "display_filter": "frame.number == 9982", "timestamp_epoch": "1575413264.913423000" } ], "is_private": false, "observable_id": "observable-242368323c2072b7f79dd7bd", "last_seen_epoch": "1575413264.913423000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413264.913423000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "35.170.121.134", "evidence": [ { "udp_stream": 75, "frame_number": 9334, "display_filter": "frame.number == 9334", "timestamp_epoch": "1575413262.647446000" } ], "is_private": false, "observable_id": "observable-75f98d3101f878714e039888", "last_seen_epoch": "1575413262.647446000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.647446000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "35.170.22.17", "evidence": [ { "udp_stream": 110, "frame_number": 10993, "display_filter": "frame.number == 10993", "timestamp_epoch": "1575413268.359202000" } ], "is_private": false, "observable_id": "observable-f05cacd6b22638bbd2a39cab", "last_seen_epoch": "1575413268.359202000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413268.359202000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "35.171.168.180", "evidence": [ { "udp_stream": 52, "frame_number": 7233, "display_filter": "frame.number == 7233", "timestamp_epoch": "1575413253.235151000" }, { "udp_stream": 56, "frame_number": 7655, "display_filter": "frame.number == 7655", "timestamp_epoch": "1575413255.099136000" }, { "udp_stream": 71, "frame_number": 9152, "display_filter": "frame.number == 9152", "timestamp_epoch": "1575413262.342458000" } ], "is_private": false, "observable_id": "observable-b4bb6055ddea709a20999aac", "last_seen_epoch": "1575413262.342458000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413253.235151000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "35.171.202.176", "evidence": [ { "udp_stream": 106, "frame_number": 10888, "display_filter": "frame.number == 10888", "timestamp_epoch": "1575413268.087189000" } ], "is_private": false, "observable_id": "observable-809481340acce0a59f9e1ca1", "last_seen_epoch": "1575413268.087189000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413268.087189000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "35.171.48.153", "evidence": [ { "udp_stream": 98, "frame_number": 10815, "display_filter": "frame.number == 10815", "timestamp_epoch": "1575413267.789823000" } ], "is_private": false, "observable_id": "observable-daab9e34ed86e707701a1a4c", "last_seen_epoch": "1575413267.789823000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413267.789823000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "35.172.104.215", "evidence": [ { "udp_stream": 52, "frame_number": 7233, "display_filter": "frame.number == 7233", "timestamp_epoch": "1575413253.235151000" }, { "udp_stream": 56, "frame_number": 7655, "display_filter": "frame.number == 7655", "timestamp_epoch": "1575413255.099136000" }, { "udp_stream": 71, "frame_number": 9152, "display_filter": "frame.number == 9152", "timestamp_epoch": "1575413262.342458000" } ], "is_private": false, "observable_id": "observable-53615dde138f7030908c71a7", "last_seen_epoch": "1575413262.342458000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413253.235151000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "35.173.158.96", "evidence": [ { "udp_stream": 183, "frame_number": 17364, "display_filter": "frame.number == 17364", "timestamp_epoch": "1575414489.352724000" } ], "is_private": false, "observable_id": "observable-e38f87318de2b864cde08779", "last_seen_epoch": "1575414489.352724000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414489.352724000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "35.174.30.193", "evidence": [ { "udp_stream": 92, "frame_number": 9982, "display_filter": "frame.number == 9982", "timestamp_epoch": "1575413264.913423000" } ], "is_private": false, "observable_id": "observable-ea8df95b2fc7e0d856824d13", "last_seen_epoch": "1575413264.913423000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413264.913423000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "35.186.239.238", "evidence": [ { "udp_stream": 89, "frame_number": 9979, "display_filter": "frame.number == 9979", "timestamp_epoch": "1575413264.894068000" } ], "is_private": false, "observable_id": "observable-28947f5eb77231777e426a82", "last_seen_epoch": "1575413264.894068000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413264.894068000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "35.190.36.172", "evidence": [ { "udp_stream": 68, "frame_number": 8643, "display_filter": "frame.number == 8643", "timestamp_epoch": "1575413260.379428000" } ], "is_private": false, "observable_id": "observable-8bee1cd4d6799d36b3ef0518", "last_seen_epoch": "1575413260.379428000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413260.379428000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "35.190.72.161", "evidence": [ { "udp_stream": 66, "frame_number": 8331, "display_filter": "frame.number == 8331", "timestamp_epoch": "1575413258.871609000" } ], "is_private": false, "observable_id": "observable-4d6b6853f811ef495278b091", "last_seen_epoch": "1575413258.871609000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413258.871609000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "35.207.24.140", "evidence": [ { "udp_stream": 120, "frame_number": 13146, "display_filter": "frame.number == 13146", "timestamp_epoch": "1575413306.126479000" } ], "is_private": false, "observable_id": "observable-c988b0ee39060f6ecc837bca", "last_seen_epoch": "1575413306.126479000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413306.126479000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "35.211.144.153", "evidence": [ { "udp_stream": 79, "frame_number": 9350, "display_filter": "frame.number == 9350", "timestamp_epoch": "1575413262.658303000" } ], "is_private": false, "observable_id": "observable-b4b01a9efc3cbb5327052afc", "last_seen_epoch": "1575413262.658303000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.658303000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "35.211.183.51", "evidence": [ { "udp_stream": 79, "frame_number": 9350, "display_filter": "frame.number == 9350", "timestamp_epoch": "1575413262.658303000" } ], "is_private": false, "observable_id": "observable-238b09044bda7270b18214ef", "last_seen_epoch": "1575413262.658303000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.658303000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "37.157.2.236", "evidence": [ { "udp_stream": 38, "frame_number": 3635, "display_filter": "frame.number == 3635", "timestamp_epoch": "1575413213.479991000" } ], "is_private": false, "observable_id": "observable-8d2460214d0f5858bff1af8c", "last_seen_epoch": "1575413213.479991000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413213.479991000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "37.157.2.237", "evidence": [ { "udp_stream": 38, "frame_number": 3635, "display_filter": "frame.number == 3635", "timestamp_epoch": "1575413213.479991000" } ], "is_private": false, "observable_id": "observable-001ad0d95198b9995b771891", "last_seen_epoch": "1575413213.479991000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413213.479991000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "37.157.4.23", "evidence": [ { "udp_stream": 38, "frame_number": 3635, "display_filter": "frame.number == 3635", "timestamp_epoch": "1575413213.479991000" } ], "is_private": false, "observable_id": "observable-1f412396f15767a60ff5b904", "last_seen_epoch": "1575413213.479991000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413213.479991000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "37.157.4.41", "evidence": [ { "udp_stream": 38, "frame_number": 3635, "display_filter": "frame.number == 3635", "timestamp_epoch": "1575413213.479991000" } ], "is_private": false, "observable_id": "observable-40f567398583c66b9639b319", "last_seen_epoch": "1575413213.479991000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413213.479991000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "37.157.6.246", "evidence": [ { "udp_stream": 38, "frame_number": 3635, "display_filter": "frame.number == 3635", "timestamp_epoch": "1575413213.479991000" } ], "is_private": false, "observable_id": "observable-7e3e13c33a393840fffec975", "last_seen_epoch": "1575413213.479991000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413213.479991000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "37.157.6.252", "evidence": [ { "udp_stream": 38, "frame_number": 3635, "display_filter": "frame.number == 3635", "timestamp_epoch": "1575413213.479991000" } ], "is_private": false, "observable_id": "observable-642eab2df5782850069c4e57", "last_seen_epoch": "1575413213.479991000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413213.479991000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "38.67.14.233", "evidence": [ { "udp_stream": 104, "frame_number": 10858, "display_filter": "frame.number == 10858", "timestamp_epoch": "1575413267.969283000" } ], "is_private": false, "observable_id": "observable-37c0e20dc55862c5af86bd92", "last_seen_epoch": "1575413267.969283000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413267.969283000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "50.116.194.21", "evidence": [ { "udp_stream": 78, "frame_number": 9357, "display_filter": "frame.number == 9357", "timestamp_epoch": "1575413262.702392000" } ], "is_private": false, "observable_id": "observable-6b09dfc3af6d4c4f950625ef", "last_seen_epoch": "1575413262.702392000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.702392000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "50.16.169.17", "evidence": [ { "udp_stream": 92, "frame_number": 9982, "display_filter": "frame.number == 9982", "timestamp_epoch": "1575413264.913423000" } ], "is_private": false, "observable_id": "observable-b041c61a5ebe3c8d9bd70c12", "last_seen_epoch": "1575413264.913423000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413264.913423000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "50.57.31.206", "evidence": [ { "udp_stream": 37, "frame_number": 3573, "display_filter": "frame.number == 3573", "timestamp_epoch": "1575413212.855201000" } ], "is_private": false, "observable_id": "observable-0af7e410a1ec1c905466b7ac", "last_seen_epoch": "1575413212.855201000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413212.855201000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "50.97.145.208", "evidence": [ { "udp_stream": 103, "frame_number": 10851, "display_filter": "frame.number == 10851", "timestamp_epoch": "1575413267.965671000" } ], "is_private": false, "observable_id": "observable-76e13ded5fc4f6cc9a79a945", "last_seen_epoch": "1575413267.965671000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413267.965671000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.0.90.21", "evidence": [ { "udp_stream": 43, "frame_number": 4892, "display_filter": "frame.number == 4892", "timestamp_epoch": "1575413246.304051000" } ], "is_private": false, "observable_id": "observable-806f22b109941f95825f8d52", "last_seen_epoch": "1575413246.304051000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413246.304051000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.2.220.123", "evidence": [ { "udp_stream": 183, "frame_number": 17364, "display_filter": "frame.number == 17364", "timestamp_epoch": "1575414489.352724000" } ], "is_private": false, "observable_id": "observable-7b316242fd42bbde5fd8c1ec", "last_seen_epoch": "1575414489.352724000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414489.352724000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.20.183.229", "evidence": [ { "udp_stream": 189, "frame_number": 18913, "display_filter": "frame.number == 18913", "timestamp_epoch": "1575414494.106735000" } ], "is_private": false, "observable_id": "observable-9502dcc94e310e0b2481ac21", "last_seen_epoch": "1575414494.106735000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414494.106735000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.20.71.5", "evidence": [ { "udp_stream": 183, "frame_number": 17364, "display_filter": "frame.number == 17364", "timestamp_epoch": "1575414489.352724000" } ], "is_private": false, "observable_id": "observable-6fc38197bac4a7ca56990701", "last_seen_epoch": "1575414489.352724000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414489.352724000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.200.145.54", "evidence": [ { "udp_stream": 183, "frame_number": 17364, "display_filter": "frame.number == 17364", "timestamp_epoch": "1575414489.352724000" } ], "is_private": false, "observable_id": "observable-e5675b59d0bb35fe58ee3e1c", "last_seen_epoch": "1575414489.352724000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414489.352724000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.201.28.115", "evidence": [ { "udp_stream": 110, "frame_number": 10993, "display_filter": "frame.number == 10993", "timestamp_epoch": "1575413268.359202000" } ], "is_private": false, "observable_id": "observable-a6420c710a2733de311273b9", "last_seen_epoch": "1575413268.359202000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413268.359202000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.202.0.127", "evidence": [ { "udp_stream": 84, "frame_number": 9864, "display_filter": "frame.number == 9864", "timestamp_epoch": "1575413264.518110000" } ], "is_private": false, "observable_id": "observable-36682e6e53f38429c914ff66", "last_seen_epoch": "1575413264.518110000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413264.518110000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.202.126.226", "evidence": [ { "udp_stream": 87, "frame_number": 9974, "display_filter": "frame.number == 9974", "timestamp_epoch": "1575413264.859950000" } ], "is_private": false, "observable_id": "observable-1a9b513f087dc7571b74a3e3", "last_seen_epoch": "1575413264.859950000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413264.859950000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.202.174.197", "evidence": [ { "udp_stream": 75, "frame_number": 9334, "display_filter": "frame.number == 9334", "timestamp_epoch": "1575413262.647446000" } ], "is_private": false, "observable_id": "observable-d926a3cb24f527f527c9cad9", "last_seen_epoch": "1575413262.647446000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.647446000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.202.55.102", "evidence": [ { "udp_stream": 182, "frame_number": 17363, "display_filter": "frame.number == 17363", "timestamp_epoch": "1575414489.352624000" } ], "is_private": false, "observable_id": "observable-92552260408c29a8b96c584a", "last_seen_epoch": "1575414489.352624000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414489.352624000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.203.83.158", "evidence": [ { "udp_stream": 92, "frame_number": 9982, "display_filter": "frame.number == 9982", "timestamp_epoch": "1575413264.913423000" } ], "is_private": false, "observable_id": "observable-c3ac2ae319d632bd7d4d25d5", "last_seen_epoch": "1575413264.913423000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413264.913423000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.204.252.186", "evidence": [ { "udp_stream": 98, "frame_number": 10815, "display_filter": "frame.number == 10815", "timestamp_epoch": "1575413267.789823000" } ], "is_private": false, "observable_id": "observable-c2d0ded54053e14b5689b206", "last_seen_epoch": "1575413267.789823000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413267.789823000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.204.50.104", "evidence": [ { "udp_stream": 92, "frame_number": 9982, "display_filter": "frame.number == 9982", "timestamp_epoch": "1575413264.913423000" } ], "is_private": false, "observable_id": "observable-3c2cf0f3061325b16c985f2f", "last_seen_epoch": "1575413264.913423000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413264.913423000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.206.226.12", "evidence": [ { "udp_stream": 52, "frame_number": 7233, "display_filter": "frame.number == 7233", "timestamp_epoch": "1575413253.235151000" }, { "udp_stream": 56, "frame_number": 7655, "display_filter": "frame.number == 7655", "timestamp_epoch": "1575413255.099136000" }, { "udp_stream": 71, "frame_number": 9152, "display_filter": "frame.number == 9152", "timestamp_epoch": "1575413262.342458000" } ], "is_private": false, "observable_id": "observable-f4c0989970215b1d2c1ab39c", "last_seen_epoch": "1575413262.342458000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413253.235151000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.21.200.160", "evidence": [ { "udp_stream": 84, "frame_number": 9864, "display_filter": "frame.number == 9864", "timestamp_epoch": "1575413264.518110000" } ], "is_private": false, "observable_id": "observable-62a0980790bbd1ec8cdfb433", "last_seen_epoch": "1575413264.518110000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413264.518110000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.21.98.231", "evidence": [ { "udp_stream": 92, "frame_number": 9982, "display_filter": "frame.number == 9982", "timestamp_epoch": "1575413264.913423000" } ], "is_private": false, "observable_id": "observable-197fbe00ff85c9b368d36083", "last_seen_epoch": "1575413264.913423000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413264.913423000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.22.131.123", "evidence": [ { "udp_stream": 92, "frame_number": 9982, "display_filter": "frame.number == 9982", "timestamp_epoch": "1575413264.913423000" } ], "is_private": false, "observable_id": "observable-73c995b781a776a095920269", "last_seen_epoch": "1575413264.913423000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413264.913423000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.22.146.21", "evidence": [ { "udp_stream": 75, "frame_number": 9334, "display_filter": "frame.number == 9334", "timestamp_epoch": "1575413262.647446000" } ], "is_private": false, "observable_id": "observable-db7ea7e6365c32306ca8fea8", "last_seen_epoch": "1575413262.647446000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.647446000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.22.184.73", "evidence": [ { "udp_stream": 73, "frame_number": 9324, "display_filter": "frame.number == 9324", "timestamp_epoch": "1575413262.643694000" } ], "is_private": false, "observable_id": "observable-64c8be63300d2af82d71fa91", "last_seen_epoch": "1575413262.643694000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.643694000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.3.11.61", "evidence": [ { "udp_stream": 60, "frame_number": 8009, "display_filter": "frame.number == 8009", "timestamp_epoch": "1575413257.314055000" } ], "is_private": false, "observable_id": "observable-33e51978c7e143a7c4601519", "last_seen_epoch": "1575413257.314055000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413257.314055000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.3.158.69", "evidence": [ { "udp_stream": 73, "frame_number": 9324, "display_filter": "frame.number == 9324", "timestamp_epoch": "1575413262.643694000" } ], "is_private": false, "observable_id": "observable-110d312d6d125b165cd3177e", "last_seen_epoch": "1575413262.643694000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.643694000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.36.218.9", "evidence": [ { "udp_stream": 33, "frame_number": 2703, "display_filter": "frame.number == 2703", "timestamp_epoch": "1575413167.311200000" } ], "is_private": false, "observable_id": "observable-2b18a92f0c602bb095368c26", "last_seen_epoch": "1575413167.311200000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413167.311200000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.38.185.101", "evidence": [ { "udp_stream": 33, "frame_number": 2703, "display_filter": "frame.number == 2703", "timestamp_epoch": "1575413167.311200000" } ], "is_private": false, "observable_id": "observable-830578ecf0f4222216a861d1", "last_seen_epoch": "1575413167.311200000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413167.311200000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.39.132.98", "evidence": [ { "udp_stream": 33, "frame_number": 2703, "display_filter": "frame.number == 2703", "timestamp_epoch": "1575413167.311200000" } ], "is_private": false, "observable_id": "observable-63d93f89ad12204d9e250933", "last_seen_epoch": "1575413167.311200000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413167.311200000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.42.99.244", "evidence": [ { "udp_stream": 33, "frame_number": 2703, "display_filter": "frame.number == 2703", "timestamp_epoch": "1575413167.311200000" } ], "is_private": false, "observable_id": "observable-6771e47b31602c59c6d24136", "last_seen_epoch": "1575413167.311200000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413167.311200000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.43.190.106", "evidence": [ { "udp_stream": 33, "frame_number": 2703, "display_filter": "frame.number == 2703", "timestamp_epoch": "1575413167.311200000" } ], "is_private": false, "observable_id": "observable-08da2d5a005b1ed529227673", "last_seen_epoch": "1575413167.311200000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413167.311200000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.44.42.164", "evidence": [ { "udp_stream": 60, "frame_number": 8009, "display_filter": "frame.number == 8009", "timestamp_epoch": "1575413257.314055000" } ], "is_private": false, "observable_id": "observable-8c12dfd7e353433ef04b56d6", "last_seen_epoch": "1575413257.314055000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413257.314055000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.45.100.81", "evidence": [ { "udp_stream": 98, "frame_number": 10815, "display_filter": "frame.number == 10815", "timestamp_epoch": "1575413267.789823000" } ], "is_private": false, "observable_id": "observable-c268ed23d0b0fc7a446bd63a", "last_seen_epoch": "1575413267.789823000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413267.789823000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.45.29.95", "evidence": [ { "udp_stream": 61, "frame_number": 8080, "display_filter": "frame.number == 8080", "timestamp_epoch": "1575413257.956936000" } ], "is_private": false, "observable_id": "observable-62bdc6bd90a5d69b513fbfa8", "last_seen_epoch": "1575413257.956936000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413257.956936000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.45.82.224", "evidence": [ { "udp_stream": 119, "frame_number": 13113, "display_filter": "frame.number == 13113", "timestamp_epoch": "1575413306.103126000" } ], "is_private": false, "observable_id": "observable-365c91bf7ea9f2fdc0ed28f6", "last_seen_epoch": "1575413306.103126000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413306.103126000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.5.227.122", "evidence": [ { "udp_stream": 87, "frame_number": 9974, "display_filter": "frame.number == 9974", "timestamp_epoch": "1575413264.859950000" } ], "is_private": false, "observable_id": "observable-14e3680253a802ab470510ac", "last_seen_epoch": "1575413264.859950000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413264.859950000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.54.122.125", "evidence": [ { "udp_stream": 61, "frame_number": 8080, "display_filter": "frame.number == 8080", "timestamp_epoch": "1575413257.956936000" } ], "is_private": false, "observable_id": "observable-3fe59f137eb29797c231fd27", "last_seen_epoch": "1575413257.956936000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413257.956936000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.55.150.239", "evidence": [ { "udp_stream": 110, "frame_number": 10993, "display_filter": "frame.number == 10993", "timestamp_epoch": "1575413268.359202000" } ], "is_private": false, "observable_id": "observable-35579aa27eb812a31bec6163", "last_seen_epoch": "1575413268.359202000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413268.359202000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.6.242.143", "evidence": [ { "udp_stream": 61, "frame_number": 8080, "display_filter": "frame.number == 8080", "timestamp_epoch": "1575413257.956936000" } ], "is_private": false, "observable_id": "observable-dbef03c98bbef299d39d376e", "last_seen_epoch": "1575413257.956936000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413257.956936000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.6.39.34", "evidence": [ { "udp_stream": 73, "frame_number": 9324, "display_filter": "frame.number == 9324", "timestamp_epoch": "1575413262.643694000" } ], "is_private": false, "observable_id": "observable-b5c70369668dcae048453fd4", "last_seen_epoch": "1575413262.643694000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.643694000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.7.147.140", "evidence": [ { "udp_stream": 87, "frame_number": 9974, "display_filter": "frame.number == 9974", "timestamp_epoch": "1575413264.859950000" } ], "is_private": false, "observable_id": "observable-cfae031c2a937a636534e1ac", "last_seen_epoch": "1575413264.859950000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413264.859950000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.70.198.170", "evidence": [ { "udp_stream": 61, "frame_number": 8080, "display_filter": "frame.number == 8080", "timestamp_epoch": "1575413257.956936000" } ], "is_private": false, "observable_id": "observable-34e4f3332dea8a6a7fc09d23", "last_seen_epoch": "1575413257.956936000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413257.956936000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.70.56.26", "evidence": [ { "udp_stream": 184, "frame_number": 17359, "display_filter": "frame.number == 17359", "timestamp_epoch": "1575414489.334625000" }, { "udp_stream": 185, "frame_number": 17386, "display_filter": "frame.number == 17386", "timestamp_epoch": "1575414489.544905000" } ], "is_private": false, "observable_id": "observable-27d065fcc85a5d5a22538d16", "last_seen_epoch": "1575414489.544905000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414489.334625000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.71.118.158", "evidence": [ { "udp_stream": 43, "frame_number": 4892, "display_filter": "frame.number == 4892", "timestamp_epoch": "1575413246.304051000" } ], "is_private": false, "observable_id": "observable-d8217fe7424fec51bfd067d0", "last_seen_epoch": "1575413246.304051000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413246.304051000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.71.154.85", "evidence": [ { "udp_stream": 189, "frame_number": 18913, "display_filter": "frame.number == 18913", "timestamp_epoch": "1575414494.106735000" } ], "is_private": false, "observable_id": "observable-9271a1b92de8c4e4f38c9e04", "last_seen_epoch": "1575414494.106735000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414494.106735000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.71.168.120", "evidence": [ { "udp_stream": 110, "frame_number": 10993, "display_filter": "frame.number == 10993", "timestamp_epoch": "1575413268.359202000" } ], "is_private": false, "observable_id": "observable-d0b09d8697e2c3c053b33d2c", "last_seen_epoch": "1575413268.359202000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413268.359202000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.72.249.172", "evidence": [ { "udp_stream": 98, "frame_number": 10815, "display_filter": "frame.number == 10815", "timestamp_epoch": "1575413267.789823000" } ], "is_private": false, "observable_id": "observable-fcbed6d57bc9e4a77324e3fe", "last_seen_epoch": "1575413267.789823000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413267.789823000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.73.155.113", "evidence": [ { "udp_stream": 60, "frame_number": 8009, "display_filter": "frame.number == 8009", "timestamp_epoch": "1575413257.314055000" } ], "is_private": false, "observable_id": "observable-077e247b22616982724ba6d8", "last_seen_epoch": "1575413257.314055000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413257.314055000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.73.52.157", "evidence": [ { "udp_stream": 182, "frame_number": 17363, "display_filter": "frame.number == 17363", "timestamp_epoch": "1575414489.352624000" } ], "is_private": false, "observable_id": "observable-939fe9c2aa3702c3a44b56c7", "last_seen_epoch": "1575414489.352624000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414489.352624000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.73.69.206", "evidence": [ { "udp_stream": 60, "frame_number": 8009, "display_filter": "frame.number == 8009", "timestamp_epoch": "1575413257.314055000" } ], "is_private": false, "observable_id": "observable-0019f4273661de717d4b8ba7", "last_seen_epoch": "1575413257.314055000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413257.314055000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.73.9.0", "evidence": [ { "udp_stream": 61, "frame_number": 8080, "display_filter": "frame.number == 8080", "timestamp_epoch": "1575413257.956936000" } ], "is_private": false, "observable_id": "observable-1b03595d45972a94ccecea02", "last_seen_epoch": "1575413257.956936000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413257.956936000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.86.28.222", "evidence": [ { "udp_stream": 110, "frame_number": 10993, "display_filter": "frame.number == 10993", "timestamp_epoch": "1575413268.359202000" } ], "is_private": false, "observable_id": "observable-08ffc226e23aba55a051132c", "last_seen_epoch": "1575413268.359202000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413268.359202000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.86.75.171", "evidence": [ { "udp_stream": 60, "frame_number": 8009, "display_filter": "frame.number == 8009", "timestamp_epoch": "1575413257.314055000" } ], "is_private": false, "observable_id": "observable-c8a18c604cdcba44f410f901", "last_seen_epoch": "1575413257.314055000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413257.314055000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.87.22.170", "evidence": [ { "udp_stream": 61, "frame_number": 8080, "display_filter": "frame.number == 8080", "timestamp_epoch": "1575413257.956936000" } ], "is_private": false, "observable_id": "observable-05a7229153c0974cb0e07a2b", "last_seen_epoch": "1575413257.956936000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413257.956936000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "52.87.90.62", "evidence": [ { "udp_stream": 98, "frame_number": 10815, "display_filter": "frame.number == 10815", "timestamp_epoch": "1575413267.789823000" } ], "is_private": false, "observable_id": "observable-576badc482c95005c7f02ea6", "last_seen_epoch": "1575413267.789823000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413267.789823000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.145.171.0", "evidence": [ { "udp_stream": 39, "frame_number": 3795, "display_filter": "frame.number == 3795", "timestamp_epoch": "1575413237.897960000" }, { "udp_stream": 40, "frame_number": 3837, "display_filter": "frame.number == 3837", "timestamp_epoch": "1575413238.558263000" } ], "is_private": false, "observable_id": "observable-a983d6441ddc1c7c18b9cec5", "last_seen_epoch": "1575413238.558263000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413237.897960000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.152.229.194", "evidence": [ { "udp_stream": 61, "frame_number": 8080, "display_filter": "frame.number == 8080", "timestamp_epoch": "1575413257.956936000" } ], "is_private": false, "observable_id": "observable-5818a970463bc714a55a51b0", "last_seen_epoch": "1575413257.956936000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413257.956936000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.152.30.174", "evidence": [ { "udp_stream": 73, "frame_number": 9324, "display_filter": "frame.number == 9324", "timestamp_epoch": "1575413262.643694000" } ], "is_private": false, "observable_id": "observable-9404daf673e6454fd214d1d1", "last_seen_epoch": "1575413262.643694000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.643694000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.156.168.222", "evidence": [ { "udp_stream": 61, "frame_number": 8080, "display_filter": "frame.number == 8080", "timestamp_epoch": "1575413257.956936000" } ], "is_private": false, "observable_id": "observable-1921371a35d995affe330354", "last_seen_epoch": "1575413257.956936000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413257.956936000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "54.158.57.141", "evidence": [ { "udp_stream": 73, "frame_number": 9324, "display_filter": "frame.number == 9324", "timestamp_epoch": "1575413262.643694000" } ], "is_private": false, "observable_id": "observable-e11c22f4dc51d9520f82efc0", "last_seen_epoch": "1575413262.643694000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.643694000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.164.248.61", "evidence": [ { "udp_stream": 87, "frame_number": 9974, "display_filter": "frame.number == 9974", "timestamp_epoch": "1575413264.859950000" } ], "is_private": false, "observable_id": "observable-262a2a8fcf3d0929f63110d1", "last_seen_epoch": "1575413264.859950000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413264.859950000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.165.26.158", "evidence": [ { "udp_stream": 98, "frame_number": 10815, "display_filter": "frame.number == 10815", "timestamp_epoch": "1575413267.789823000" } ], "is_private": false, "observable_id": "observable-7949cbb80a1756c674323b8b", "last_seen_epoch": "1575413267.789823000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413267.789823000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "54.175.7.235", "evidence": [ { "udp_stream": 183, "frame_number": 17364, "display_filter": "frame.number == 17364", "timestamp_epoch": "1575414489.352724000" } ], "is_private": false, "observable_id": "observable-193165302e963e19625fc9f4", "last_seen_epoch": "1575414489.352724000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414489.352724000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "54.175.88.188", "evidence": [ { "udp_stream": 110, "frame_number": 10993, "display_filter": "frame.number == 10993", "timestamp_epoch": "1575413268.359202000" } ], "is_private": false, "observable_id": "observable-d4813034575ffa8ffd6a0041", "last_seen_epoch": "1575413268.359202000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413268.359202000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "54.186.165.46", "evidence": [ { "udp_stream": 33, "frame_number": 2703, "display_filter": "frame.number == 2703", "timestamp_epoch": "1575413167.311200000" } ], "is_private": false, "observable_id": "observable-c7890c1a63b6e098de1387e4", "last_seen_epoch": "1575413167.311200000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413167.311200000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.208.163.85", "evidence": [ { "udp_stream": 98, "frame_number": 10815, "display_filter": "frame.number == 10815", "timestamp_epoch": "1575413267.789823000" } ], "is_private": false, "observable_id": "observable-a7173b7f45ce592c4eab36ac", "last_seen_epoch": "1575413267.789823000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413267.789823000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.209.191.239", "evidence": [ { "udp_stream": 189, "frame_number": 18913, "display_filter": "frame.number == 18913", "timestamp_epoch": "1575414494.106735000" } ], "is_private": false, "observable_id": "observable-469792b65c3b9c1706950d06", "last_seen_epoch": "1575414494.106735000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414494.106735000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.209.242.98", "evidence": [ { "udp_stream": 106, "frame_number": 10888, "display_filter": "frame.number == 10888", "timestamp_epoch": "1575413268.087189000" } ], "is_private": false, "observable_id": "observable-97e6a694369dc4997fb15797", "last_seen_epoch": "1575413268.087189000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413268.087189000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.209.58.223", "evidence": [ { "udp_stream": 29, "frame_number": 2546, "display_filter": "frame.number == 2546", "timestamp_epoch": "1575413166.668934000" } ], "is_private": false, "observable_id": "observable-222137882f5c5ca3c4b700ee", "last_seen_epoch": "1575413166.668934000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413166.668934000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.209.91.178", "evidence": [ { "udp_stream": 182, "frame_number": 17363, "display_filter": "frame.number == 17363", "timestamp_epoch": "1575414489.352624000" } ], "is_private": false, "observable_id": "observable-adcf1cee3efd84665fd95059", "last_seen_epoch": "1575414489.352624000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414489.352624000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.209.98.151", "evidence": [ { "udp_stream": 60, "frame_number": 8009, "display_filter": "frame.number == 8009", "timestamp_epoch": "1575413257.314055000" } ], "is_private": false, "observable_id": "observable-647670111627ef36fd4ab2cb", "last_seen_epoch": "1575413257.314055000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413257.314055000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.226.243.22", "evidence": [ { "udp_stream": 73, "frame_number": 9324, "display_filter": "frame.number == 9324", "timestamp_epoch": "1575413262.643694000" } ], "is_private": false, "observable_id": "observable-d31ea48d9b8d342056fd1a16", "last_seen_epoch": "1575413262.643694000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.643694000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "54.236.178.170", "evidence": [ { "udp_stream": 39, "frame_number": 3795, "display_filter": "frame.number == 3795", "timestamp_epoch": "1575413237.897960000" }, { "udp_stream": 40, "frame_number": 3837, "display_filter": "frame.number == 3837", "timestamp_epoch": "1575413238.558263000" } ], "is_private": false, "observable_id": "observable-a3c6be663c6a01d973e6ce16", "last_seen_epoch": "1575413238.558263000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413237.897960000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.236.214.197", "evidence": [ { "udp_stream": 184, "frame_number": 17359, "display_filter": "frame.number == 17359", "timestamp_epoch": "1575414489.334625000" }, { "udp_stream": 185, "frame_number": 17386, "display_filter": "frame.number == 17386", "timestamp_epoch": "1575414489.544905000" } ], "is_private": false, "observable_id": "observable-0d773138152baf4f3fa669e9", "last_seen_epoch": "1575414489.544905000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414489.334625000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "54.82.194.252", "evidence": [ { "udp_stream": 119, "frame_number": 13113, "display_filter": "frame.number == 13113", "timestamp_epoch": "1575413306.103126000" } ], "is_private": false, "observable_id": "observable-03adb873196351ec145021d5", "last_seen_epoch": "1575413306.103126000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413306.103126000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "54.84.47.220", "evidence": [ { "udp_stream": 75, "frame_number": 9334, "display_filter": "frame.number == 9334", "timestamp_epoch": "1575413262.647446000" } ], "is_private": false, "observable_id": "observable-3b7bf8396306dac6f3a6db16", "last_seen_epoch": "1575413262.647446000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.647446000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "54.85.102.186", "evidence": [ { "udp_stream": 106, "frame_number": 10888, "display_filter": "frame.number == 10888", "timestamp_epoch": "1575413268.087189000" } ], "is_private": false, "observable_id": "observable-030d0ddc3a76821c297b8a1c", "last_seen_epoch": "1575413268.087189000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413268.087189000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.88.83.158", "evidence": [ { "udp_stream": 84, "frame_number": 9864, "display_filter": "frame.number == 9864", "timestamp_epoch": "1575413264.518110000" } ], "is_private": false, "observable_id": "observable-5a2d9223add3879847ccd18f", "last_seen_epoch": "1575413264.518110000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413264.518110000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.88.96.255", "evidence": [ { "udp_stream": 29, "frame_number": 2546, "display_filter": "frame.number == 2546", "timestamp_epoch": "1575413166.668934000" } ], "is_private": false, "observable_id": "observable-d4bf676f3e996f4b005521ff", "last_seen_epoch": "1575413166.668934000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413166.668934000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.89.56.97", "evidence": [ { "udp_stream": 87, "frame_number": 9974, "display_filter": "frame.number == 9974", "timestamp_epoch": "1575413264.859950000" } ], "is_private": false, "observable_id": "observable-e460ffa09217c7a9f7ecd346", "last_seen_epoch": "1575413264.859950000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413264.859950000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "58.251.121.110", "evidence": [ { "udp_stream": 137, "frame_number": 15281, "display_filter": "frame.number == 15281", "timestamp_epoch": "1575413425.403718000" }, { "udp_stream": 138, "frame_number": 15576, "display_filter": "frame.number == 15576", "timestamp_epoch": "1575413428.584602000" }, { "udp_stream": 145, "frame_number": 15951, "display_filter": "frame.number == 15951", "timestamp_epoch": "1575413434.109141000" }, { "udp_stream": 146, "frame_number": 15967, "display_filter": "frame.number == 15967", "timestamp_epoch": "1575413440.498835000" }, { "udp_stream": 159, "frame_number": 16149, "display_filter": "frame.number == 16149", "timestamp_epoch": "1575413455.357740000" }, { "udp_stream": 160, "frame_number": 16160, "display_filter": "frame.number == 16160", "timestamp_epoch": "1575413456.425216000" }, { "udp_stream": 161, "frame_number": 16179, "display_filter": "frame.number == 16179", "timestamp_epoch": "1575413457.526856000" }, { "udp_stream": 162, "frame_number": 16196, "display_filter": "frame.number == 16196", "timestamp_epoch": "1575413468.760703000" }, { "udp_stream": 163, "frame_number": 16209, "display_filter": "frame.number == 16209", "timestamp_epoch": "1575413469.819055000" }, { "udp_stream": 164, "frame_number": 16309, "display_filter": "frame.number == 16309", "timestamp_epoch": "1575413756.347599000" }, { "udp_stream": 165, "frame_number": 16432, "display_filter": "frame.number == 16432", "timestamp_epoch": "1575414056.349092000" }, { "udp_stream": 166, "frame_number": 16443, "display_filter": "frame.number == 16443", "timestamp_epoch": "1575414057.413839000" }, { "udp_stream": 168, "frame_number": 16487, "display_filter": "frame.number == 16487", "timestamp_epoch": "1575414357.417756000" }, { "udp_stream": 190, "frame_number": 21099, "display_filter": "frame.number == 21099", "timestamp_epoch": "1575414657.443819000" }, { "udp_stream": 191, "frame_number": 21110, "display_filter": "frame.number == 21110", "timestamp_epoch": "1575414658.500356000" }, { "udp_stream": 192, "frame_number": 21123, "display_filter": "frame.number == 21123", "timestamp_epoch": "1575414669.784425000" } ], "is_private": false, "observable_id": "observable-950a640a3dc0ee10275e8a3d", "last_seen_epoch": "1575414669.784425000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413425.403718000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "64.58.116.196", "evidence": [ { "udp_stream": 126, "frame_number": 13408, "display_filter": "frame.number == 13408", "timestamp_epoch": "1575413306.386965000" } ], "is_private": false, "observable_id": "observable-71aa80c53555f571891b3a0b", "last_seen_epoch": "1575413306.386965000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413306.386965000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "64.58.116.236", "evidence": [ { "udp_stream": 126, "frame_number": 13408, "display_filter": "frame.number == 13408", "timestamp_epoch": "1575413306.386965000" } ], "is_private": false, "observable_id": "observable-3c09ec8a15d2190c19ab13ec", "last_seen_epoch": "1575413306.386965000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413306.386965000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "64.58.119.36", "evidence": [ { "udp_stream": 126, "frame_number": 13408, "display_filter": "frame.number == 13408", "timestamp_epoch": "1575413306.386965000" } ], "is_private": false, "observable_id": "observable-3fbb69d56f81029991a93f1d", "last_seen_epoch": "1575413306.386965000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413306.386965000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "66.218.84.42", "evidence": [ { "udp_stream": 16, "frame_number": 644, "display_filter": "frame.number == 644", "timestamp_epoch": "1575413160.441484000" } ], "is_private": false, "observable_id": "observable-21ac632502395d7df3a57b3b", "last_seen_epoch": "1575413160.441484000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413160.441484000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "66.218.84.43", "evidence": [ { "udp_stream": 16, "frame_number": 644, "display_filter": "frame.number == 644", "timestamp_epoch": "1575413160.441484000" } ], "is_private": false, "observable_id": "observable-20b9386a80dce79e5194ef15", "last_seen_epoch": "1575413160.441484000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413160.441484000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "66.218.87.13", "evidence": [ { "udp_stream": 44, "frame_number": 4922, "display_filter": "frame.number == 4922", "timestamp_epoch": "1575413246.488601000" } ], "is_private": false, "observable_id": "observable-b1d57a74c4cec4677f233738", "last_seen_epoch": "1575413246.488601000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413246.488601000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "66.218.87.15", "evidence": [ { "udp_stream": 17, "frame_number": 647, "display_filter": "frame.number == 647", "timestamp_epoch": "1575413160.623478000" } ], "is_private": false, "observable_id": "observable-a9880152b69cba0953a442c8", "last_seen_epoch": "1575413160.623478000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413160.623478000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "66.235.147.232", "evidence": [ { "udp_stream": 181, "frame_number": 17335, "display_filter": "frame.number == 17335", "timestamp_epoch": "1575414489.184029000" } ], "is_private": false, "observable_id": "observable-44bbe19a6301086368948297", "last_seen_epoch": "1575414489.184029000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414489.184029000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "66.235.147.233", "evidence": [ { "udp_stream": 181, "frame_number": 17335, "display_filter": "frame.number == 17335", "timestamp_epoch": "1575414489.184029000" } ], "is_private": false, "observable_id": "observable-905b1736023538321501e5d4", "last_seen_epoch": "1575414489.184029000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414489.184029000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "66.235.147.234", "evidence": [ { "udp_stream": 181, "frame_number": 17335, "display_filter": "frame.number == 17335", "timestamp_epoch": "1575414489.184029000" } ], "is_private": false, "observable_id": "observable-41145260387bd79d756d84d5", "last_seen_epoch": "1575414489.184029000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414489.184029000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "66.235.147.235", "evidence": [ { "udp_stream": 181, "frame_number": 17335, "display_filter": "frame.number == 17335", "timestamp_epoch": "1575414489.184029000" } ], "is_private": false, "observable_id": "observable-53f68e869e22eea3b384710a", "last_seen_epoch": "1575414489.184029000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414489.184029000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "66.235.147.236", "evidence": [ { "udp_stream": 181, "frame_number": 17335, "display_filter": "frame.number == 17335", "timestamp_epoch": "1575414489.184029000" } ], "is_private": false, "observable_id": "observable-65e7710e0aaae1409d18e694", "last_seen_epoch": "1575414489.184029000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414489.184029000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "66.235.147.237", "evidence": [ { "udp_stream": 181, "frame_number": 17335, "display_filter": "frame.number == 17335", "timestamp_epoch": "1575414489.184029000" } ], "is_private": false, "observable_id": "observable-83cfa1ffc9204eac8e6f83f9", "last_seen_epoch": "1575414489.184029000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414489.184029000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "66.235.147.238", "evidence": [ { "udp_stream": 181, "frame_number": 17335, "display_filter": "frame.number == 17335", "timestamp_epoch": "1575414489.184029000" } ], "is_private": false, "observable_id": "observable-e4d688045a38af5ea8346e8a", "last_seen_epoch": "1575414489.184029000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414489.184029000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "66.235.147.239", "evidence": [ { "udp_stream": 181, "frame_number": 17335, "display_filter": "frame.number == 17335", "timestamp_epoch": "1575414489.184029000" } ], "is_private": false, "observable_id": "observable-33d662dfaec9bff26b81f9f1", "last_seen_epoch": "1575414489.184029000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414489.184029000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "66.235.147.240", "evidence": [ { "udp_stream": 181, "frame_number": 17335, "display_filter": "frame.number == 17335", "timestamp_epoch": "1575414489.184029000" } ], "is_private": false, "observable_id": "observable-36a8409e278a5e9e557d483a", "last_seen_epoch": "1575414489.184029000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414489.184029000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "66.235.147.244", "evidence": [ { "udp_stream": 181, "frame_number": 17335, "display_filter": "frame.number == 17335", "timestamp_epoch": "1575414489.184029000" } ], "is_private": false, "observable_id": "observable-47f5b4fd5f492ef23ea729f2", "last_seen_epoch": "1575414489.184029000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414489.184029000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "66.235.147.246", "evidence": [ { "udp_stream": 181, "frame_number": 17335, "display_filter": "frame.number == 17335", "timestamp_epoch": "1575414489.184029000" } ], "is_private": false, "observable_id": "observable-1394e46215b0972ccc8709ae", "last_seen_epoch": "1575414489.184029000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414489.184029000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "67.195.204.151", "evidence": [ { "udp_stream": 6, "frame_number": 308, "display_filter": "frame.number == 308", "timestamp_epoch": "1575413156.734046000" }, { "udp_stream": 7, "frame_number": 352, "display_filter": "frame.number == 352", "timestamp_epoch": "1575413157.278971000" }, { "udp_stream": 8, "frame_number": 399, "display_filter": "frame.number == 399", "timestamp_epoch": "1575413157.843186000" } ], "is_private": false, "observable_id": "observable-64a0cd61dbc091a34bb113e0", "last_seen_epoch": "1575413157.843186000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413156.734046000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "69.147.64.33", "evidence": [ { "udp_stream": 4, "frame_number": 276, "display_filter": "frame.number == 276", "timestamp_epoch": "1575413155.227694000" }, { "udp_stream": 9, "frame_number": 504, "display_filter": "frame.number == 504", "timestamp_epoch": "1575413158.967341000" }, { "udp_stream": 18, "frame_number": 648, "display_filter": "frame.number == 648", "timestamp_epoch": "1575413160.623583000" } ], "is_private": false, "observable_id": "observable-7a61a58a9a2c0af8550ab7e6", "last_seen_epoch": "1575413160.623583000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413155.227694000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "69.147.64.34", "evidence": [ { "udp_stream": 4, "frame_number": 276, "display_filter": "frame.number == 276", "timestamp_epoch": "1575413155.227694000" }, { "udp_stream": 9, "frame_number": 504, "display_filter": "frame.number == 504", "timestamp_epoch": "1575413158.967341000" }, { "udp_stream": 18, "frame_number": 648, "display_filter": "frame.number == 648", "timestamp_epoch": "1575413160.623583000" } ], "is_private": false, "observable_id": "observable-b3169ba94cd2601fd69e02e5", "last_seen_epoch": "1575413160.623583000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413155.227694000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "70.42.32.63", "evidence": [ { "udp_stream": 127, "frame_number": 13285, "display_filter": "frame.number == 13285", "timestamp_epoch": "1575413306.270237000" } ], "is_private": false, "observable_id": "observable-f19eab796c60a950a6883b1b", "last_seen_epoch": "1575413306.270237000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413306.270237000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "72.21.81.200", "evidence": [ { "udp_stream": 34, "frame_number": 2902, "display_filter": "frame.number == 2902", "timestamp_epoch": "1575413185.249277000" }, { "udp_stream": 35, "frame_number": 2904, "display_filter": "frame.number == 2904", "timestamp_epoch": "1575413185.267497000" } ], "is_private": false, "observable_id": "observable-31028ffaaf8d3e7fc2a3cdd5", "last_seen_epoch": "1575413185.267497000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413185.249277000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "72.5.64.63", "evidence": [ { "udp_stream": 130, "frame_number": 13311, "display_filter": "frame.number == 13311", "timestamp_epoch": "1575413306.289844000" } ], "is_private": false, "observable_id": "observable-30373f8458d92ffb739136b2", "last_seen_epoch": "1575413306.289844000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413306.289844000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "74.119.118.138", "evidence": [ { "udp_stream": 100, "frame_number": 10847, "display_filter": "frame.number == 10847", "timestamp_epoch": "1575413267.948443000" } ], "is_private": false, "observable_id": "observable-e64b93d6e7b7effd94ae24c6", "last_seen_epoch": "1575413267.948443000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413267.948443000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "74.121.138.36", "evidence": [ { "udp_stream": 77, "frame_number": 9305, "display_filter": "frame.number == 9305", "timestamp_epoch": "1575413262.640867000" } ], "is_private": false, "observable_id": "observable-033c632538dfc86eba6a21d9", "last_seen_epoch": "1575413262.640867000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.640867000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "74.121.138.90", "evidence": [ { "udp_stream": 77, "frame_number": 9305, "display_filter": "frame.number == 9305", "timestamp_epoch": "1575413262.640867000" } ], "is_private": false, "observable_id": "observable-02558c400da39ed25650183f", "last_seen_epoch": "1575413262.640867000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413262.640867000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "74.6.138.64", "evidence": [ { "udp_stream": 49, "frame_number": 6460, "display_filter": "frame.number == 6460", "timestamp_epoch": "1575413250.068987000" } ], "is_private": false, "observable_id": "observable-9dc01ef46aa3efb7c24b949d", "last_seen_epoch": "1575413250.068987000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413250.068987000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "74.6.138.72", "evidence": [ { "udp_stream": 51, "frame_number": 7139, "display_filter": "frame.number == 7139", "timestamp_epoch": "1575413252.926670000" } ], "is_private": false, "observable_id": "observable-afe7fe4558316a8b1f183cb5", "last_seen_epoch": "1575413252.926670000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413252.926670000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "74.6.138.75", "evidence": [ { "udp_stream": 83, "frame_number": 9810, "display_filter": "frame.number == 9810", "timestamp_epoch": "1575413264.126151000" } ], "is_private": false, "observable_id": "observable-8f8c519f97fbc2509f57ec48", "last_seen_epoch": "1575413264.126151000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413264.126151000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "74.6.143.14", "evidence": [ { "udp_stream": 69, "frame_number": 8646, "display_filter": "frame.number == 8646", "timestamp_epoch": "1575413260.432992000" } ], "is_private": false, "observable_id": "observable-205e824adb5f7118fb361a4c", "last_seen_epoch": "1575413260.432992000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413260.432992000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "74.6.228.136", "evidence": [ { "udp_stream": 16, "frame_number": 644, "display_filter": "frame.number == 644", "timestamp_epoch": "1575413160.441484000" } ], "is_private": false, "observable_id": "observable-30eb8700f26d07ed050d1edc", "last_seen_epoch": "1575413160.441484000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413160.441484000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "74.6.228.137", "evidence": [ { "udp_stream": 16, "frame_number": 644, "display_filter": "frame.number == 644", "timestamp_epoch": "1575413160.441484000" } ], "is_private": false, "observable_id": "observable-201365a25ed86d190a811b84", "last_seen_epoch": "1575413160.441484000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413160.441484000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "74.6.231.10", "evidence": [ { "udp_stream": 69, "frame_number": 8646, "display_filter": "frame.number == 8646", "timestamp_epoch": "1575413260.432992000" } ], "is_private": false, "observable_id": "observable-6c0b824554011425125b7986", "last_seen_epoch": "1575413260.432992000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413260.432992000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "76.13.32.137", "evidence": [ { "udp_stream": 69, "frame_number": 8646, "display_filter": "frame.number == 8646", "timestamp_epoch": "1575413260.432992000" } ], "is_private": false, "observable_id": "observable-f94d3aa9e3221707e70204a7", "last_seen_epoch": "1575413260.432992000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413260.432992000" }, { "type": "ipv4", "roles": [ "dns-answer", "http-host", "network-endpoint" ], "value": "8.208.24.139", "evidence": [ { "udp_stream": 137, "frame_number": 15281, "display_filter": "frame.number == 15281", "timestamp_epoch": "1575413425.403718000" }, { "udp_stream": 138, "frame_number": 15576, "display_filter": "frame.number == 15576", "timestamp_epoch": "1575413428.584602000" }, { "udp_stream": 145, "frame_number": 15951, "display_filter": "frame.number == 15951", "timestamp_epoch": "1575413434.109141000" }, { "udp_stream": 146, "frame_number": 15967, "display_filter": "frame.number == 15967", "timestamp_epoch": "1575413440.498835000" }, { "udp_stream": 159, "frame_number": 16149, "display_filter": "frame.number == 16149", "timestamp_epoch": "1575413455.357740000" }, { "udp_stream": 160, "frame_number": 16160, "display_filter": "frame.number == 16160", "timestamp_epoch": "1575413456.425216000" }, { "udp_stream": 161, "frame_number": 16179, "display_filter": "frame.number == 16179", "timestamp_epoch": "1575413457.526856000" }, { "udp_stream": 162, "frame_number": 16196, "display_filter": "frame.number == 16196", "timestamp_epoch": "1575413468.760703000" }, { "udp_stream": 163, "frame_number": 16209, "display_filter": "frame.number == 16209", "timestamp_epoch": "1575413469.819055000" }, { "udp_stream": 164, "frame_number": 16309, "display_filter": "frame.number == 16309", "timestamp_epoch": "1575413756.347599000" }, { "udp_stream": 165, "frame_number": 16432, "display_filter": "frame.number == 16432", "timestamp_epoch": "1575414056.349092000" }, { "udp_stream": 166, "frame_number": 16443, "display_filter": "frame.number == 16443", "timestamp_epoch": "1575414057.413839000" }, { "udp_stream": 168, "frame_number": 16487, "display_filter": "frame.number == 16487", "timestamp_epoch": "1575414357.417756000" }, { "udp_stream": 190, "frame_number": 21099, "display_filter": "frame.number == 21099", "timestamp_epoch": "1575414657.443819000" }, { "udp_stream": 191, "frame_number": 21110, "display_filter": "frame.number == 21110", "timestamp_epoch": "1575414658.500356000" }, { "udp_stream": 192, "frame_number": 21123, "display_filter": "frame.number == 21123", "timestamp_epoch": "1575414669.784425000" }, { "tcp_stream": 421, "frame_number": 15569, "display_filter": "frame.number == 15569", "timestamp_epoch": "1575413427.772846000" }, { "tcp_stream": 423, "frame_number": 15944, "display_filter": "frame.number == 15944", "timestamp_epoch": "1575413432.842336000" } ], "is_private": false, "observable_id": "observable-17d14a27c223b2f53d17b43a", "last_seen_epoch": "1575414669.784425000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413425.403718000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "8.41.222.150", "evidence": [ { "udp_stream": 122, "frame_number": 13288, "display_filter": "frame.number == 13288", "timestamp_epoch": "1575413306.271668000" } ], "is_private": false, "observable_id": "observable-d4fab433c0d07dc62447758e", "last_seen_epoch": "1575413306.271668000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413306.271668000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "91.199.212.52", "evidence": [ { "udp_stream": 95, "frame_number": 10536, "display_filter": "frame.number == 10536", "timestamp_epoch": "1575413266.379001000" }, { "udp_stream": 94, "frame_number": 10537, "display_filter": "frame.number == 10537", "timestamp_epoch": "1575413266.379122000" } ], "is_private": false, "observable_id": "observable-d3e99ed55e4db86c249e448a", "last_seen_epoch": "1575413266.379122000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413266.379001000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "96.6.83.178", "evidence": [ { "udp_stream": 30, "frame_number": 2668, "display_filter": "frame.number == 2668", "timestamp_epoch": "1575413167.222296000" } ], "is_private": false, "observable_id": "observable-5d5be013f088d3596c344284", "last_seen_epoch": "1575413167.222296000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413167.222296000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "98.136.96.149", "evidence": [ { "udp_stream": 49, "frame_number": 6460, "display_filter": "frame.number == 6460", "timestamp_epoch": "1575413250.068987000" } ], "is_private": false, "observable_id": "observable-9ffe4088db736fbafc8d9dc6", "last_seen_epoch": "1575413250.068987000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413250.068987000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "98.137.155.9", "evidence": [ { "udp_stream": 28, "frame_number": 2224, "display_filter": "frame.number == 2224", "timestamp_epoch": "1575413165.993066000" } ], "is_private": false, "observable_id": "observable-0e20feb79454b70c5514fa7c", "last_seen_epoch": "1575413165.993066000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413165.993066000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "98.137.156.136", "evidence": [ { "udp_stream": 6, "frame_number": 308, "display_filter": "frame.number == 308", "timestamp_epoch": "1575413156.734046000" }, { "udp_stream": 7, "frame_number": 352, "display_filter": "frame.number == 352", "timestamp_epoch": "1575413157.278971000" }, { "udp_stream": 8, "frame_number": 399, "display_filter": "frame.number == 399", "timestamp_epoch": "1575413157.843186000" } ], "is_private": false, "observable_id": "observable-61f87aba05dc914eddffdf1b", "last_seen_epoch": "1575413157.843186000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413156.734046000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "98.137.156.137", "evidence": [ { "udp_stream": 17, "frame_number": 647, "display_filter": "frame.number == 647", "timestamp_epoch": "1575413160.623478000" } ], "is_private": false, "observable_id": "observable-e2ef891c0828192beb5346cc", "last_seen_epoch": "1575413160.623478000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413160.623478000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "98.138.71.148", "evidence": [ { "udp_stream": 51, "frame_number": 7139, "display_filter": "frame.number == 7139", "timestamp_epoch": "1575413252.926670000" } ], "is_private": false, "observable_id": "observable-f46f09251e7d7e078dc975d5", "last_seen_epoch": "1575413252.926670000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413252.926670000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "98.138.71.149", "evidence": [ { "udp_stream": 69, "frame_number": 8646, "display_filter": "frame.number == 8646", "timestamp_epoch": "1575413260.432992000" } ], "is_private": false, "observable_id": "observable-0bf5b98d6c5d64d0dd9d4da1", "last_seen_epoch": "1575413260.432992000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413260.432992000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "99.86.77.108", "evidence": [ { "udp_stream": 32, "frame_number": 2663, "display_filter": "frame.number == 2663", "timestamp_epoch": "1575413167.216789000" } ], "is_private": false, "observable_id": "observable-74dc1ee542b4613c2c7b6f39", "last_seen_epoch": "1575413167.216789000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413167.216789000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "99.86.77.3", "evidence": [ { "udp_stream": 32, "frame_number": 2663, "display_filter": "frame.number == 2663", "timestamp_epoch": "1575413167.216789000" } ], "is_private": false, "observable_id": "observable-1d114d99b74a135daee72bce", "last_seen_epoch": "1575413167.216789000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413167.216789000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "99.86.77.5", "evidence": [ { "udp_stream": 32, "frame_number": 2663, "display_filter": "frame.number == 2663", "timestamp_epoch": "1575413167.216789000" } ], "is_private": false, "observable_id": "observable-9aa081356111d70b5853d808", "last_seen_epoch": "1575413167.216789000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413167.216789000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "99.86.77.59", "evidence": [ { "udp_stream": 32, "frame_number": 2663, "display_filter": "frame.number == 2663", "timestamp_epoch": "1575413167.216789000" } ], "is_private": false, "observable_id": "observable-3cac7f333836d16cadebd094", "last_seen_epoch": "1575413167.216789000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413167.216789000" }, { "type": "ipv6", "roles": [ "dns-answer" ], "value": "fd3e:4f5a:5b81::1", "evidence": [ { "udp_stream": 3, "frame_number": 259, "display_filter": "frame.number == 259", "timestamp_epoch": "1575413123.412011000" } ], "is_private": true, "observable_id": "observable-9b9e67774c144d63d68c7515", "last_seen_epoch": "1575413123.412011000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413123.412011000" }, { "type": "ja3", "roles": [ "tls-client-fingerprint" ], "value": "4d7a28d6f2263ed61de88ca66eb011e3", "evidence": [ { "tcp_stream": 23, "frame_number": 288, "display_filter": "frame.number == 288", "timestamp_epoch": "1575413156.177305000" }, { "tcp_stream": 24, "frame_number": 313, "display_filter": "frame.number == 313", "timestamp_epoch": "1575413156.844944000" }, { "tcp_stream": 25, "frame_number": 317, "display_filter": "frame.number == 317", "timestamp_epoch": "1575413156.862203000" }, { "tcp_stream": 26, "frame_number": 358, "display_filter": "frame.number == 358", "timestamp_epoch": "1575413157.370538000" }, { "tcp_stream": 27, "frame_number": 362, "display_filter": "frame.number == 362", "timestamp_epoch": "1575413157.375597000" }, { "tcp_stream": 28, "frame_number": 406, "display_filter": "frame.number == 406", "timestamp_epoch": "1575413157.957301000" }, { "tcp_stream": 29, "frame_number": 408, "display_filter": "frame.number == 408", "timestamp_epoch": "1575413157.957372000" }, { "tcp_stream": 31, "frame_number": 524, "display_filter": "frame.number == 524", "timestamp_epoch": "1575413159.150193000" }, { "tcp_stream": 32, "frame_number": 526, "display_filter": "frame.number == 526", "timestamp_epoch": "1575413159.150917000" }, { "tcp_stream": 33, "frame_number": 535, "display_filter": "frame.number == 535", "timestamp_epoch": "1575413159.388361000" }, { "tcp_stream": 34, "frame_number": 658, "display_filter": "frame.number == 658", "timestamp_epoch": "1575413160.625245000" }, { "tcp_stream": 37, "frame_number": 662, "display_filter": "frame.number == 662", "timestamp_epoch": "1575413160.952787000" }, { "tcp_stream": 35, "frame_number": 675, "display_filter": "frame.number == 675", "timestamp_epoch": "1575413160.953563000" }, { "tcp_stream": 36, "frame_number": 678, "display_filter": "frame.number == 678", "timestamp_epoch": "1575413160.953856000" }, { "tcp_stream": 38, "frame_number": 680, "display_filter": "frame.number == 680", "timestamp_epoch": "1575413160.953961000" }, { "tcp_stream": 39, "frame_number": 958, "display_filter": "frame.number == 958", "timestamp_epoch": "1575413162.970253000" }, { "tcp_stream": 42, "frame_number": 962, "display_filter": "frame.number == 962", "timestamp_epoch": "1575413162.990597000" }, { "tcp_stream": 41, "frame_number": 970, "display_filter": "frame.number == 970", "timestamp_epoch": "1575413162.992961000" }, { "tcp_stream": 40, "frame_number": 972, "display_filter": "frame.number == 972", "timestamp_epoch": "1575413162.993109000" }, { "tcp_stream": 43, "frame_number": 974, "display_filter": "frame.number == 974", "timestamp_epoch": "1575413162.993239000" } ], "is_private": null, "observable_id": "observable-6056c0d72b14f66640068c38", "last_seen_epoch": "1575414523.405641000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413156.177305000" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "0b504e7f3cec848c7a1c25720cc40e7fd6919e217b4f56e50f645bda49259a39", "evidence": [], "is_private": null, "observable_id": "observable-f2b177fc91e9f6435596fac8", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "1a5174980a294a528a110726d5855650266c48d9883bea692b67b6d726da98c5", "evidence": [], "is_private": null, "observable_id": "observable-a532952f1ddea355cc7dd963", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "1f0bad278e2bf2f41979f2144a94cb85ac19d93abd041230b236463a992d9190", "evidence": [], "is_private": null, "observable_id": "observable-b142bca25c30d58367f14dd9", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "52307c67a1d0d310baf70fb8c346eb51856b73c08f9cf67535720b900023ee5e", "evidence": [], "is_private": null, "observable_id": "observable-c97fe5cd53607b4c4a201952", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "5b80b1566219a6c3321b14127ebae23f73a18fd50a0751d2179e42d461e9ad39", "evidence": [], "is_private": null, "observable_id": "observable-f1f32b32dbfc3116cc209b30", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "6c0c18274fed35e973d1c060f2f4137bb91444a78fbafd3be6c5f6d2f3cc63b8", "evidence": [], "is_private": null, "observable_id": "observable-14a742869b29e21ef4bfd6ce", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "6d8a01dc7647bc218d003b58fe04049e24a9359900b7e0cebae76edf85b8b914", "evidence": [], "is_private": null, "observable_id": "observable-2ef5f60ecfc8e16eb9b0a94a", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "78f53c3a83a6e9d23f3903efc3a5635ea95fd21264ada13ebb8af23eb761fa40", "evidence": [], "is_private": null, "observable_id": "observable-d6277528832b17ff12667299", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6", "evidence": [], "is_private": null, "observable_id": "observable-de4352773e8ad91a0ccb43a7", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "839488ebc08446a096a893996ed23eac321ac166724cd8c5d9092057834d2d79", "evidence": [], "is_private": null, "observable_id": "observable-ecedf3a97463338f5ebb2dee", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "8bbbecf9c7b14eab33a19f0ab1529dd595dbd2ba51ef0dab65201aef80ce18b6", "evidence": [], "is_private": null, "observable_id": "observable-3855ab944bd33c5847b5abc5", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "a08902c478721cb65ddbb075d5dea373db29f80c15d67cdb23f25ebfb6284fc7", "evidence": [], "is_private": null, "observable_id": "observable-aa623d8c42fb2c1c20dab455", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "a2f75fb154555d2877b0648f52b549a947b9c82bcff786d7c81ba712e9c3f3f8", "evidence": [], "is_private": null, "observable_id": "observable-c2e3b0f5ba40eb47063610ca", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "afb96043d1f8390179fe445d5063c434d4df10fa0194e7879ecadf4c9e8f9b78", "evidence": [], "is_private": null, "observable_id": "observable-fa739bbed164870fcb39de40", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "c65cb1829bda38e033f2c42d891e2f0cf9cb5bf2352a74a05ffc27049a98cb56", "evidence": [], "is_private": null, "observable_id": "observable-3c29ab9db064545ed00a8246", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b", "evidence": [], "is_private": null, "observable_id": "observable-8769b7b3d3d02eee500a81df", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "cf63a226cdfefcc50f0ebd036df2729d1a6493cac1a5b814eec81ce4eed0f948", "evidence": [], "is_private": null, "observable_id": "observable-57fe67d7de3860096889ee0e", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "evidence": [], "is_private": null, "observable_id": "observable-d7fdc4de0d69c2abfe4071a1", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "url", "roles": [ "http-request" ], "value": "http://239.255.255.250:1900*", "evidence": [ { "frame_number": 3182, "display_filter": "frame.number == 3182", "timestamp_epoch": "1575413205.860754000" }, { "frame_number": 3184, "display_filter": "frame.number == 3184", "timestamp_epoch": "1575413206.181964000" }, { "frame_number": 3199, "display_filter": "frame.number == 3199", "timestamp_epoch": "1575413208.859570000" }, { "frame_number": 3218, "display_filter": "frame.number == 3218", "timestamp_epoch": "1575413209.186580000" }, { "frame_number": 3498, "display_filter": "frame.number == 3498", "timestamp_epoch": "1575413211.874717000" }, { "frame_number": 3534, "display_filter": "frame.number == 3534", "timestamp_epoch": "1575413212.187013000" } ], "is_private": null, "observable_id": "observable-9c958ec3eaf056d99725b146", "last_seen_epoch": "1575413212.187013000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413205.860754000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://8.208.24.139/favicon.ico", "evidence": [ { "tcp_stream": 421, "frame_number": 15569, "display_filter": "frame.number == 15569", "timestamp_epoch": "1575413427.772846000" }, { "tcp_stream": 423, "frame_number": 15944, "display_filter": "frame.number == 15944", "timestamp_epoch": "1575413432.842336000" } ], "is_private": null, "observable_id": "observable-b2a34f309652cc731ccad47c", "last_seen_epoch": "1575413432.842336000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413427.772846000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://api2.casus.at/jvassets/xI/t64.dat", "evidence": [ { "tcp_stream": 426, "frame_number": 15971, "display_filter": "frame.number == 15971", "timestamp_epoch": "1575413440.713801000" } ], "is_private": null, "observable_id": "observable-d7453842750d3e483ce29a09", "last_seen_epoch": "1575413440.713801000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413440.713801000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://crt.usertrust.com/USERTrustRSAAddTrustCA.crt", "evidence": [ { "tcp_stream": 254, "frame_number": 10625, "display_filter": "frame.number == 10625", "timestamp_epoch": "1575413266.902247000" }, { "tcp_stream": 253, "frame_number": 10629, "display_filter": "frame.number == 10629", "timestamp_epoch": "1575413266.906579000" } ], "is_private": null, "observable_id": "observable-ad5ecf9910b64fe84029da62", "last_seen_epoch": "1575413266.906579000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413266.902247000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://go.microsoft.com/fwlink/?LinkID=403856&language=en-US&scale=100&contrast=gray", "evidence": [ { "tcp_stream": 329, "frame_number": 12951, "display_filter": "frame.number == 12951", "timestamp_epoch": "1575413305.661450000" } ], "is_private": null, "observable_id": "observable-cf02ba62ab549db9e4277cc4", "last_seen_epoch": "1575413305.661450000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413305.661450000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://h1.wensa.at/api1/0H5UepzG6l8VMC2Pmj/sEZknMRGq/cYV1WzhM9pu8ZeXH_2FY/oc3TLTu7RSq8d2PoCnQ/WIHBDOGJ2GjfbSowy7j5_2/B0EOfL_2FpbXE/rJfdKuzL/_2BbCSo6csLXLP5vO8R_2B3/TMvCcGFAgV/Th0Hwc6reCySrBkAd/zlQ4OLgNqPb5/5W5WAQ0SxwW/yInFoimw547dUm/IVywwkc_2Bkxi4Udvkm3V/9UMNcvy_2B5tDJ4t/_2BE7_2BHXb_2FQ/BIG44mS62Qdr1DeRku/CSQbSS_0A/_0DsSVK_2Fymf4t8ngQi/oa2u69rQ2Fjk5_2BI7m/oQFncyREXFVbCQDDNqU92w/hsPYdmJIpMMIr/_2B", "evidence": [ { "tcp_stream": 440, "frame_number": 16449, "display_filter": "frame.number == 16449", "timestamp_epoch": "1575414057.593994000" } ], "is_private": null, "observable_id": "observable-d63004ef7f76b8f9b4f97172", "last_seen_epoch": "1575414057.593994000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414057.593994000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://h1.wensa.at/api1/4G0Wr6wO0HVb0ZSY2qm1/K1Uti_2FLNMYqzVrRDZ/USwqUHH_2BR0sNak0R4hRv/pjmVHxq_2FHK7/gwr3QR_2/F95tBCofLSdp1GzKpWuUbPl/LkP69828Bg/sLa1g3aY92ruiOrwK/B6AOBbGIQkio/LQLsJMyJVoH/biNOzDGmPi2Uwb/4jTXSNpqxsQcNUBMrPQbG/5Z7IUjAPqkHv58af/nup7A2KuNKzkTI_/2B70soMb_2B1oRHobL/K3X5EHhbt/zI_2BkMzoLvAQQP8D5_0/A_0Dmg_2Baf6QCX7ZjI/7qKQ4rQKPPaCrEDkSgpBbL/ALG4SCtaG/5p6", "evidence": [ { "tcp_stream": 429, "frame_number": 16185, "display_filter": "frame.number == 16185", "timestamp_epoch": "1575413457.706444000" } ], "is_private": null, "observable_id": "observable-fe9d3abe33c9578e4231fe85", "last_seen_epoch": "1575413457.706444000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413457.706444000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://h1.wensa.at/api1/g_2Bx7tr9ZryzLouz/05_2FX84jbMj/yEgR5F11nXe/H5Q4RcMk_2FuwO/mHq2BQhJfdTL6FfQ5xauF/u3qTIj03n_2B6nCV/KDSsMyOE_2BTXhg/zxiQKteEk_2BtBzEfx/rnKqQyEpw/YTk34JFznNpQ2vXp7rlN/QFKcIBfT62Iy9KIGk6c/fu_2BuRsq5ahizZjA_2B09/ZtAtAlqztqIMv/z2icag6K/oe3n4nqKEufBvSpu_2BCr9K/xKyx8CbjTI/_2Bhj19DXUF0GS_2B/nXsuBYTFS_0A/_0DLPacLo8b/rzI_2BK0OE9TEL/FflWTWADAHUkyB4qUf8r4/9WN9Wa", "evidence": [ { "tcp_stream": 439, "frame_number": 16436, "display_filter": "frame.number == 16436", "timestamp_epoch": "1575414056.522987000" } ], "is_private": null, "observable_id": "observable-cf27ab8a36bd09818da567c1", "last_seen_epoch": "1575414056.522987000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414056.522987000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://h1.wensa.at/api1/Gwbw8tnew726Q/M9Skme3k/6AO19COaR1FoGUdhMsA4GKW/nGqco_2FRl/teGegEqJuVxOOJNjV/oZpTXdjy_2Bp/KEZa3DJBBka/I2gHb_2Bq8hRT4/_2FU7850yaD3XLl9pVrNr/89FBtPrqmkgqnOZV/PXktvK2crzgUudm/BPzuMDS8CVqNScB5ZQ/00ONmphj_/2FdZVyZcJs6fKopUr5Oe/CSefjjsmyKqDX1Ds8p1/KqNJ8ceLBLWrM0Po9Oc5ml/RarNO5_2BgMVz/Ull_0A_0/DZaejK2BA6dxD9vL3jkOsM9/vTC_2F84Pt/COJihOMT_2Fj/raR9XNN", "evidence": [ { "tcp_stream": 431, "frame_number": 16215, "display_filter": "frame.number == 16215", "timestamp_epoch": "1575413469.987340000" } ], "is_private": null, "observable_id": "observable-8412e0f45311fd87908e61d4", "last_seen_epoch": "1575413469.987340000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413469.987340000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://h1.wensa.at/api1/hK7XkhVzoQriE0IxUMIa/1O_2BExsgz_2B4Zrthx/W5oi4sXavmJrJ9O9ZQLiPT/S8QFsqJE4sBmf/34lfHb1q/xuA6Q_2FUiM8Xysq1l2iGRB/xgXJph0O3I/GcewoFxd7uN_2BN_2/BH49MRgd_2Ba/fVlVyXE9he8/2q6kX1ls6vfx6p/QX_2FVWJj2W9fBbvgUrOF/bu5C9f_2F3aoPyMf/JYzTSWA0WG2WuW_/2Br4YaeG1faOQcxd0y/ygfOlk3GY/8vuCdPg8IQd_2B6RPUbY/0XEF_0A_0DKpaKUxoL5/qPjhVWhEzP_2FYH6lBq0L8/FoLLMkTwGyXhD/uKVOKORn/3_2Fucd9qVC/XqMxEWSL/V", "evidence": [ { "tcp_stream": 434, "frame_number": 16315, "display_filter": "frame.number == 16315", "timestamp_epoch": "1575413756.495982000" } ], "is_private": null, "observable_id": "observable-d9e6fd934d2160aa50a59adc", "last_seen_epoch": "1575413756.495982000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413756.495982000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://h1.wensa.at/api1/hT5dOTbjmf2_2B4L0/1eaFf9lf3m_2/BEod_2FgUv1/bH2oww4ozdpST4/0acg3vqY7b7zbofHJ41fp/TCAo62pQ7IZa7G0M/iUe40TTaNAP_2BX/JAxRkvtqotcpimE8G2/_2BYg04t6/PW5wbGs_2F6zmB6DwT8h/4VDZ24p2WrGNrXRSmt3/KNVKNdr649JOjV0obrOZBq/g7R1FUFGlzI1u/2d_2BXpZ/0fFT4vAb57Og_2BcIwwM2S8/coL2_2BCyP/KeoRT2yn7nueL4fti/ZhMFL_0A_0DI/A_2FkWnMUpu/XWsMQEDNYGA6pd/N1mzHAcnvEFjdim2rLpxQ/LBIJYMSjpX_2FZT_/2F5V0kBIIM/A", "evidence": [ { "tcp_stream": 487, "frame_number": 21103, "display_filter": "frame.number == 21103", "timestamp_epoch": "1575414657.626613000" } ], "is_private": null, "observable_id": "observable-77522da2425a0d682351abc2", "last_seen_epoch": "1575414657.626613000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414657.626613000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://h1.wensa.at/api1/IDTB2Kcam0xK2fxd/vTEcLqZOh5c9NYp/NXe6hyoZ9mNQTlY3Y5/bLIdZtExd/d31qAYZtsuTQ9gbIrUSe/PGrhB_2B9yjB9bXOF7t/r1hhLrPtfktOcSFkbu6Ekq/618iNFb5nCo6k/sfFUnlf_/2FoJgVQXG_2FHnDq4o5FjDN/BXT35nGCWe/nyYlM4u5QciWlXTKn/Wm1_2FQtCZd6/aM_2FytaGFR/hYFsI2a6Zr8k4Q/_2BnAwEvBubUGKUloxotM/SLymtM9HHfANmR9n/_0A_0DC9isxkOv5/2K4_2BjxTOT0rBI_2B/_2FLRSSAS/8Qwfk0N2nq8/beBzLG", "evidence": [ { "tcp_stream": 489, "frame_number": 21158, "display_filter": "frame.number == 21158", "timestamp_epoch": "1575414669.952174000" } ], "is_private": null, "observable_id": "observable-5447c5ede5ec521df1d82ccd", "last_seen_epoch": "1575414669.952174000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414669.952174000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://h1.wensa.at/api1/NdyKQBz2bkQyWRjW/DQxAC7LXQQhux0L/JG8Hy_2FKtggSPly52/OI_2Bww0d/GlhCZjLB1qzPFsZmpylg/Ms3wZA3Stl71Q46KRVb/iVLkW9gg4uKEOIATInV3zY/iLuKm_2BHFq5Q/sYBbWlUn/p_2BS4xgcBhCn0_2FVa5JBR/FwZ3dNRALU/50_2FvcGyN_2Bi_2F/gT8JmJY_2Frd/Lwf2Rf9oDBS/vn2noKvqMLt20R/8_2Fy946FBaM8_2F1ADOd/yK0bIHFjspZwtBHx/YHVqsuHv6P_0A_0/Dv9mhzaFuIXiIwIFNV/J7o6OM2pj/ergUZu91KSmAuKhCbtY2/Z7AlSzdNRd_2F_2BrH8/VYH_2BmX/E", "evidence": [ { "tcp_stream": 428, "frame_number": 16166, "display_filter": "frame.number == 16166", "timestamp_epoch": "1575413456.606844000" } ], "is_private": null, "observable_id": "observable-46f6650556fabe4da8331375", "last_seen_epoch": "1575413456.606844000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413456.606844000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://h1.wensa.at/api1/QgPIxa1ctWDK/QU9lAhPb2iw/5sIZr5uccWlTxZ/uU_2FqywknwxovxrWm_2F/ahch3EAUKYeQXCzA/Vynn0p13_2Bpxqw/tiWI5q5zVB6xDKKPsK/jd8RtPdHr/U9wvSAKUxuqoPqHyK80e/Pp9fwSrn2K6_2Fx6Jvq/O_2BxEc_2BAPBPnfun8is9/51Pm2zx2o6hHW/9lHHpa80/bTCwozeMJ4Mrk2q9WhpEAE3/l4oUJWp_2F/I_2FM41FL473zUEnL/2cD_2FdZ8qun/29km6_2F7t_/2BL_0A_0DoEVkm/rcBnMNBSpm5xuE8tfj0dd/xPdfTqFLXz5KI7CFdVm/7Z", "evidence": [ { "tcp_stream": 427, "frame_number": 16153, "display_filter": "frame.number == 16153", "timestamp_epoch": "1575413455.515761000" } ], "is_private": null, "observable_id": "observable-ac04d387e0bc53a18013ed61", "last_seen_epoch": "1575413455.515761000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413455.515761000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://h1.wensa.at/api1/rdEreIZkL4/wPcSNXzrRsehTfcyh/tMgQb3qP5lKV/3G4sKnE3XbK/elnGU0srM6zogs/s_2FESzfMOTYDC5_2FR44/j6_2Fv7HHm0FcoBK/_2FRt9xIa946PwM/7hRJM1qbSsws9VeljG/1J6wSRUaT/gmjRcK2wygucnEodYqLC/FbjG139p5ZDb5pyAufv/nJXkZEoWxFZH_2FooxgojE/tFU5IyJR00Riy/bazsDgly/BetpqgAXMYifOBIEdhrITDi/m2GTytY3XJ/JO4r_0A_0DsEyLom2/0DBGVv7B7iWo/qEglwzPAxGf/CnptaQBsxDNM3l/DWphGJyhAADQy1hbrnY_2/Faz2p", "evidence": [ { "tcp_stream": 442, "frame_number": 16493, "display_filter": "frame.number == 16493", "timestamp_epoch": "1575414357.589472000" } ], "is_private": null, "observable_id": "observable-501eb7f4cabb2166af674114", "last_seen_epoch": "1575414357.589472000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414357.589472000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://h1.wensa.at/api1/vkxyxZ87Twi_2Fn1PHKp/03jApGbg_2BRhYkWe9k/esP6O8hbXHW6ZPgXl_2BSj/eoO9reGwFG5Nl/0Bl4MK9Y/Jd_2BNDeICtWFs2iHFgpCDs/67mGV1rAHa/zuH8BB7FghT4J2TNj/R4rOjkgHMzJa/gbTEXT5RJwF/2fmttnND48mMIW/wti0svI2LCBV161F0fEVF/14N3kRMB1SGN44Nm/X7RDPysDrd8saSl/jYZkFcj_2BzrVuVXSM/6kM52Gg2R/Qs_2FpbLz0jSKD_2Bh_0/A_0Decb6GJ_2BMAJGne/vVWWOh9xt4K0tz2TppftCo/JsWCPltqz/XLm", "evidence": [ { "tcp_stream": 430, "frame_number": 16202, "display_filter": "frame.number == 16202", "timestamp_epoch": "1575413468.944358000" } ], "is_private": null, "observable_id": "observable-311671737e2bf13c637dec65", "last_seen_epoch": "1575413468.944358000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413468.944358000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://h1.wensa.at/api1/WFavOHRQEMt1/znzQ6SK8Cgb/wxvOQ24UVpaQ7R/5E5zFgFb9RQEgPSly9itM/m_2ByKEgt9nvbpq5/rldfZ8lX1njJaA_/2FG7PamZ5_2FEsPiSc/AQx3zcvaB/qWSse9dj40jJCiIERQZn/nJ_2B7CfYvnMHI6bUv5/MZUbbZtoX0enD_2F3KhrS6/cy8A3KCQ9r1hu/Jh0amkRo/081_2FiOyZxp6B7n5bVAptk/IFzCpwyO5t/bkXCXwooW_2Bw550c/aOreQQMfX4Gl/BT7itc_0A_0/DjFoQkz2N1oAiX/qjaaLL_2BSO3VvsqA_2Bp/sT9LOZEV9wlPj7Bt/THj2ittoB/7CHZWVbOOz5/wV", "evidence": [ { "tcp_stream": 488, "frame_number": 21116, "display_filter": "frame.number == 21116", "timestamp_epoch": "1575414658.671978000" } ], "is_private": null, "observable_id": "observable-58b80de7d45383f84c18e3ae", "last_seen_epoch": "1575414658.671978000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414658.671978000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://mail.aol.com/", "evidence": [ { "tcp_stream": 22, "frame_number": 281, "display_filter": "frame.number == 281", "timestamp_epoch": "1575413155.938245000" } ], "is_private": null, "observable_id": "observable-fdbf29838037fc3165fd9cda", "last_seen_epoch": "1575413155.938245000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413155.938245000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://w8.wensa.at/api1/I01zepn8d/lW8zbbQjFkfEikrpMjIM/BUpAeRTlHQ4bvFyNQ5b/QJQiaBloENVY8vhKyUyE0o/DlBxOkmYhfcXF/f83ZepX0/p4w8NwGSdWiq2d0xSm7dQRx/c9TVoEwwGP/q1ZfqVF4Kk65L3fk5/ZmA_2F4e_2Fz/EA15GMwiWYS/dM6cnd6KMsJ08_/2FGuylglowKzvlAqp_2B7/1F_2FeKeSZFlbTaP/MX93YLJkZgekq1k/2ECfT2iPz4_2FLNdDL/PjdGytsj5/j_2BwGYOG_0A_0DWVnLJ/lblBYSp5hbm4QlU/JSHmUi", "evidence": [ { "tcp_stream": 422, "frame_number": 15581, "display_filter": "frame.number == 15581", "timestamp_epoch": "1575413428.857662000" } ], "is_private": null, "observable_id": "observable-86cb554d8a50e0450f16cb08", "last_seen_epoch": "1575413428.857662000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413428.857662000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://w8.wensa.at/api1/PUbKL64xdNDApQ_2FhOvR/PzVuL7v93RbB1xfc/OEnwN9VtRcH8Ccu/jPgnw0d37uDEzDiVOf/KHgo0k5Uc/k6JCnK_2FBZ4yd9zeeiC/VpJpc2JMgFpc_2BUK2N/MNdoh0fThkbLeh37DCpXrm/guVivsIWc_2FM/aKnRfxy_/2FhTlme15XsXbjEQesbQbAJ/Z9BLtjy3Zi/ZcwiqStUG_2BZapZN/hqA8oHVvfrmy/sqq6RrFWUhE/NiEXX3DV0k2wcp/3ypM4pRUl6ezpp8W_0A_0/Dq6VuunS4q_2BKna/0dWjHSjvGD9y/2", "evidence": [ { "tcp_stream": 420, "frame_number": 15288, "display_filter": "frame.number == 15288", "timestamp_epoch": "1575413425.959473000" } ], "is_private": null, "observable_id": "observable-fb791000b140e99b855709c9", "last_seen_epoch": "1575413425.959473000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413425.959473000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://w8.wensa.at/api1/yHuijzBzQc46MJ8Hh_2B3To/h6eUe0SPQ_/2FyC9fDGgAdh4u0V0/Y_2F7w0Pe86d/_2FTkP74EP4/K1gu1U6e0AQB5l/cREXUjyc5L8u6LnRWbbL1/uRyhvKc_2FJntmF6/2AoYMEWtimRTV2a/PtgF_2F7ZN3svdTbI8/iP951uoBL/13G66amAYJslhDbJ9LRx/3TnU8ybVEHD70NlfPgK/H8jUEtFKAt07GB5iuDJECi/UWsRrR1g_2FwB/Fis0q36f/6B9w_2F9mwHOMRaRAywS_0A/_0DXkcCzh7/ICclVahOB309_2F/AEHAZk", "evidence": [ { "tcp_stream": 424, "frame_number": 15956, "display_filter": "frame.number == 15956", "timestamp_epoch": "1575413434.456567000" } ], "is_private": null, "observable_id": "observable-cfa30db995c58fcfe35e080a", "last_seen_epoch": "1575413434.456567000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413434.456567000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.bing.com/favicon.ico", "evidence": [ { "tcp_stream": 449, "frame_number": 17330, "display_filter": "frame.number == 17330", "timestamp_epoch": "1575414488.801335000" } ], "is_private": null, "observable_id": "observable-24c5326d4d8dd5ded1749a85", "last_seen_epoch": "1575414488.801335000", "enrichment_state": "not_requested", "first_seen_epoch": "1575414488.801335000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt", "evidence": [ { "tcp_stream": 256, "frame_number": 10681, "display_filter": "frame.number == 10681", "timestamp_epoch": "1575413267.275134000" }, { "tcp_stream": 257, "frame_number": 10684, "display_filter": "frame.number == 10684", "timestamp_epoch": "1575413267.275288000" }, { "tcp_stream": 256, "frame_number": 10744, "display_filter": "frame.number == 10744", "timestamp_epoch": "1575413267.573647000" }, { "tcp_stream": 257, "frame_number": 10746, "display_filter": "frame.number == 10746", "timestamp_epoch": "1575413267.574570000" } ], "is_private": null, "observable_id": "observable-2e6817ab14f517e1640cc6c5", "last_seen_epoch": "1575413267.574570000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413267.275134000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Microsoft-CryptoAPI/6.1", "evidence": [ { "tcp_stream": 254, "frame_number": 10625, "display_filter": "frame.number == 10625", "timestamp_epoch": "1575413266.902247000" }, { "tcp_stream": 253, "frame_number": 10629, "display_filter": "frame.number == 10629", "timestamp_epoch": "1575413266.906579000" }, { "tcp_stream": 256, "frame_number": 10681, "display_filter": "frame.number == 10681", "timestamp_epoch": "1575413267.275134000" }, { "tcp_stream": 257, "frame_number": 10684, "display_filter": "frame.number == 10684", "timestamp_epoch": "1575413267.275288000" }, { "tcp_stream": 256, "frame_number": 10744, "display_filter": "frame.number == 10744", "timestamp_epoch": "1575413267.573647000" }, { "tcp_stream": 257, "frame_number": 10746, "display_filter": "frame.number == 10746", "timestamp_epoch": "1575413267.574570000" } ], "is_private": null, "observable_id": "observable-5e62fbe50cfe495157b63ea1", "last_seen_epoch": "1575413267.574570000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413266.902247000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0", "evidence": [ { "tcp_stream": 427, "frame_number": 16153, "display_filter": "frame.number == 16153", "timestamp_epoch": "1575413455.515761000" }, { "tcp_stream": 428, "frame_number": 16166, "display_filter": "frame.number == 16166", "timestamp_epoch": "1575413456.606844000" }, { "tcp_stream": 429, "frame_number": 16185, "display_filter": "frame.number == 16185", "timestamp_epoch": "1575413457.706444000" }, { "tcp_stream": 430, "frame_number": 16202, "display_filter": "frame.number == 16202", "timestamp_epoch": "1575413468.944358000" }, { "tcp_stream": 431, "frame_number": 16215, "display_filter": "frame.number == 16215", "timestamp_epoch": "1575413469.987340000" }, { "tcp_stream": 434, "frame_number": 16315, "display_filter": "frame.number == 16315", "timestamp_epoch": "1575413756.495982000" }, { "tcp_stream": 439, "frame_number": 16436, "display_filter": "frame.number == 16436", "timestamp_epoch": "1575414056.522987000" }, { "tcp_stream": 440, "frame_number": 16449, "display_filter": "frame.number == 16449", "timestamp_epoch": "1575414057.593994000" }, { "tcp_stream": 442, "frame_number": 16493, "display_filter": "frame.number == 16493", "timestamp_epoch": "1575414357.589472000" }, { "tcp_stream": 487, "frame_number": 21103, "display_filter": "frame.number == 21103", "timestamp_epoch": "1575414657.626613000" }, { "tcp_stream": 488, "frame_number": 21116, "display_filter": "frame.number == 21116", "timestamp_epoch": "1575414658.671978000" }, { "tcp_stream": 489, "frame_number": 21158, "display_filter": "frame.number == 21158", "timestamp_epoch": "1575414669.952174000" } ], "is_private": null, "observable_id": "observable-34e8c814ce7e85ef15932286", "last_seen_epoch": "1575414669.952174000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413455.515761000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko", "evidence": [ { "tcp_stream": 329, "frame_number": 12951, "display_filter": "frame.number == 12951", "timestamp_epoch": "1575413305.661450000" }, { "tcp_stream": 449, "frame_number": 17330, "display_filter": "frame.number == 17330", "timestamp_epoch": "1575414488.801335000" } ], "is_private": null, "observable_id": "observable-11b9d7db67bc438da3e2ccd8", "last_seen_epoch": "1575414488.801335000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413305.661450000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "evidence": [ { "tcp_stream": 22, "frame_number": 281, "display_filter": "frame.number == 281", "timestamp_epoch": "1575413155.938245000" }, { "tcp_stream": 420, "frame_number": 15288, "display_filter": "frame.number == 15288", "timestamp_epoch": "1575413425.959473000" }, { "tcp_stream": 421, "frame_number": 15569, "display_filter": "frame.number == 15569", "timestamp_epoch": "1575413427.772846000" }, { "tcp_stream": 422, "frame_number": 15581, "display_filter": "frame.number == 15581", "timestamp_epoch": "1575413428.857662000" }, { "tcp_stream": 423, "frame_number": 15944, "display_filter": "frame.number == 15944", "timestamp_epoch": "1575413432.842336000" }, { "tcp_stream": 424, "frame_number": 15956, "display_filter": "frame.number == 15956", "timestamp_epoch": "1575413434.456567000" } ], "is_private": null, "observable_id": "observable-8ef2f9ad78f1854669e452e9", "last_seen_epoch": "1575413434.456567000", "enrichment_state": "not_requested", "first_seen_epoch": "1575413155.938245000" } ], "schema_version": "pcap-analysis-v1", "semantic_sha256": "2ce5685240d4e8d4a57342c7b2fcec99b8925adbdbc1f79c94697f24e9fa6993", "analyzer_manifest": { "limits": { "max_flows": 50000, "max_endpoints": 20000, "max_upload_bytes": 536870912, "max_exported_files": 50000, "max_events_per_kind": 50000, "max_exported_objects": 500, "tool_timeout_seconds": 300, "max_object_hash_index": 50000, "max_tool_output_bytes": 268435456, "max_exported_total_bytes": 268435456, "max_exported_object_bytes": 52428800 }, "profile_id": "tshark-evidence-v6", "profile_sha256": "aff64bf3786902d5d7a2c1a9be158a5246cc81aecea6c44eda74701431070465", "schema_version": "pcap-analyzer-manifest-v1", "tshark_version": "TShark (Wireshark) 4.4.18.", "manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0", "capinfos_version": "Capinfos (Wireshark) 4.4.18.", "rulepack_version": "pcap-rules-v5", "implementation_sha256": "1a7d19199ff58059a12b34656620481b502fadc52d115b5f4b42fc28e5817c3c", "requested_fields_sha256": "e7a6eff11f7ae2101845897ce7e3b0a0e9cea31bdea4a824734869f39f3fb4f3", "supported_profile_fields_sha256": "6d94b9bc3aea93d5f7f4f815bdd025560ceba0d5e27b380ad14da28b44947994" }, "attack_candidates": [], "analysis_key_material": { "source_sha256": "01da378585edbbc7d97e9cd91418a50cc506468d615ff0002b7f4bc34e0cbe0a", "rulepack_version": "pcap-rules-v5", "analyzer_manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0" } }, "context": { "mode": "local-only", "matches": [], "coverage": { "truncated": false, "no_exact_match": 565, "observable_limit": 5000, "observables_total": 565, "matched_observables": 0, "observables_checked": 565, "prior_cases_checked": 50, "prior_case_limit_reached": true }, "created_at": "2026-09-22T16:01:42.557567+00:00", "session_id": "48b1b9f6-8efb-4b8c-9a75-698c3c1c2789", "techniques": [], "interpretation": "No match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.", "schema_version": "pcap-context-v1", "snapshot_sha256": "7391d9a1492b61adb92cbb4caa154ab6d893d9a075ce9959761e6e0b1ed161e8", "source_actor_links": [], "external_enrichment": { "reason": "Requires explicit provider consent and privacy review", "status": "not-requested", "requests": 0 }, "source_semantic_sha256": "2ce5685240d4e8d4a57342c7b2fcec99b8925adbdbc1f79c94697f24e9fa6993", "cross_case_correlations": [ { "shared_count": 14, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 9, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 39, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 120, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 2, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 9, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 7, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 7, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 11, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 6, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 14, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 11, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 8, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 9, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 1, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 3, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 3, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 5, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 7, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 10, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 9, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 10, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 8, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 9, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 10, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 9, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." } ] }, "assessment": { "policy_version": "pcap-assessment-v3", "source_semantic_sha256": "2ce5685240d4e8d4a57342c7b2fcec99b8925adbdbc1f79c94697f24e9fa6993", "items": [ { "observable_id": "observable-2abae6ca95386b6e43cd26f8", "type": "domain", "value": "222.222.67.208.in-addr.arpa", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 149, "frame_number": 16132, "display_filter": "frame.number == 16132", "timestamp_epoch": "1575413450.598824000" }, { "udp_stream": 150, "frame_number": 16133, "display_filter": "frame.number == 16133", "timestamp_epoch": "1575413450.598925000" }, { "udp_stream": 149, "frame_number": 16134, "display_filter": "frame.number == 16134", "timestamp_epoch": "1575413450.991320000" }, { "udp_stream": 150, "frame_number": 16136, "display_filter": "frame.number == 16136", "timestamp_epoch": "1575413450.995136000" } ], "roles": [ "dns-query" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5d457c947380fa15fc9bb743", "type": "domain", "value": "a.tribalfusion.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:44:46.368151+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:52.421575+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 124, "frame_number": 13184, "display_filter": "frame.number == 13184", "timestamp_epoch": "1575413306.142255000" }, { "udp_stream": 124, "frame_number": 13357, "display_filter": "frame.number == 13357", "timestamp_epoch": "1575413306.307779000" }, { "tcp_stream": 383, "frame_number": 13559, "display_filter": "frame.number == 13559", "timestamp_epoch": "1575413306.504817000" }, { "tcp_stream": 384, "frame_number": 13561, "display_filter": "frame.number == 13561", "timestamp_epoch": "1575413306.505030000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:52.415855+00:00" }, { "observable_id": "observable-094d4fac48fb64fd59c46c1f", "type": "domain", "value": "aa.agkn.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:44:46.562458+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:52.431021+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 31, "frame_number": 2655, "display_filter": "frame.number == 2655", "timestamp_epoch": "1575413167.132764000" }, { "udp_stream": 31, "frame_number": 2659, "display_filter": "frame.number == 2659", "timestamp_epoch": "1575413167.210776000" }, { "tcp_stream": 64, "frame_number": 2681, "display_filter": "frame.number == 2681", "timestamp_epoch": "1575413167.297012000" }, { "tcp_stream": 65, "frame_number": 2695, "display_filter": "frame.number == 2695", "timestamp_epoch": "1575413167.305025000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:52.426149+00:00" }, { "observable_id": "observable-acb5dbd36b8670eb6e65598e", "type": "domain", "value": "ad.doubleclick.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:44:47.999984+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:52.440318+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 23, "frame_number": 1040, "display_filter": "frame.number == 1040", "timestamp_epoch": "1575413163.088488000" }, { "udp_stream": 23, "frame_number": 1069, "display_filter": "frame.number == 1069", "timestamp_epoch": "1575413163.198550000" }, { "tcp_stream": 46, "frame_number": 1088, "display_filter": "frame.number == 1088", "timestamp_epoch": "1575413163.327415000" }, { "tcp_stream": 45, "frame_number": 1101, "display_filter": "frame.number == 1101", "timestamp_epoch": "1575413163.331669000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:52.435686+00:00" }, { "observable_id": "observable-c84950f3b1fce8b4e4c51c92", "type": "domain", "value": "ad.turn.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:44:48.311339+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:52.450045+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 78, "frame_number": 9292, "display_filter": "frame.number == 9292", "timestamp_epoch": "1575413262.581216000" }, { "udp_stream": 78, "frame_number": 9357, "display_filter": "frame.number == 9357", "timestamp_epoch": "1575413262.702392000" }, { "tcp_stream": 216, "frame_number": 9451, "display_filter": "frame.number == 9451", "timestamp_epoch": "1575413262.860441000" }, { "tcp_stream": 215, "frame_number": 9457, "display_filter": "frame.number == 9457", "timestamp_epoch": "1575413262.864668000" }, { "tcp_stream": 319, "frame_number": 12703, "display_filter": "frame.number == 12703", "timestamp_epoch": "1575413305.286681000" }, { "tcp_stream": 320, "frame_number": 12709, "display_filter": "frame.number == 12709", "timestamp_epoch": "1575413305.291034000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:52.445360+00:00" }, { "observable_id": "observable-7a77b900cf6e944c01be95b8", "type": "domain", "value": "ad.turn.com.akadns.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 78, "frame_number": 9357, "display_filter": "frame.number == 9357", "timestamp_epoch": "1575413262.702392000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-102021d5d0e7bf80cdfb1751", "type": "domain", "value": "ads.pubmatic.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:44:48.666824+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:52.461803+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 80, "frame_number": 9294, "display_filter": "frame.number == 9294", "timestamp_epoch": "1575413262.587877000" }, { "udp_stream": 80, "frame_number": 9345, "display_filter": "frame.number == 9345", "timestamp_epoch": "1575413262.654064000" }, { "tcp_stream": 209, "frame_number": 9419, "display_filter": "frame.number == 9419", "timestamp_epoch": "1575413262.804160000" }, { "tcp_stream": 210, "frame_number": 9430, "display_filter": "frame.number == 9430", "timestamp_epoch": "1575413262.820376000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:52.456084+00:00" }, { "observable_id": "observable-31dc241354ff0bff8e876c61", "type": "domain", "value": "ads.yahoo.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:44:48.848605+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:52.476123+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 69, "frame_number": 8604, "display_filter": "frame.number == 8604", "timestamp_epoch": "1575413260.166154000" }, { "udp_stream": 69, "frame_number": 8646, "display_filter": "frame.number == 8646", "timestamp_epoch": "1575413260.432992000" }, { "tcp_stream": 185, "frame_number": 8681, "display_filter": "frame.number == 8681", "timestamp_epoch": "1575413260.570908000" }, { "tcp_stream": 186, "frame_number": 8685, "display_filter": "frame.number == 8685", "timestamp_epoch": "1575413260.585331000" }, { "tcp_stream": 303, "frame_number": 12582, "display_filter": "frame.number == 12582", "timestamp_epoch": "1575413304.669901000" }, { "tcp_stream": 304, "frame_number": 12584, "display_filter": "frame.number == 12584", "timestamp_epoch": "1575413304.670144000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:52.469586+00:00" }, { "observable_id": "observable-527ab6475e33966fa862b7d3", "type": "domain", "value": "ads.yap.yahoo.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:52.699627+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:52.697517+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 49, "frame_number": 6379, "display_filter": "frame.number == 6379", "timestamp_epoch": "1575413249.766503000" }, { "udp_stream": 49, "frame_number": 6460, "display_filter": "frame.number == 6460", "timestamp_epoch": "1575413250.068987000" }, { "tcp_stream": 130, "frame_number": 6596, "display_filter": "frame.number == 6596", "timestamp_epoch": "1575413250.317154000" }, { "tcp_stream": 129, "frame_number": 6598, "display_filter": "frame.number == 6598", "timestamp_epoch": "1575413250.317352000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:52.694317+00:00" }, { "observable_id": "observable-80abe780a41d5f15cba0680f", "type": "domain", "value": "adserver-vpc-alb-0-2072243822.us-east-1.elb.amazonaws.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 119, "frame_number": 13113, "display_filter": "frame.number == 13113", "timestamp_epoch": "1575413306.103126000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9cdd32d434f1ee3a44a43e59", "type": "domain", "value": "adserver.adtech.advertising.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:52.871850+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:52.866834+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 50, "frame_number": 6833, "display_filter": "frame.number == 6833", "timestamp_epoch": "1575413250.760262000" }, { "udp_stream": 50, "frame_number": 6899, "display_filter": "frame.number == 6899", "timestamp_epoch": "1575413251.062084000" }, { "tcp_stream": 133, "frame_number": 6930, "display_filter": "frame.number == 6930", "timestamp_epoch": "1575413251.162091000" }, { "tcp_stream": 134, "frame_number": 6934, "display_filter": "frame.number == 6934", "timestamp_epoch": "1575413251.164564000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:52.862167+00:00" }, { "observable_id": "observable-32ef5d448f2bd5cc0a30ad9e", "type": "domain", "value": "aero.bankofamerica.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:53.052749+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:53.047450+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 182, "frame_number": 17338, "display_filter": "frame.number == 17338", "timestamp_epoch": "1575414489.185931000" }, { "udp_stream": 182, "frame_number": 17363, "display_filter": "frame.number == 17363", "timestamp_epoch": "1575414489.352624000" }, { "tcp_stream": 459, "frame_number": 17521, "display_filter": "frame.number == 17521", "timestamp_epoch": "1575414489.714009000" }, { "tcp_stream": 458, "frame_number": 17527, "display_filter": "frame.number == 17527", "timestamp_epoch": "1575414489.714501000" }, { "tcp_stream": 468, "frame_number": 18434, "display_filter": "frame.number == 18434", "timestamp_epoch": "1575414491.357363000" }, { "tcp_stream": 470, "frame_number": 18446, "display_filter": "frame.number == 18446", "timestamp_epoch": "1575414491.364631000" }, { "tcp_stream": 481, "frame_number": 20233, "display_filter": "frame.number == 20233", "timestamp_epoch": "1575414522.730039000" }, { "tcp_stream": 486, "frame_number": 20567, "display_filter": "frame.number == 20567", "timestamp_epoch": "1575414523.405641000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:53.042502+00:00" }, { "observable_id": "observable-7e43d55a5fe2bd53bb6180e8", "type": "domain", "value": "aka-cdn.adtechus.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:53.240271+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:53.236406+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 22, "frame_number": 1037, "display_filter": "frame.number == 1037", "timestamp_epoch": "1575413163.086015000" }, { "udp_stream": 22, "frame_number": 1072, "display_filter": "frame.number == 1072", "timestamp_epoch": "1575413163.219942000" }, { "tcp_stream": 47, "frame_number": 1081, "display_filter": "frame.number == 1081", "timestamp_epoch": "1575413163.327080000" }, { "tcp_stream": 48, "frame_number": 1083, "display_filter": "frame.number == 1083", "timestamp_epoch": "1575413163.327186000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:53.232273+00:00" }, { "observable_id": "observable-bb0aa819f5c331d34de6ff37", "type": "domain", "value": "api.bing.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 11, "frame_number": 551, "display_filter": "frame.number == 551", "timestamp_epoch": "1575413159.407057000" }, { "udp_stream": 12, "frame_number": 552, "display_filter": "frame.number == 552", "timestamp_epoch": "1575413159.407211000" }, { "udp_stream": 11, "frame_number": 560, "display_filter": "frame.number == 560", "timestamp_epoch": "1575413159.571932000" }, { "udp_stream": 12, "frame_number": 561, "display_filter": "frame.number == 561", "timestamp_epoch": "1575413159.572020000" }, { "udp_stream": 139, "frame_number": 15894, "display_filter": "frame.number == 15894", "timestamp_epoch": "1575413432.609808000" }, { "udp_stream": 140, "frame_number": 15895, "display_filter": "frame.number == 15895", "timestamp_epoch": "1575413432.610255000" }, { "udp_stream": 140, "frame_number": 15924, "display_filter": "frame.number == 15924", "timestamp_epoch": "1575413432.761525000" }, { "udp_stream": 139, "frame_number": 15925, "display_filter": "frame.number == 15925", "timestamp_epoch": "1575413432.761612000" }, { "udp_stream": 177, "frame_number": 17197, "display_filter": "frame.number == 17197", "timestamp_epoch": "1575414487.622818000" }, { "udp_stream": 180, "frame_number": 17200, "display_filter": "frame.number == 17200", "timestamp_epoch": "1575414487.625563000" }, { "udp_stream": 180, "frame_number": 17245, "display_filter": "frame.number == 17245", "timestamp_epoch": "1575414487.898383000" }, { "udp_stream": 177, "frame_number": 17247, "display_filter": "frame.number == 17247", "timestamp_epoch": "1575414487.898510000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-92962bb482ea1243cfc95546", "type": "domain", "value": "api.login.aol.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:53.438871+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:53.434055+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 7, "frame_number": 351, "display_filter": "frame.number == 351", "timestamp_epoch": "1575413157.216685000" }, { "udp_stream": 7, "frame_number": 352, "display_filter": "frame.number == 352", "timestamp_epoch": "1575413157.278971000" }, { "tcp_stream": 26, "frame_number": 358, "display_filter": "frame.number == 358", "timestamp_epoch": "1575413157.370538000" }, { "tcp_stream": 27, "frame_number": 362, "display_filter": "frame.number == 362", "timestamp_epoch": "1575413157.375597000" }, { "tcp_stream": 97, "frame_number": 3896, "display_filter": "frame.number == 3896", "timestamp_epoch": "1575413239.592707000" }, { "tcp_stream": 96, "frame_number": 3900, "display_filter": "frame.number == 3900", "timestamp_epoch": "1575413239.596757000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:53.429179+00:00" }, { "observable_id": "observable-e397fc7e778496bac3dac380", "type": "domain", "value": "api2.casus.at", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:51.827532+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:51.821850+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 146, "frame_number": 15966, "display_filter": "frame.number == 15966", "timestamp_epoch": "1575413440.200051000" }, { "udp_stream": 146, "frame_number": 15967, "display_filter": "frame.number == 15967", "timestamp_epoch": "1575413440.498835000" }, { "tcp_stream": 426, "frame_number": 15971, "display_filter": "frame.number == 15971", "timestamp_epoch": "1575413440.713801000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:51.814527+00:00" }, { "observable_id": "observable-b175953c3556bacea93d2923", "type": "domain", "value": "apx.moatads.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:53.621946+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:53.617306+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 27, "frame_number": 1431, "display_filter": "frame.number == 1431", "timestamp_epoch": "1575413164.249265000" }, { "udp_stream": 27, "frame_number": 2058, "display_filter": "frame.number == 2058", "timestamp_epoch": "1575413165.535569000" }, { "udp_stream": 27, "frame_number": 2214, "display_filter": "frame.number == 2214", "timestamp_epoch": "1575413165.990675000" }, { "tcp_stream": 53, "frame_number": 2447, "display_filter": "frame.number == 2447", "timestamp_epoch": "1575413166.362415000" }, { "tcp_stream": 54, "frame_number": 2453, "display_filter": "frame.number == 2453", "timestamp_epoch": "1575413166.367591000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:53.612219+00:00" }, { "observable_id": "observable-eee2f162b77a33664598f447", "type": "domain", "value": "at.atwola.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:53.797240+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:53.795360+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 48, "frame_number": 5605, "display_filter": "frame.number == 5605", "timestamp_epoch": "1575413248.806325000" }, { "udp_stream": 48, "frame_number": 5656, "display_filter": "frame.number == 5656", "timestamp_epoch": "1575413248.903560000" }, { "tcp_stream": 121, "frame_number": 6054, "display_filter": "frame.number == 6054", "timestamp_epoch": "1575413249.284537000" }, { "tcp_stream": 120, "frame_number": 6055, "display_filter": "frame.number == 6055", "timestamp_epoch": "1575413249.284637000" }, { "tcp_stream": 135, "frame_number": 7074, "display_filter": "frame.number == 7074", "timestamp_epoch": "1575413252.276342000" }, { "tcp_stream": 298, "frame_number": 12490, "display_filter": "frame.number == 12490", "timestamp_epoch": "1575413303.010327000" }, { "tcp_stream": 297, "frame_number": 12494, "display_filter": "frame.number == 12494", "timestamp_epoch": "1575413303.013351000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:53.793297+00:00" }, { "observable_id": "observable-69163faa4644efe6f6c92969", "type": "domain", "value": "audex.userreport.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:53.954270+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:53.952182+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 32, "frame_number": 2658, "display_filter": "frame.number == 2658", "timestamp_epoch": "1575413167.147746000" }, { "udp_stream": 32, "frame_number": 2663, "display_filter": "frame.number == 2663", "timestamp_epoch": "1575413167.216789000" }, { "tcp_stream": 67, "frame_number": 2699, "display_filter": "frame.number == 2699", "timestamp_epoch": "1575413167.307424000" }, { "tcp_stream": 66, "frame_number": 2700, "display_filter": "frame.number == 2700", "timestamp_epoch": "1575413167.307490000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:53.949176+00:00" }, { "observable_id": "observable-0eb5dad8d2bbf156e4e6e460", "type": "domain", "value": "awuseb.advanced-web-analytics.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:54.137894+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:54.133095+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 189, "frame_number": 18877, "display_filter": "frame.number == 18877", "timestamp_epoch": "1575414493.246643000" }, { "udp_stream": 189, "frame_number": 18913, "display_filter": "frame.number == 18913", "timestamp_epoch": "1575414494.106735000" }, { "tcp_stream": 476, "frame_number": 18928, "display_filter": "frame.number == 18928", "timestamp_epoch": "1575414494.321804000" }, { "tcp_stream": 475, "frame_number": 18932, "display_filter": "frame.number == 18932", "timestamp_epoch": "1575414494.325959000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:54.128669+00:00" }, { "observable_id": "observable-8f86f35245a1eb8fbe68a586", "type": "domain", "value": "b.aol.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 53, "frame_number": 7456, "display_filter": "frame.number == 7456", "timestamp_epoch": "1575413253.970345000" }, { "udp_stream": 53, "frame_number": 7467, "display_filter": "frame.number == 7467", "timestamp_epoch": "1575413254.084287000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c1ca62d275d487faa211ad9b", "type": "domain", "value": "b1sync.zemanta.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:44:54.921986+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:54.315186+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 127, "frame_number": 13194, "display_filter": "frame.number == 13194", "timestamp_epoch": "1575413306.152210000" }, { "udp_stream": 127, "frame_number": 13285, "display_filter": "frame.number == 13285", "timestamp_epoch": "1575413306.270237000" }, { "tcp_stream": 367, "frame_number": 13501, "display_filter": "frame.number == 13501", "timestamp_epoch": "1575413306.454402000" }, { "tcp_stream": 368, "frame_number": 13504, "display_filter": "frame.number == 13504", "timestamp_epoch": "1575413306.454572000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:54.308522+00:00" }, { "observable_id": "observable-038baef259648cbfbe4de5ea", "type": "domain", "value": "bankofamerica.tt.omtrdc.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:54.526358+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:54.522517+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 181, "frame_number": 17334, "display_filter": "frame.number == 17334", "timestamp_epoch": "1575414489.089710000" }, { "udp_stream": 181, "frame_number": 17335, "display_filter": "frame.number == 17335", "timestamp_epoch": "1575414489.184029000" }, { "tcp_stream": 451, "frame_number": 17357, "display_filter": "frame.number == 17357", "timestamp_epoch": "1575414489.303501000" }, { "tcp_stream": 452, "frame_number": 17371, "display_filter": "frame.number == 17371", "timestamp_epoch": "1575414489.358157000" }, { "tcp_stream": 480, "frame_number": 19717, "display_filter": "frame.number == 19717", "timestamp_epoch": "1575414520.904583000" }, { "tcp_stream": 479, "frame_number": 19719, "display_filter": "frame.number == 19719", "timestamp_epoch": "1575414520.904656000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:54.517318+00:00" }, { "observable_id": "observable-b976ceb017e63e01812eb3de", "type": "domain", "value": "beap.gemini.yahoo.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:54.699062+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:54.697350+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 51, "frame_number": 7120, "display_filter": "frame.number == 7120", "timestamp_epoch": "1575413252.786071000" }, { "udp_stream": 51, "frame_number": 7139, "display_filter": "frame.number == 7139", "timestamp_epoch": "1575413252.926670000" }, { "tcp_stream": 137, "frame_number": 7185, "display_filter": "frame.number == 7185", "timestamp_epoch": "1575413253.027999000" }, { "tcp_stream": 136, "frame_number": 7201, "display_filter": "frame.number == 7201", "timestamp_epoch": "1575413253.176098000" }, { "tcp_stream": 251, "frame_number": 10489, "display_filter": "frame.number == 10489", "timestamp_epoch": "1575413266.137026000" }, { "tcp_stream": 250, "frame_number": 10491, "display_filter": "frame.number == 10491", "timestamp_epoch": "1575413266.137584000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:54.695268+00:00" }, { "observable_id": "observable-d4ec6f0c3d118ddc963d99e3", "type": "domain", "value": "beap1.cb.g01.yahoodns.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 51, "frame_number": 7139, "display_filter": "frame.number == 7139", "timestamp_epoch": "1575413252.926670000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cef84fa09435bfa8c9436fd8", "type": "domain", "value": "bh.contextweb.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:44:56.288623+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:54.855927+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 16, "frame_number": 13189, "display_filter": "frame.number == 13189", "timestamp_epoch": "1575413306.146694000" }, { "udp_stream": 16, "frame_number": 13337, "display_filter": "frame.number == 13337", "timestamp_epoch": "1575413306.294911000" }, { "tcp_stream": 380, "frame_number": 13547, "display_filter": "frame.number == 13547", "timestamp_epoch": "1575413306.483362000" }, { "tcp_stream": 379, "frame_number": 13553, "display_filter": "frame.number == 13553", "timestamp_epoch": "1575413306.487291000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:54.853543+00:00" }, { "observable_id": "observable-8759cea9cfa68bf20e28efee", "type": "domain", "value": "bm.adentifi.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:54.869581+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:54.865193+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 60, "frame_number": 8002, "display_filter": "frame.number == 8002", "timestamp_epoch": "1575413257.206920000" }, { "udp_stream": 60, "frame_number": 8009, "display_filter": "frame.number == 8009", "timestamp_epoch": "1575413257.314055000" }, { "tcp_stream": 154, "frame_number": 8028, "display_filter": "frame.number == 8028", "timestamp_epoch": "1575413257.408110000" }, { "tcp_stream": 155, "frame_number": 8032, "display_filter": "frame.number == 8032", "timestamp_epoch": "1575413257.416303000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:54.860300+00:00" }, { "observable_id": "observable-1b36a6859ec3d67f91e32b2b", "type": "domain", "value": "boss.bankofamerica.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:55.052847+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:55.048608+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 183, "frame_number": 17339, "display_filter": "frame.number == 17339", "timestamp_epoch": "1575414489.187171000" }, { "udp_stream": 183, "frame_number": 17364, "display_filter": "frame.number == 17364", "timestamp_epoch": "1575414489.352724000" }, { "tcp_stream": 457, "frame_number": 17523, "display_filter": "frame.number == 17523", "timestamp_epoch": "1575414489.714291000" }, { "tcp_stream": 456, "frame_number": 17529, "display_filter": "frame.number == 17529", "timestamp_epoch": "1575414489.714649000" }, { "tcp_stream": 469, "frame_number": 18379, "display_filter": "frame.number == 18379", "timestamp_epoch": "1575414491.316577000" }, { "tcp_stream": 467, "frame_number": 18426, "display_filter": "frame.number == 18426", "timestamp_epoch": "1575414491.356015000" }, { "tcp_stream": 473, "frame_number": 18871, "display_filter": "frame.number == 18871", "timestamp_epoch": "1575414493.185956000" }, { "tcp_stream": 474, "frame_number": 18918, "display_filter": "frame.number == 18918", "timestamp_epoch": "1575414494.140958000" }, { "tcp_stream": 482, "frame_number": 20344, "display_filter": "frame.number == 20344", "timestamp_epoch": "1575414522.899753000" }, { "tcp_stream": 483, "frame_number": 20371, "display_filter": "frame.number == 20371", "timestamp_epoch": "1575414523.032260000" }, { "tcp_stream": 484, "frame_number": 20377, "display_filter": "frame.number == 20377", "timestamp_epoch": "1575414523.032855000" }, { "tcp_stream": 485, "frame_number": 20564, "display_filter": "frame.number == 20564", "timestamp_epoch": "1575414523.405133000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:55.043373+00:00" }, { "observable_id": "observable-cb61d9b74c3ca69303f3895a", "type": "domain", "value": "c.fqtag.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:55.210934+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:55.208790+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 66, "frame_number": 8270, "display_filter": "frame.number == 8270", "timestamp_epoch": "1575413258.607616000" }, { "udp_stream": 66, "frame_number": 8331, "display_filter": "frame.number == 8331", "timestamp_epoch": "1575413258.871609000" }, { "tcp_stream": 174, "frame_number": 8416, "display_filter": "frame.number == 8416", "timestamp_epoch": "1575413259.192038000" }, { "tcp_stream": 175, "frame_number": 8422, "display_filter": "frame.number == 8422", "timestamp_epoch": "1575413259.194025000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:55.206698+00:00" }, { "observable_id": "observable-bf331719c013b37bb9accce6", "type": "domain", "value": "c1.adform.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:44:58.799281+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:55.372513+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 90, "frame_number": 9899, "display_filter": "frame.number == 9899", "timestamp_epoch": "1575413264.539023000" }, { "udp_stream": 90, "frame_number": 9997, "display_filter": "frame.number == 9997", "timestamp_epoch": "1575413264.964593000" }, { "tcp_stream": 244, "frame_number": 10128, "display_filter": "frame.number == 10128", "timestamp_epoch": "1575413265.191805000" }, { "tcp_stream": 243, "frame_number": 10129, "display_filter": "frame.number == 10129", "timestamp_epoch": "1575413265.191850000" }, { "tcp_stream": 343, "frame_number": 13144, "display_filter": "frame.number == 13144", "timestamp_epoch": "1575413306.126314000" }, { "tcp_stream": 344, "frame_number": 13150, "display_filter": "frame.number == 13150", "timestamp_epoch": "1575413306.127107000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:55.367322+00:00" }, { "observable_id": "observable-a69bed8a9cf47e16d0b4c3be", "type": "domain", "value": "casale-match.dotomi.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:55.386346+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:55.381409+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 88, "frame_number": 9897, "display_filter": "frame.number == 9897", "timestamp_epoch": "1575413264.536227000" }, { "udp_stream": 88, "frame_number": 10032, "display_filter": "frame.number == 10032", "timestamp_epoch": "1575413265.132382000" }, { "tcp_stream": 246, "frame_number": 10141, "display_filter": "frame.number == 10141", "timestamp_epoch": "1575413265.311628000" }, { "tcp_stream": 245, "frame_number": 10145, "display_filter": "frame.number == 10145", "timestamp_epoch": "1575413265.320884000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:55.376941+00:00" }, { "observable_id": "observable-23f25314663154b353843685", "type": "domain", "value": "cdn.fqtag.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:55.568360+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:55.563271+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 68, "frame_number": 8601, "display_filter": "frame.number == 8601", "timestamp_epoch": "1575413260.162620000" }, { "udp_stream": 68, "frame_number": 8643, "display_filter": "frame.number == 8643", "timestamp_epoch": "1575413260.379428000" }, { "tcp_stream": 183, "frame_number": 8673, "display_filter": "frame.number == 8673", "timestamp_epoch": "1575413260.523537000" }, { "tcp_stream": 184, "frame_number": 8677, "display_filter": "frame.number == 8677", "timestamp_epoch": "1575413260.524660000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:55.556993+00:00" }, { "observable_id": "observable-50321f90b882642588797dae", "type": "domain", "value": "cm.adgrx.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:55.750716+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:55.746774+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 91, "frame_number": 9900, "display_filter": "frame.number == 9900", "timestamp_epoch": "1575413264.539552000" }, { "udp_stream": 91, "frame_number": 9990, "display_filter": "frame.number == 9990", "timestamp_epoch": "1575413264.924248000" }, { "tcp_stream": 241, "frame_number": 10127, "display_filter": "frame.number == 10127", "timestamp_epoch": "1575413265.191748000" }, { "tcp_stream": 242, "frame_number": 10131, "display_filter": "frame.number == 10131", "timestamp_epoch": "1575413265.191985000" }, { "tcp_stream": 346, "frame_number": 13147, "display_filter": "frame.number == 13147", "timestamp_epoch": "1575413306.126851000" }, { "tcp_stream": 345, "frame_number": 13155, "display_filter": "frame.number == 13155", "timestamp_epoch": "1575413306.127361000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:55.742017+00:00" }, { "observable_id": "observable-f1030a7ae8cc443f76affadf", "type": "domain", "value": "cm.eyereturn.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:56.146510+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:56.141153+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 89, "frame_number": 9898, "display_filter": "frame.number == 9898", "timestamp_epoch": "1575413264.537914000" }, { "udp_stream": 89, "frame_number": 9979, "display_filter": "frame.number == 9979", "timestamp_epoch": "1575413264.894068000" }, { "tcp_stream": 235, "frame_number": 10045, "display_filter": "frame.number == 10045", "timestamp_epoch": "1575413265.135568000" }, { "tcp_stream": 236, "frame_number": 10048, "display_filter": "frame.number == 10048", "timestamp_epoch": "1575413265.135802000" }, { "tcp_stream": 355, "frame_number": 13296, "display_filter": "frame.number == 13296", "timestamp_epoch": "1575413306.272502000" }, { "tcp_stream": 356, "frame_number": 13304, "display_filter": "frame.number == 13304", "timestamp_epoch": "1575413306.274331000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:56.135071+00:00" }, { "observable_id": "observable-46011bfd52503a3760f74fcb", "type": "domain", "value": "cm.g.doubleclick.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:13.189219+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:56.325893+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 72, "frame_number": 9281, "display_filter": "frame.number == 9281", "timestamp_epoch": "1575413262.562854000" }, { "udp_stream": 72, "frame_number": 9322, "display_filter": "frame.number == 9322", "timestamp_epoch": "1575413262.643180000" }, { "tcp_stream": 201, "frame_number": 9377, "display_filter": "frame.number == 9377", "timestamp_epoch": "1575413262.735404000" }, { "tcp_stream": 200, "frame_number": 9378, "display_filter": "frame.number == 9378", "timestamp_epoch": "1575413262.735505000" }, { "tcp_stream": 202, "frame_number": 9380, "display_filter": "frame.number == 9380", "timestamp_epoch": "1575413262.735796000" }, { "tcp_stream": 199, "frame_number": 9387, "display_filter": "frame.number == 9387", "timestamp_epoch": "1575413262.740925000" }, { "tcp_stream": 305, "frame_number": 12660, "display_filter": "frame.number == 12660", "timestamp_epoch": "1575413305.241743000" }, { "tcp_stream": 306, "frame_number": 12669, "display_filter": "frame.number == 12669", "timestamp_epoch": "1575413305.253240000" }, { "tcp_stream": 311, "frame_number": 12680, "display_filter": "frame.number == 12680", "timestamp_epoch": "1575413305.257120000" }, { "tcp_stream": 312, "frame_number": 12682, "display_filter": "frame.number == 12682", "timestamp_epoch": "1575413305.257257000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:56.322809+00:00" }, { "observable_id": "observable-c7bf9faa2bd18f146295e7f0", "type": "domain", "value": "cms.analytics.yahoo.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:56.335590+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:56.332740+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 28, "frame_number": 1598, "display_filter": "frame.number == 1598", "timestamp_epoch": "1575413164.774429000" }, { "udp_stream": 28, "frame_number": 2213, "display_filter": "frame.number == 2213", "timestamp_epoch": "1575413165.783856000" }, { "udp_stream": 28, "frame_number": 2224, "display_filter": "frame.number == 2224", "timestamp_epoch": "1575413165.993066000" }, { "tcp_stream": 55, "frame_number": 2455, "display_filter": "frame.number == 2455", "timestamp_epoch": "1575413166.367879000" }, { "tcp_stream": 60, "frame_number": 2480, "display_filter": "frame.number == 2480", "timestamp_epoch": "1575413166.410412000" }, { "tcp_stream": 61, "frame_number": 2484, "display_filter": "frame.number == 2484", "timestamp_epoch": "1575413166.410679000" }, { "tcp_stream": 56, "frame_number": 2488, "display_filter": "frame.number == 2488", "timestamp_epoch": "1575413166.411517000" }, { "tcp_stream": 59, "frame_number": 2492, "display_filter": "frame.number == 2492", "timestamp_epoch": "1575413166.413832000" }, { "tcp_stream": 83, "frame_number": 3537, "display_filter": "frame.number == 3537", "timestamp_epoch": "1575413212.376817000" }, { "tcp_stream": 84, "frame_number": 3541, "display_filter": "frame.number == 3541", "timestamp_epoch": "1575413212.385880000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:56.329945+00:00" }, { "observable_id": "observable-8103ffcc03f19ff3a50a4176", "type": "domain", "value": "consent.cmp.oath.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:56.496007+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:56.494327+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 42, "frame_number": 4183, "display_filter": "frame.number == 4183", "timestamp_epoch": "1575413244.536843000" }, { "udp_stream": 42, "frame_number": 4187, "display_filter": "frame.number == 4187", "timestamp_epoch": "1575413244.607312000" }, { "tcp_stream": 105, "frame_number": 4198, "display_filter": "frame.number == 4198", "timestamp_epoch": "1575413244.664431000" }, { "tcp_stream": 104, "frame_number": 4199, "display_filter": "frame.number == 4199", "timestamp_epoch": "1575413244.664515000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:56.492236+00:00" }, { "observable_id": "observable-4a61cad65fdd3e0ae078fef3", "type": "domain", "value": "cookie.brealtime.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:56.659170+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:56.656821+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 125, "frame_number": 13190, "display_filter": "frame.number == 13190", "timestamp_epoch": "1575413306.147638000" }, { "udp_stream": 125, "frame_number": 13293, "display_filter": "frame.number == 13293", "timestamp_epoch": "1575413306.272141000" }, { "tcp_stream": 372, "frame_number": 13448, "display_filter": "frame.number == 13448", "timestamp_epoch": "1575413306.423610000" }, { "tcp_stream": 371, "frame_number": 13449, "display_filter": "frame.number == 13449", "timestamp_epoch": "1575413306.423688000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:56.654562+00:00" }, { "observable_id": "observable-818b6c2a14fc32e6d1470743", "type": "domain", "value": "cookie.brealtime.com.cdn.cloudflare.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 125, "frame_number": 13293, "display_filter": "frame.number == 13293", "timestamp_epoch": "1575413306.272141000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0fe3eeefc5b698a1867ce9ac", "type": "domain", "value": "crt.usertrust.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:56.840518+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:56.836089+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 94, "frame_number": 10413, "display_filter": "frame.number == 10413", "timestamp_epoch": "1575413265.792188000" }, { "udp_stream": 95, "frame_number": 10468, "display_filter": "frame.number == 10468", "timestamp_epoch": "1575413265.946223000" }, { "udp_stream": 95, "frame_number": 10536, "display_filter": "frame.number == 10536", "timestamp_epoch": "1575413266.379001000" }, { "udp_stream": 94, "frame_number": 10537, "display_filter": "frame.number == 10537", "timestamp_epoch": "1575413266.379122000" }, { "tcp_stream": 254, "frame_number": 10625, "display_filter": "frame.number == 10625", "timestamp_epoch": "1575413266.902247000" }, { "tcp_stream": 253, "frame_number": 10629, "display_filter": "frame.number == 10629", "timestamp_epoch": "1575413266.906579000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:56.830067+00:00" }, { "observable_id": "observable-b393cabf8c39bb0b7ae01658", "type": "domain", "value": "cs550162656.adn.psicdn.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 42, "frame_number": 4187, "display_filter": "frame.number == 4187", "timestamp_epoch": "1575413244.607312000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3421a4258340df2b859d932d", "type": "domain", "value": "cs629.wpc.lambdacdn.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 41, "frame_number": 4184, "display_filter": "frame.number == 4184", "timestamp_epoch": "1575413244.602338000" }, { "udp_stream": 47, "frame_number": 5418, "display_filter": "frame.number == 5418", "timestamp_epoch": "1575413248.467142000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6eb5e7cab184e062405555c2", "type": "domain", "value": "cs737157920.wpc.omicroncdn.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 46, "frame_number": 5225, "display_filter": "frame.number == 5225", "timestamp_epoch": "1575413248.059796000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e62e9cb95d32767f234e4f76", "type": "domain", "value": "cs747173190.wac.omegacdn.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 21, "frame_number": 929, "display_filter": "frame.number == 929", "timestamp_epoch": "1575413162.912621000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-417bd4be1e243993c77e60aa", "type": "domain", "value": "csm2waycm-atl.netmng.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:57.041095+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:57.034868+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 118, "frame_number": 13021, "display_filter": "frame.number == 13021", "timestamp_epoch": "1575413305.963396000" }, { "udp_stream": 118, "frame_number": 13081, "display_filter": "frame.number == 13081", "timestamp_epoch": "1575413306.074332000" }, { "tcp_stream": 348, "frame_number": 13206, "display_filter": "frame.number == 13206", "timestamp_epoch": "1575413306.180173000" }, { "tcp_stream": 349, "frame_number": 13219, "display_filter": "frame.number == 13219", "timestamp_epoch": "1575413306.186794000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:57.027899+00:00" }, { "observable_id": "observable-52ce2be832fd6d42a90b521b", "type": "domain", "value": "d.adroll.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:57.254705+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:57.249857+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 119, "frame_number": 13023, "display_filter": "frame.number == 13023", "timestamp_epoch": "1575413305.964081000" }, { "udp_stream": 119, "frame_number": 13113, "display_filter": "frame.number == 13113", "timestamp_epoch": "1575413306.103126000" }, { "tcp_stream": 351, "frame_number": 13252, "display_filter": "frame.number == 13252", "timestamp_epoch": "1575413306.241473000" }, { "tcp_stream": 352, "frame_number": 13258, "display_filter": "frame.number == 13258", "timestamp_epoch": "1575413306.242423000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:57.245227+00:00" }, { "observable_id": "observable-350d9ade5f63dd6a90cfba17", "type": "domain", "value": "d.agkn.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:57.450959+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:57.446437+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 64, "frame_number": 8117, "display_filter": "frame.number == 8117", "timestamp_epoch": "1575413258.171519000" }, { "udp_stream": 64, "frame_number": 8202, "display_filter": "frame.number == 8202", "timestamp_epoch": "1575413258.371041000" }, { "tcp_stream": 162, "frame_number": 8232, "display_filter": "frame.number == 8232", "timestamp_epoch": "1575413258.496034000" }, { "tcp_stream": 163, "frame_number": 8234, "display_filter": "frame.number == 8234", "timestamp_epoch": "1575413258.496358000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:57.441511+00:00" }, { "observable_id": "observable-dcb174a46072ed1d25a4c118", "type": "domain", "value": "d2u28gf9o4d1cv.cloudfront.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 32, "frame_number": 2663, "display_filter": "frame.number == 2663", "timestamp_epoch": "1575413167.216789000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3184e9db19c8f57710aaeac3", "type": "domain", "value": "dart.l.doubleclick.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 23, "frame_number": 1069, "display_filter": "frame.number == 1069", "timestamp_epoch": "1575413163.198550000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f7bd17f3a585e0914a85f683", "type": "domain", "value": "data.coremetrics.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:57.629821+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:57.627662+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 187, "frame_number": 17999, "display_filter": "frame.number == 17999", "timestamp_epoch": "1575414490.527327000" }, { "udp_stream": 187, "frame_number": 18068, "display_filter": "frame.number == 18068", "timestamp_epoch": "1575414490.617736000" }, { "tcp_stream": 465, "frame_number": 18073, "display_filter": "frame.number == 18073", "timestamp_epoch": "1575414490.719140000" }, { "tcp_stream": 466, "frame_number": 18077, "display_filter": "frame.number == 18077", "timestamp_epoch": "1575414490.735364000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:57.625235+00:00" }, { "observable_id": "observable-56be77e2df29fdc0d8032c2e", "type": "domain", "value": "dis.criteo.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:57.955315+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:57.952644+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 100, "frame_number": 10786, "display_filter": "frame.number == 10786", "timestamp_epoch": "1575413267.654094000" }, { "udp_stream": 100, "frame_number": 10847, "display_filter": "frame.number == 10847", "timestamp_epoch": "1575413267.948443000" }, { "tcp_stream": 263, "frame_number": 10948, "display_filter": "frame.number == 10948", "timestamp_epoch": "1575413268.290123000" }, { "tcp_stream": 262, "frame_number": 10949, "display_filter": "frame.number == 10949", "timestamp_epoch": "1575413268.290174000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:57.949275+00:00" }, { "observable_id": "observable-83e41d6fecaa1c13e303a5cb", "type": "domain", "value": "dns.msftncsi.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 2, "frame_number": 253, "display_filter": "frame.number == 253", "timestamp_epoch": "1575413123.292845000" }, { "udp_stream": 2, "frame_number": 257, "display_filter": "frame.number == 257", "timestamp_epoch": "1575413123.352446000" }, { "udp_stream": 3, "frame_number": 258, "display_filter": "frame.number == 258", "timestamp_epoch": "1575413123.353131000" }, { "udp_stream": 3, "frame_number": 259, "display_filter": "frame.number == 259", "timestamp_epoch": "1575413123.412011000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-bf737cad0145f495bcd81fc1", "type": "domain", "value": "dpm.demdex.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:16.880908+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:58.124800+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 33, "frame_number": 2677, "display_filter": "frame.number == 2677", "timestamp_epoch": "1575413167.227450000" }, { "udp_stream": 33, "frame_number": 2703, "display_filter": "frame.number == 2703", "timestamp_epoch": "1575413167.311200000" }, { "tcp_stream": 70, "frame_number": 2763, "display_filter": "frame.number == 2763", "timestamp_epoch": "1575413167.452950000" }, { "tcp_stream": 71, "frame_number": 2777, "display_filter": "frame.number == 2777", "timestamp_epoch": "1575413167.476096000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:58.122213+00:00" }, { "observable_id": "observable-b3153640c0257552655d2e35", "type": "domain", "value": "ds-ats.member.g02.yahoodns.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 6, "frame_number": 308, "display_filter": "frame.number == 308", "timestamp_epoch": "1575413156.734046000" }, { "udp_stream": 7, "frame_number": 352, "display_filter": "frame.number == 352", "timestamp_epoch": "1575413157.278971000" }, { "udp_stream": 8, "frame_number": 399, "display_filter": "frame.number == 399", "timestamp_epoch": "1575413157.843186000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9c9e3d5802dc8e59bcdf0cad", "type": "domain", "value": "ds-geoycpi-uno-lite.gycpi.b.yahoodns.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 16, "frame_number": 644, "display_filter": "frame.number == 644", "timestamp_epoch": "1575413160.441484000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7b4183146e956ccd740a213e", "type": "domain", "value": "ds-pr-bh.ybp.gysm.yahoodns.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 83, "frame_number": 9810, "display_filter": "frame.number == 9810", "timestamp_epoch": "1575413264.126151000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8b05266a91b50044a75389a9", "type": "domain", "value": "dsum-sec.casalemedia.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:17.077543+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:58.128722+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 93, "frame_number": 9973, "display_filter": "frame.number == 9973", "timestamp_epoch": "1575413264.829744000" }, { "udp_stream": 93, "frame_number": 10059, "display_filter": "frame.number == 10059", "timestamp_epoch": "1575413265.173234000" }, { "tcp_stream": 247, "frame_number": 10196, "display_filter": "frame.number == 10196", "timestamp_epoch": "1575413265.403229000" }, { "tcp_stream": 248, "frame_number": 10197, "display_filter": "frame.number == 10197", "timestamp_epoch": "1575413265.403332000" }, { "tcp_stream": 249, "frame_number": 10198, "display_filter": "frame.number == 10198", "timestamp_epoch": "1575413265.403378000" }, { "tcp_stream": 252, "frame_number": 10597, "display_filter": "frame.number == 10597", "timestamp_epoch": "1575413266.750929000" }, { "tcp_stream": 255, "frame_number": 10656, "display_filter": "frame.number == 10656", "timestamp_epoch": "1575413267.132409000" }, { "tcp_stream": 387, "frame_number": 13888, "display_filter": "frame.number == 13888", "timestamp_epoch": "1575413306.996081000" }, { "tcp_stream": 388, "frame_number": 13896, "display_filter": "frame.number == 13896", "timestamp_epoch": "1575413307.000043000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:58.126748+00:00" }, { "observable_id": "observable-bd067b2162665756a56b4dd6", "type": "domain", "value": "dsum.casalemedia.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:58.133919+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:58.132275+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 111, "frame_number": 11021, "display_filter": "frame.number == 11021", "timestamp_epoch": "1575413268.446252000" }, { "udp_stream": 111, "frame_number": 11250, "display_filter": "frame.number == 11250", "timestamp_epoch": "1575413268.813668000" }, { "tcp_stream": 289, "frame_number": 11388, "display_filter": "frame.number == 11388", "timestamp_epoch": "1575413269.029328000" }, { "tcp_stream": 288, "frame_number": 11389, "display_filter": "frame.number == 11389", "timestamp_epoch": "1575413269.029388000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:58.130513+00:00" }, { "observable_id": "observable-c7ebc047f69e57cd24c7da2c", "type": "domain", "value": "dull.bankofamerica.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:58.301738+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:58.297342+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 184, "frame_number": 17340, "display_filter": "frame.number == 17340", "timestamp_epoch": "1575414489.188976000" }, { "udp_stream": 184, "frame_number": 17359, "display_filter": "frame.number == 17359", "timestamp_epoch": "1575414489.334625000" }, { "tcp_stream": 454, "frame_number": 17501, "display_filter": "frame.number == 17501", "timestamp_epoch": "1575414489.707149000" }, { "tcp_stream": 453, "frame_number": 17503, "display_filter": "frame.number == 17503", "timestamp_epoch": "1575414489.707359000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:58.292227+00:00" }, { "observable_id": "observable-d4113795a6a2a978fbcd7b50", "type": "domain", "value": "dxedge-prod-lb-946522505.us-east-1.elb.amazonaws.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 87, "frame_number": 9974, "display_filter": "frame.number == 9974", "timestamp_epoch": "1575413264.859950000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1229bafb89b93202ef52171f", "type": "domain", "value": "e.serverbid.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:58.484067+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:58.477158+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 128, "frame_number": 13195, "display_filter": "frame.number == 13195", "timestamp_epoch": "1575413306.154087000" }, { "udp_stream": 128, "frame_number": 13344, "display_filter": "frame.number == 13344", "timestamp_epoch": "1575413306.297988000" }, { "tcp_stream": 382, "frame_number": 13579, "display_filter": "frame.number == 13579", "timestamp_epoch": "1575413306.525415000" }, { "tcp_stream": 381, "frame_number": 13580, "display_filter": "frame.number == 13580", "timestamp_epoch": "1575413306.525493000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:58.471022+00:00" }, { "observable_id": "observable-b2b225d7a6b7b93ef4a92429", "type": "domain", "value": "edge.gycpi.b.yahoodns.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 9, "frame_number": 504, "display_filter": "frame.number == 504", "timestamp_epoch": "1575413158.967341000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-87d9ff28dbda0d49f0d80215", "type": "domain", "value": "f2.taboola.map.fastly.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 123, "frame_number": 13306, "display_filter": "frame.number == 13306", "timestamp_epoch": "1575413306.288790000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-bbd402ee2a64ad4dbe35ff11", "type": "domain", "value": "fam-geo-atsv2.prod.media.g03.yahoodns.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 17, "frame_number": 647, "display_filter": "frame.number == 647", "timestamp_epoch": "1575413160.623478000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0e0896daeedefb950896f7fd", "type": "domain", "value": "fc.yahoo.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:58.680101+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:58.673713+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 18, "frame_number": 641, "display_filter": "frame.number == 641", "timestamp_epoch": "1575413160.335721000" }, { "udp_stream": 18, "frame_number": 648, "display_filter": "frame.number == 648", "timestamp_epoch": "1575413160.623583000" }, { "tcp_stream": 37, "frame_number": 662, "display_filter": "frame.number == 662", "timestamp_epoch": "1575413160.952787000" }, { "tcp_stream": 35, "frame_number": 675, "display_filter": "frame.number == 675", "timestamp_epoch": "1575413160.953563000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:58.669117+00:00" }, { "observable_id": "observable-9bb57fe7b0daff63be7c20b0", "type": "domain", "value": "fo-fd-world-new.yax.gysm.yahoodns.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 69, "frame_number": 8646, "display_filter": "frame.number == 8646", "timestamp_epoch": "1575413260.432992000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1ecd2bb276a8fe143e19fe49", "type": "domain", "value": "fonts.googleapis.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:19.818148+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:58.858280+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 65, "frame_number": 8238, "display_filter": "frame.number == 8238", "timestamp_epoch": "1575413258.535495000" }, { "udp_stream": 65, "frame_number": 8315, "display_filter": "frame.number == 8315", "timestamp_epoch": "1575413258.762246000" }, { "tcp_stream": 173, "frame_number": 8390, "display_filter": "frame.number == 8390", "timestamp_epoch": "1575413259.082074000" }, { "tcp_stream": 172, "frame_number": 8392, "display_filter": "frame.number == 8392", "timestamp_epoch": "1575413259.082670000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:58.856222+00:00" }, { "observable_id": "observable-a101666ba0044e36e8f06d55", "type": "domain", "value": "fonts.gstatic.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:19.985832+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:58.861777+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 67, "frame_number": 8582, "display_filter": "frame.number == 8582", "timestamp_epoch": "1575413259.995926000" }, { "udp_stream": 67, "frame_number": 8615, "display_filter": "frame.number == 8615", "timestamp_epoch": "1575413260.271166000" }, { "tcp_stream": 180, "frame_number": 8659, "display_filter": "frame.number == 8659", "timestamp_epoch": "1575413260.503407000" }, { "tcp_stream": 178, "frame_number": 8660, "display_filter": "frame.number == 8660", "timestamp_epoch": "1575413260.503755000" }, { "tcp_stream": 181, "frame_number": 8663, "display_filter": "frame.number == 8663", "timestamp_epoch": "1575413260.504466000" }, { "tcp_stream": 179, "frame_number": 8665, "display_filter": "frame.number == 8665", "timestamp_epoch": "1575413260.504684000" }, { "tcp_stream": 182, "frame_number": 8669, "display_filter": "frame.number == 8669", "timestamp_epoch": "1575413260.507679000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:58.860097+00:00" }, { "observable_id": "observable-21b25939081833ab55750753", "type": "domain", "value": "geo.moatads.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:58.866862+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:58.865329+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 26, "frame_number": 1430, "display_filter": "frame.number == 1430", "timestamp_epoch": "1575413164.247294000" }, { "udp_stream": 26, "frame_number": 2059, "display_filter": "frame.number == 2059", "timestamp_epoch": "1575413165.536404000" }, { "udp_stream": 26, "frame_number": 2223, "display_filter": "frame.number == 2223", "timestamp_epoch": "1575413165.992964000" }, { "tcp_stream": 57, "frame_number": 2472, "display_filter": "frame.number == 2472", "timestamp_epoch": "1575413166.399229000" }, { "tcp_stream": 58, "frame_number": 2474, "display_filter": "frame.number == 2474", "timestamp_epoch": "1575413166.399383000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:58.863620+00:00" }, { "observable_id": "observable-433a641dc351a0c326074469", "type": "domain", "value": "geo.yahoo.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:59.453383+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:59.450643+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 17, "frame_number": 640, "display_filter": "frame.number == 640", "timestamp_epoch": "1575413160.316417000" }, { "udp_stream": 17, "frame_number": 647, "display_filter": "frame.number == 647", "timestamp_epoch": "1575413160.623478000" }, { "tcp_stream": 36, "frame_number": 678, "display_filter": "frame.number == 678", "timestamp_epoch": "1575413160.953856000" }, { "tcp_stream": 38, "frame_number": 680, "display_filter": "frame.number == 680", "timestamp_epoch": "1575413160.953961000" }, { "tcp_stream": 72, "frame_number": 2896, "display_filter": "frame.number == 2896", "timestamp_epoch": "1575413185.224964000" }, { "tcp_stream": 73, "frame_number": 2900, "display_filter": "frame.number == 2900", "timestamp_epoch": "1575413185.235960000" }, { "tcp_stream": 87, "frame_number": 3613, "display_filter": "frame.number == 3613", "timestamp_epoch": "1575413213.214158000" }, { "tcp_stream": 90, "frame_number": 3754, "display_filter": "frame.number == 3754", "timestamp_epoch": "1575413237.455051000" }, { "tcp_stream": 91, "frame_number": 3758, "display_filter": "frame.number == 3758", "timestamp_epoch": "1575413237.465842000" }, { "tcp_stream": 128, "frame_number": 6544, "display_filter": "frame.number == 6544", "timestamp_epoch": "1575413250.119831000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:59.447511+00:00" }, { "observable_id": "observable-bef060f14df6552cf2a8ef88", "type": "domain", "value": "geoycpi-uno.gycpi.b.yahoodns.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 4, "frame_number": 276, "display_filter": "frame.number == 276", "timestamp_epoch": "1575413155.227694000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d644a63266e91fd324da5b44", "type": "domain", "value": "go.microsoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:22.062012+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:59.628056+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 117, "frame_number": 12700, "display_filter": "frame.number == 12700", "timestamp_epoch": "1575413305.285884000" }, { "udp_stream": 117, "frame_number": 12826, "display_filter": "frame.number == 12826", "timestamp_epoch": "1575413305.449366000" }, { "tcp_stream": 329, "frame_number": 12951, "display_filter": "frame.number == 12951", "timestamp_epoch": "1575413305.661450000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:59.621308+00:00" }, { "observable_id": "observable-b435ca743935f6703dad9358", "type": "domain", "value": "googleads.g.doubleclick.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:42.522371+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:59.638624+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 74, "frame_number": 9288, "display_filter": "frame.number == 9288", "timestamp_epoch": "1575413262.571454000" }, { "udp_stream": 74, "frame_number": 9306, "display_filter": "frame.number == 9306", "timestamp_epoch": "1575413262.640954000" }, { "tcp_stream": 195, "frame_number": 9367, "display_filter": "frame.number == 9367", "timestamp_epoch": "1575413262.720347000" }, { "tcp_stream": 197, "frame_number": 9379, "display_filter": "frame.number == 9379", "timestamp_epoch": "1575413262.735724000" }, { "tcp_stream": 309, "frame_number": 12668, "display_filter": "frame.number == 12668", "timestamp_epoch": "1575413305.253173000" }, { "tcp_stream": 310, "frame_number": 12677, "display_filter": "frame.number == 12677", "timestamp_epoch": "1575413305.256655000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:59.634081+00:00" }, { "observable_id": "observable-f2151bfd24e041600180e837", "type": "domain", "value": "googleads4.g.doubleclick.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:59.656743+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:59.651936+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 63, "frame_number": 8116, "display_filter": "frame.number == 8116", "timestamp_epoch": "1575413258.171271000" }, { "udp_stream": 63, "frame_number": 8199, "display_filter": "frame.number == 8199", "timestamp_epoch": "1575413258.370803000" }, { "tcp_stream": 161, "frame_number": 8224, "display_filter": "frame.number == 8224", "timestamp_epoch": "1575413258.484254000" }, { "tcp_stream": 160, "frame_number": 8236, "display_filter": "frame.number == 8236", "timestamp_epoch": "1575413258.496522000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:59.645200+00:00" }, { "observable_id": "observable-d75c164547da339fe492938b", "type": "domain", "value": "gstaticadssl.l.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 67, "frame_number": 8615, "display_filter": "frame.number == 8615", "timestamp_epoch": "1575413260.271166000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a0f4a132ff9c49af306eca47", "type": "domain", "value": "guce.advertising.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:59.846102+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:59.841828+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 40, "frame_number": 3836, "display_filter": "frame.number == 3836", "timestamp_epoch": "1575413238.467239000" }, { "udp_stream": 40, "frame_number": 3837, "display_filter": "frame.number == 3837", "timestamp_epoch": "1575413238.558263000" }, { "tcp_stream": 94, "frame_number": 3844, "display_filter": "frame.number == 3844", "timestamp_epoch": "1575413238.657727000" }, { "tcp_stream": 95, "frame_number": 3845, "display_filter": "frame.number == 3845", "timestamp_epoch": "1575413238.657823000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:59.836123+00:00" }, { "observable_id": "observable-4f087341ffe14e5fdcf290ad", "type": "domain", "value": "guce.aol.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:00.015656+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:00.013862+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 39, "frame_number": 3794, "display_filter": "frame.number == 3794", "timestamp_epoch": "1575413237.817285000" }, { "udp_stream": 39, "frame_number": 3795, "display_filter": "frame.number == 3795", "timestamp_epoch": "1575413237.897960000" }, { "tcp_stream": 92, "frame_number": 3800, "display_filter": "frame.number == 3800", "timestamp_epoch": "1575413237.982876000" }, { "tcp_stream": 93, "frame_number": 3804, "display_filter": "frame.number == 3804", "timestamp_epoch": "1575413237.989740000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:46:00.011745+00:00" }, { "observable_id": "observable-23fcbd1b6899af2fa0be7f69", "type": "domain", "value": "gxp2.mail.aol.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:00.208923+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:00.206473+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 43, "frame_number": 4873, "display_filter": "frame.number == 4873", "timestamp_epoch": "1575413246.231562000" }, { "udp_stream": 43, "frame_number": 4892, "display_filter": "frame.number == 4892", "timestamp_epoch": "1575413246.304051000" }, { "tcp_stream": 110, "frame_number": 4947, "display_filter": "frame.number == 4947", "timestamp_epoch": "1575413246.523761000" }, { "tcp_stream": 109, "frame_number": 4949, "display_filter": "frame.number == 4949", "timestamp_epoch": "1575413246.524008000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:46:00.203906+00:00" }, { "observable_id": "observable-31893647f5c0c7cc982f3a76", "type": "domain", "value": "h1.wensa.at", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:51.651368+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:51.649457+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 159, "frame_number": 16148, "display_filter": "frame.number == 16148", "timestamp_epoch": "1575413455.165434000" }, { "udp_stream": 159, "frame_number": 16149, "display_filter": "frame.number == 16149", "timestamp_epoch": "1575413455.357740000" }, { "udp_stream": 160, "frame_number": 16159, "display_filter": "frame.number == 16159", "timestamp_epoch": "1575413456.141997000" }, { "udp_stream": 160, "frame_number": 16160, "display_filter": "frame.number == 16160", "timestamp_epoch": "1575413456.425216000" }, { "udp_stream": 161, "frame_number": 16178, "display_filter": "frame.number == 16178", "timestamp_epoch": "1575413457.348260000" }, { "udp_stream": 161, "frame_number": 16179, "display_filter": "frame.number == 16179", "timestamp_epoch": "1575413457.526856000" }, { "udp_stream": 162, "frame_number": 16195, "display_filter": "frame.number == 16195", "timestamp_epoch": "1575413468.491491000" }, { "udp_stream": 162, "frame_number": 16196, "display_filter": "frame.number == 16196", "timestamp_epoch": "1575413468.760703000" }, { "udp_stream": 163, "frame_number": 16208, "display_filter": "frame.number == 16208", "timestamp_epoch": "1575413469.615843000" }, { "udp_stream": 163, "frame_number": 16209, "display_filter": "frame.number == 16209", "timestamp_epoch": "1575413469.819055000" }, { "udp_stream": 164, "frame_number": 16308, "display_filter": "frame.number == 16308", "timestamp_epoch": "1575413756.153041000" }, { "udp_stream": 164, "frame_number": 16309, "display_filter": "frame.number == 16309", "timestamp_epoch": "1575413756.347599000" }, { "udp_stream": 165, "frame_number": 16431, "display_filter": "frame.number == 16431", "timestamp_epoch": "1575414056.144786000" }, { "udp_stream": 165, "frame_number": 16432, "display_filter": "frame.number == 16432", "timestamp_epoch": "1575414056.349092000" }, { "udp_stream": 166, "frame_number": 16442, "display_filter": "frame.number == 16442", "timestamp_epoch": "1575414057.220629000" }, { "udp_stream": 166, "frame_number": 16443, "display_filter": "frame.number == 16443", "timestamp_epoch": "1575414057.413839000" }, { "udp_stream": 168, "frame_number": 16486, "display_filter": "frame.number == 16486", "timestamp_epoch": "1575414357.231323000" }, { "udp_stream": 168, "frame_number": 16487, "display_filter": "frame.number == 16487", "timestamp_epoch": "1575414357.417756000" }, { "udp_stream": 190, "frame_number": 21098, "display_filter": "frame.number == 21098", "timestamp_epoch": "1575414657.235731000" }, { "udp_stream": 190, "frame_number": 21099, "display_filter": "frame.number == 21099", "timestamp_epoch": "1575414657.443819000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:51.646294+00:00" }, { "observable_id": "observable-43d502761133c22bac0209b2", "type": "domain", "value": "ib.adnxs.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:00.414704+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:00.412045+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 81, "frame_number": 9295, "display_filter": "frame.number == 9295", "timestamp_epoch": "1575413262.589105000" }, { "udp_stream": 81, "frame_number": 9344, "display_filter": "frame.number == 9344", "timestamp_epoch": "1575413262.653946000" }, { "tcp_stream": 211, "frame_number": 9439, "display_filter": "frame.number == 9439", "timestamp_epoch": "1575413262.854389000" }, { "tcp_stream": 212, "frame_number": 9445, "display_filter": "frame.number == 9445", "timestamp_epoch": "1575413262.859437000" }, { "tcp_stream": 324, "frame_number": 12745, "display_filter": "frame.number == 12745", "timestamp_epoch": "1575413305.323450000" }, { "tcp_stream": 323, "frame_number": 12747, "display_filter": "frame.number == 12747", "timestamp_epoch": "1575413305.323625000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:46:00.409307+00:00" }, { "observable_id": "observable-a04182d0a119c4e17be36885", "type": "domain", "value": "iecvlist.microsoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:00.584505+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:00.581826+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 34, "frame_number": 2890, "display_filter": "frame.number == 2890", "timestamp_epoch": "1575413185.149414000" }, { "udp_stream": 34, "frame_number": 2902, "display_filter": "frame.number == 2902", "timestamp_epoch": "1575413185.249277000" }, { "tcp_stream": 74, "frame_number": 2909, "display_filter": "frame.number == 2909", "timestamp_epoch": "1575413185.320300000" }, { "tcp_stream": 77, "frame_number": 3030, "display_filter": "frame.number == 3030", "timestamp_epoch": "1575413185.747908000" }, { "tcp_stream": 78, "frame_number": 3032, "display_filter": "frame.number == 3032", "timestamp_epoch": "1575413185.748739000" }, { "tcp_stream": 477, "frame_number": 19408, "display_filter": "frame.number == 19408", "timestamp_epoch": "1575414513.780707000" }, { "tcp_stream": 478, "frame_number": 19410, "display_filter": "frame.number == 19410", "timestamp_epoch": "1575414513.781170000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:46:00.579099+00:00" }, { "observable_id": "observable-05ef48696bde9d3fec6089a7", "type": "domain", "value": "image2.pubmatic.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:00.767630+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:00.765133+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 108, "frame_number": 10829, "display_filter": "frame.number == 10829", "timestamp_epoch": "1575413267.830137000" }, { "udp_stream": 108, "frame_number": 10910, "display_filter": "frame.number == 10910", "timestamp_epoch": "1575413268.262916000" }, { "tcp_stream": 276, "frame_number": 11032, "display_filter": "frame.number == 11032", "timestamp_epoch": "1575413268.463232000" }, { "tcp_stream": 277, "frame_number": 11048, "display_filter": "frame.number == 11048", "timestamp_epoch": "1575413268.492173000" }, { "tcp_stream": 278, "frame_number": 11051, "display_filter": "frame.number == 11051", "timestamp_epoch": "1575413268.492523000" }, { "tcp_stream": 285, "frame_number": 11192, "display_filter": "frame.number == 11192", "timestamp_epoch": "1575413268.636080000" }, { "tcp_stream": 291, "frame_number": 11515, "display_filter": "frame.number == 11515", "timestamp_epoch": "1575413269.531034000" }, { "tcp_stream": 293, "frame_number": 11558, "display_filter": "frame.number == 11558", "timestamp_epoch": "1575413269.719299000" }, { "tcp_stream": 389, "frame_number": 13985, "display_filter": "frame.number == 13985", "timestamp_epoch": "1575413307.174430000" }, { "tcp_stream": 390, "frame_number": 13988, "display_filter": "frame.number == 13988", "timestamp_epoch": "1575413307.174741000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:46:00.761909+00:00" }, { "observable_id": "observable-10cc055c5fe6c3127ee2d4ff", "type": "domain", "value": "image4.pubmatic.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 107, "frame_number": 10824, "display_filter": "frame.number == 10824", "timestamp_epoch": "1575413267.805499000" }, { "udp_stream": 107, "frame_number": 10924, "display_filter": "frame.number == 10924", "timestamp_epoch": "1575413268.273846000" }, { "tcp_stream": 279, "frame_number": 11050, "display_filter": "frame.number == 11050", "timestamp_epoch": "1575413268.492357000" }, { "tcp_stream": 280, "frame_number": 11065, "display_filter": "frame.number == 11065", "timestamp_epoch": "1575413268.498230000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4c0849e5cddf63ce17fe4848", "type": "domain", "value": "image6.pubmatic.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 85, "frame_number": 9852, "display_filter": "frame.number == 9852", "timestamp_epoch": "1575413264.386247000" }, { "udp_stream": 85, "frame_number": 9934, "display_filter": "frame.number == 9934", "timestamp_epoch": "1575413264.714628000" }, { "tcp_stream": 230, "frame_number": 10022, "display_filter": "frame.number == 10022", "timestamp_epoch": "1575413265.023163000" }, { "tcp_stream": 229, "frame_number": 10047, "display_filter": "frame.number == 10047", "timestamp_epoch": "1575413265.135752000" }, { "tcp_stream": 327, "frame_number": 12757, "display_filter": "frame.number == 12757", "timestamp_epoch": "1575413305.324132000" }, { "tcp_stream": 328, "frame_number": 12777, "display_filter": "frame.number == 12777", "timestamp_epoch": "1575413305.343252000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-285ff452b5cb6e0e74ca6455", "type": "domain", "value": "login.aol.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 8, "frame_number": 398, "display_filter": "frame.number == 398", "timestamp_epoch": "1575413157.773625000" }, { "udp_stream": 8, "frame_number": 399, "display_filter": "frame.number == 399", "timestamp_epoch": "1575413157.843186000" }, { "tcp_stream": 28, "frame_number": 406, "display_filter": "frame.number == 406", "timestamp_epoch": "1575413157.957301000" }, { "tcp_stream": 29, "frame_number": 408, "display_filter": "frame.number == 408", "timestamp_epoch": "1575413157.957372000" }, { "tcp_stream": 82, "frame_number": 3212, "display_filter": "frame.number == 3212", "timestamp_epoch": "1575413209.121309000" }, { "tcp_stream": 81, "frame_number": 3216, "display_filter": "frame.number == 3216", "timestamp_epoch": "1575413209.125896000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-36d7c19b3b18dcf78504ea04", "type": "domain", "value": "m-node-alb-us-east-1-prod-530825477.us-east-1.elb.amazonaws.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 56, "frame_number": 7655, "display_filter": "frame.number == 7655", "timestamp_epoch": "1575413255.099136000" }, { "udp_stream": 71, "frame_number": 9152, "display_filter": "frame.number == 9152", "timestamp_epoch": "1575413262.342458000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-76026d979017cfab95acf2f8", "type": "domain", "value": "mail.aol.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 4, "frame_number": 275, "display_filter": "frame.number == 275", "timestamp_epoch": "1575413155.172788000" }, { "udp_stream": 4, "frame_number": 276, "display_filter": "frame.number == 276", "timestamp_epoch": "1575413155.227694000" }, { "tcp_stream": 22, "frame_number": 281, "display_filter": "frame.number == 281", "timestamp_epoch": "1575413155.938245000" }, { "tcp_stream": 23, "frame_number": 288, "display_filter": "frame.number == 288", "timestamp_epoch": "1575413156.177305000" }, { "tcp_stream": 100, "frame_number": 4036, "display_filter": "frame.number == 4036", "timestamp_epoch": "1575413242.848243000" }, { "tcp_stream": 101, "frame_number": 4044, "display_filter": "frame.number == 4044", "timestamp_epoch": "1575413242.859580000" }, { "tcp_stream": 419, "frame_number": 14824, "display_filter": "frame.number == 14824", "timestamp_epoch": "1575413366.025506000" }, { "tcp_stream": 432, "frame_number": 16227, "display_filter": "frame.number == 16227", "timestamp_epoch": "1575413486.057022000" }, { "tcp_stream": 433, "frame_number": 16287, "display_filter": "frame.number == 16287", "timestamp_epoch": "1575413726.073713000" }, { "tcp_stream": 435, "frame_number": 16334, "display_filter": "frame.number == 16334", "timestamp_epoch": "1575413845.995219000" }, { "tcp_stream": 436, "frame_number": 16338, "display_filter": "frame.number == 16338", "timestamp_epoch": "1575413846.003112000" }, { "tcp_stream": 437, "frame_number": 16342, "display_filter": "frame.number == 16342", "timestamp_epoch": "1575413846.029786000" } ], "roles": [ "dns-query", "http-host", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2a4313ed252b9e5877876f0b", "type": "domain", "value": "match-975362022.us-east-1.elb.amazonaws.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 75, "frame_number": 9334, "display_filter": "frame.number == 9334", "timestamp_epoch": "1575413262.647446000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-573683686841d23c696138a4", "type": "domain", "value": "match.adsrvr.org", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 75, "frame_number": 9289, "display_filter": "frame.number == 9289", "timestamp_epoch": "1575413262.574246000" }, { "udp_stream": 75, "frame_number": 9334, "display_filter": "frame.number == 9334", "timestamp_epoch": "1575413262.647446000" }, { "tcp_stream": 203, "frame_number": 9409, "display_filter": "frame.number == 9409", "timestamp_epoch": "1575413262.794307000" }, { "tcp_stream": 204, "frame_number": 9411, "display_filter": "frame.number == 9411", "timestamp_epoch": "1575413262.794440000" }, { "tcp_stream": 314, "frame_number": 12711, "display_filter": "frame.number == 12711", "timestamp_epoch": "1575413305.291195000" }, { "tcp_stream": 313, "frame_number": 12719, "display_filter": "frame.number == 12719", "timestamp_epoch": "1575413305.295194000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0fe67f2f5943cc0f3ba6612e", "type": "domain", "value": "match.prod.bidr.io", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 92, "frame_number": 9907, "display_filter": "frame.number == 9907", "timestamp_epoch": "1575413264.560359000" }, { "udp_stream": 92, "frame_number": 9982, "display_filter": "frame.number == 9982", "timestamp_epoch": "1575413264.913423000" }, { "tcp_stream": 239, "frame_number": 10110, "display_filter": "frame.number == 10110", "timestamp_epoch": "1575413265.188216000" }, { "tcp_stream": 240, "frame_number": 10111, "display_filter": "frame.number == 10111", "timestamp_epoch": "1575413265.188358000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-79f3faa6f04f0b4c9af13a93", "type": "domain", "value": "match.rundsp.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 106, "frame_number": 10802, "display_filter": "frame.number == 10802", "timestamp_epoch": "1575413267.665708000" }, { "udp_stream": 106, "frame_number": 10888, "display_filter": "frame.number == 10888", "timestamp_epoch": "1575413268.087189000" }, { "tcp_stream": 275, "frame_number": 11004, "display_filter": "frame.number == 11004", "timestamp_epoch": "1575413268.385846000" }, { "tcp_stream": 274, "frame_number": 11010, "display_filter": "frame.number == 11010", "timestamp_epoch": "1575413268.393109000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-752dacb2399993cae2ce1c27", "type": "domain", "value": "match.taboola.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 133, "frame_number": 14021, "display_filter": "frame.number == 14021", "timestamp_epoch": "1575413307.237564000" }, { "udp_stream": 133, "frame_number": 14095, "display_filter": "frame.number == 14095", "timestamp_epoch": "1575413307.419283000" }, { "tcp_stream": 401, "frame_number": 14155, "display_filter": "frame.number == 14155", "timestamp_epoch": "1575413307.601114000" }, { "tcp_stream": 400, "frame_number": 14156, "display_filter": "frame.number == 14156", "timestamp_epoch": "1575413307.601203000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ed3aa637e2ee6edf262dc3ac", "type": "domain", "value": "match.zorosrv.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 134, "frame_number": 14309, "display_filter": "frame.number == 14309", "timestamp_epoch": "1575413308.047524000" }, { "udp_stream": 134, "frame_number": 14321, "display_filter": "frame.number == 14321", "timestamp_epoch": "1575413308.123917000" }, { "tcp_stream": 407, "frame_number": 14334, "display_filter": "frame.number == 14334", "timestamp_epoch": "1575413308.175469000" }, { "tcp_stream": 408, "frame_number": 14338, "display_filter": "frame.number == 14338", "timestamp_epoch": "1575413308.187872000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ef5eaacb44eb88b3f43b8270", "type": "domain", "value": "matchuseast-1393638539.us-east-1.elb.amazonaws.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 106, "frame_number": 10888, "display_filter": "frame.number == 10888", "timestamp_epoch": "1575413268.087189000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-224eb79bcc4d299028f69e40", "type": "domain", "value": "media-router-flurry1.prod.media.wg1.b.yahoo.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 49, "frame_number": 6460, "display_filter": "frame.number == 6460", "timestamp_epoch": "1575413250.068987000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8b967e85f04e1de2bcfeed75", "type": "domain", "value": "myip.opendns.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 155, "frame_number": 16140, "display_filter": "frame.number == 16140", "timestamp_epoch": "1575413455.012126000" }, { "udp_stream": 156, "frame_number": 16141, "display_filter": "frame.number == 16141", "timestamp_epoch": "1575413455.012294000" }, { "udp_stream": 155, "frame_number": 16142, "display_filter": "frame.number == 16142", "timestamp_epoch": "1575413455.067315000" }, { "udp_stream": 157, "frame_number": 16143, "display_filter": "frame.number == 16143", "timestamp_epoch": "1575413455.070317000" }, { "udp_stream": 156, "frame_number": 16144, "display_filter": "frame.number == 16144", "timestamp_epoch": "1575413455.075680000" }, { "udp_stream": 158, "frame_number": 16145, "display_filter": "frame.number == 16145", "timestamp_epoch": "1575413455.078339000" }, { "udp_stream": 157, "frame_number": 16146, "display_filter": "frame.number == 16146", "timestamp_epoch": "1575413455.131069000" }, { "udp_stream": 158, "frame_number": 16147, "display_filter": "frame.number == 16147", "timestamp_epoch": "1575413455.140510000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c201ea6cfeef25850f3162e6", "type": "domain", "value": "myip.opendns.com.icemaiden.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 151, "frame_number": 16135, "display_filter": "frame.number == 16135", "timestamp_epoch": "1575413450.992534000" }, { "udp_stream": 152, "frame_number": 16137, "display_filter": "frame.number == 16137", "timestamp_epoch": "1575413450.995863000" }, { "udp_stream": 153, "frame_number": 16138, "display_filter": "frame.number == 16138", "timestamp_epoch": "1575413452.999333000" }, { "udp_stream": 154, "frame_number": 16139, "display_filter": "frame.number == 16139", "timestamp_epoch": "1575413452.999457000" }, { "udp_stream": 152, "frame_number": 16168, "display_filter": "frame.number == 16168", "timestamp_epoch": "1575413457.097506000" }, { "udp_stream": 151, "frame_number": 16169, "display_filter": "frame.number == 16169", "timestamp_epoch": "1575413457.100534000" }, { "udp_stream": 153, "frame_number": 16191, "display_filter": "frame.number == 16191", "timestamp_epoch": "1575413459.043562000" }, { "udp_stream": 154, "frame_number": 16192, "display_filter": "frame.number == 16192", "timestamp_epoch": "1575413459.051947000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f16fcabbbe6413c7cbfc6335", "type": "domain", "value": "o.aolcdn.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 47, "frame_number": 5344, "display_filter": "frame.number == 5344", "timestamp_epoch": "1575413248.190906000" }, { "udp_stream": 47, "frame_number": 5418, "display_filter": "frame.number == 5418", "timestamp_epoch": "1575413248.467142000" }, { "tcp_stream": 118, "frame_number": 5569, "display_filter": "frame.number == 5569", "timestamp_epoch": "1575413248.615528000" }, { "tcp_stream": 119, "frame_number": 5577, "display_filter": "frame.number == 5577", "timestamp_epoch": "1575413248.637510000" }, { "tcp_stream": 125, "frame_number": 6389, "display_filter": "frame.number == 6389", "timestamp_epoch": "1575413249.886098000" }, { "tcp_stream": 124, "frame_number": 6392, "display_filter": "frame.number == 6392", "timestamp_epoch": "1575413249.886410000" }, { "tcp_stream": 122, "frame_number": 6394, "display_filter": "frame.number == 6394", "timestamp_epoch": "1575413249.886633000" }, { "tcp_stream": 123, "frame_number": 6396, "display_filter": "frame.number == 6396", "timestamp_epoch": "1575413249.887009000" }, { "tcp_stream": 127, "frame_number": 6416, "display_filter": "frame.number == 6416", "timestamp_epoch": "1575413250.007581000" }, { "tcp_stream": 126, "frame_number": 6418, "display_filter": "frame.number == 6418", "timestamp_epoch": "1575413250.007765000" }, { "tcp_stream": 131, "frame_number": 6711, "display_filter": "frame.number == 6711", "timestamp_epoch": "1575413250.560233000" }, { "tcp_stream": 132, "frame_number": 6714, "display_filter": "frame.number == 6714", "timestamp_epoch": "1575413250.560521000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b9e21b63c69ea2f706f22dba", "type": "domain", "value": "oao-js-tag.onemobile.yahoo.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 52, "frame_number": 7180, "display_filter": "frame.number == 7180", "timestamp_epoch": "1575413253.008581000" }, { "udp_stream": 52, "frame_number": 7233, "display_filter": "frame.number == 7233", "timestamp_epoch": "1575413253.235151000" }, { "tcp_stream": 138, "frame_number": 7386, "display_filter": "frame.number == 7386", "timestamp_epoch": "1575413253.561508000" }, { "tcp_stream": 139, "frame_number": 7401, "display_filter": "frame.number == 7401", "timestamp_epoch": "1575413253.562698000" }, { "tcp_stream": 300, "frame_number": 12546, "display_filter": "frame.number == 12546", "timestamp_epoch": "1575413304.110176000" }, { "tcp_stream": 299, "frame_number": 12547, "display_filter": "frame.number == 12547", "timestamp_epoch": "1575413304.110245000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-46734ba0502474bae253a387", "type": "domain", "value": "oidc.mail.aol.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 6, "frame_number": 307, "display_filter": "frame.number == 307", "timestamp_epoch": "1575413156.673565000" }, { "udp_stream": 6, "frame_number": 308, "display_filter": "frame.number == 308", "timestamp_epoch": "1575413156.734046000" }, { "tcp_stream": 24, "frame_number": 313, "display_filter": "frame.number == 313", "timestamp_epoch": "1575413156.844944000" }, { "tcp_stream": 25, "frame_number": 317, "display_filter": "frame.number == 317", "timestamp_epoch": "1575413156.862203000" }, { "tcp_stream": 98, "frame_number": 3980, "display_filter": "frame.number == 3980", "timestamp_epoch": "1575413241.586415000" }, { "tcp_stream": 99, "frame_number": 3984, "display_filter": "frame.number == 3984", "timestamp_epoch": "1575413241.595025000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-417a628958affe9af4406c2a", "type": "domain", "value": "opus.analytics.yahoo.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 20, "frame_number": 920, "display_filter": "frame.number == 920", "timestamp_epoch": "1575413162.714269000" }, { "udp_stream": 20, "frame_number": 928, "display_filter": "frame.number == 928", "timestamp_epoch": "1575413162.912415000" }, { "tcp_stream": 42, "frame_number": 962, "display_filter": "frame.number == 962", "timestamp_epoch": "1575413162.990597000" }, { "tcp_stream": 40, "frame_number": 972, "display_filter": "frame.number == 972", "timestamp_epoch": "1575413162.993109000" }, { "tcp_stream": 188, "frame_number": 9048, "display_filter": "frame.number == 9048", "timestamp_epoch": "1575413261.210715000" }, { "tcp_stream": 187, "frame_number": 9049, "display_filter": "frame.number == 9049", "timestamp_epoch": "1575413261.210773000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b84bdb241c6ec12751704e85", "type": "domain", "value": "p.adsymptotic.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 98, "frame_number": 10765, "display_filter": "frame.number == 10765", "timestamp_epoch": "1575413267.635090000" }, { "udp_stream": 98, "frame_number": 10815, "display_filter": "frame.number == 10815", "timestamp_epoch": "1575413267.789823000" }, { "tcp_stream": 258, "frame_number": 10915, "display_filter": "frame.number == 10915", "timestamp_epoch": "1575413268.263420000" }, { "tcp_stream": 259, "frame_number": 10929, "display_filter": "frame.number == 10929", "timestamp_epoch": "1575413268.275131000" }, { "tcp_stream": 361, "frame_number": 13349, "display_filter": "frame.number == 13349", "timestamp_epoch": "1575413306.301316000" }, { "tcp_stream": 362, "frame_number": 13355, "display_filter": "frame.number == 13355", "timestamp_epoch": "1575413306.306691000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5c411958409e4dac146b7a46", "type": "domain", "value": "p.rfihub.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 86, "frame_number": 9893, "display_filter": "frame.number == 9893", "timestamp_epoch": "1575413264.532818000" }, { "udp_stream": 86, "frame_number": 9983, "display_filter": "frame.number == 9983", "timestamp_epoch": "1575413264.913538000" }, { "tcp_stream": 237, "frame_number": 10108, "display_filter": "frame.number == 10108", "timestamp_epoch": "1575413265.188012000" }, { "tcp_stream": 238, "frame_number": 10109, "display_filter": "frame.number == 10109", "timestamp_epoch": "1575413265.188160000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-031fabd00ce17948d744c88f", "type": "domain", "value": "pagead-googlehosted.l.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 58, "frame_number": 7823, "display_filter": "frame.number == 7823", "timestamp_epoch": "1575413255.913526000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7d206dcea8f25727df66bb52", "type": "domain", "value": "pagead.l.doubleclick.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 63, "frame_number": 8199, "display_filter": "frame.number == 8199", "timestamp_epoch": "1575413258.370803000" }, { "udp_stream": 72, "frame_number": 9322, "display_filter": "frame.number == 9322", "timestamp_epoch": "1575413262.643180000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-989a34518134d51e6101b89b", "type": "domain", "value": "pagead2.googlesyndication.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 59, "frame_number": 7967, "display_filter": "frame.number == 7967", "timestamp_epoch": "1575413256.911444000" }, { "udp_stream": 59, "frame_number": 7972, "display_filter": "frame.number == 7972", "timestamp_epoch": "1575413257.008584000" }, { "tcp_stream": 152, "frame_number": 7977, "display_filter": "frame.number == 7977", "timestamp_epoch": "1575413257.092361000" }, { "tcp_stream": 153, "frame_number": 7981, "display_filter": "frame.number == 7981", "timestamp_epoch": "1575413257.101753000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-77f71ee548a7d91604668eaf", "type": "domain", "value": "pagead46.l.doubleclick.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 57, "frame_number": 7658, "display_filter": "frame.number == 7658", "timestamp_epoch": "1575413255.123657000" }, { "udp_stream": 59, "frame_number": 7972, "display_filter": "frame.number == 7972", "timestamp_epoch": "1575413257.008584000" }, { "udp_stream": 74, "frame_number": 9306, "display_filter": "frame.number == 9306", "timestamp_epoch": "1575413262.640954000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5dab12271fd8ecea3a06d68a", "type": "domain", "value": "pixel-a.sitescout.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 101, "frame_number": 10850, "display_filter": "frame.number == 10850", "timestamp_epoch": "1575413267.965591000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-17aace6bd86e7b2781ae5609", "type": "domain", "value": "pixel-origin.mathtag.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 77, "frame_number": 9305, "display_filter": "frame.number == 9305", "timestamp_epoch": "1575413262.640867000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-53f279a9261a60feb6b94e65", "type": "domain", "value": "pixel-sync.sitescout.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 101, "frame_number": 10787, "display_filter": "frame.number == 10787", "timestamp_epoch": "1575413267.655554000" }, { "udp_stream": 101, "frame_number": 10850, "display_filter": "frame.number == 10850", "timestamp_epoch": "1575413267.965591000" }, { "tcp_stream": 265, "frame_number": 10972, "display_filter": "frame.number == 10972", "timestamp_epoch": "1575413268.314920000" }, { "tcp_stream": 264, "frame_number": 10976, "display_filter": "frame.number == 10976", "timestamp_epoch": "1575413268.333871000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-56e3b40bc13b8222ed259e63", "type": "domain", "value": "pixel.advertising.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 73, "frame_number": 9286, "display_filter": "frame.number == 9286", "timestamp_epoch": "1575413262.570113000" }, { "udp_stream": 73, "frame_number": 9324, "display_filter": "frame.number == 9324", "timestamp_epoch": "1575413262.643694000" }, { "tcp_stream": 205, "frame_number": 9423, "display_filter": "frame.number == 9423", "timestamp_epoch": "1575413262.804456000" }, { "tcp_stream": 206, "frame_number": 9429, "display_filter": "frame.number == 9429", "timestamp_epoch": "1575413262.820301000" }, { "tcp_stream": 220, "frame_number": 9826, "display_filter": "frame.number == 9826", "timestamp_epoch": "1575413264.158665000" }, { "tcp_stream": 219, "frame_number": 9831, "display_filter": "frame.number == 9831", "timestamp_epoch": "1575413264.161621000" }, { "tcp_stream": 221, "frame_number": 9839, "display_filter": "frame.number == 9839", "timestamp_epoch": "1575413264.190485000" }, { "tcp_stream": 222, "frame_number": 9903, "display_filter": "frame.number == 9903", "timestamp_epoch": "1575413264.551307000" }, { "tcp_stream": 307, "frame_number": 12692, "display_filter": "frame.number == 12692", "timestamp_epoch": "1575413305.278668000" }, { "tcp_stream": 308, "frame_number": 12698, "display_filter": "frame.number == 12698", "timestamp_epoch": "1575413305.285416000" }, { "tcp_stream": 331, "frame_number": 12987, "display_filter": "frame.number == 12987", "timestamp_epoch": "1575413305.850256000" }, { "tcp_stream": 334, "frame_number": 13033, "display_filter": "frame.number == 13033", "timestamp_epoch": "1575413305.970868000" }, { "tcp_stream": 335, "frame_number": 13068, "display_filter": "frame.number == 13068", "timestamp_epoch": "1575413306.051550000" }, { "tcp_stream": 336, "frame_number": 13072, "display_filter": "frame.number == 13072", "timestamp_epoch": "1575413306.055922000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-800980b5d5df4f3e741d3a56", "type": "domain", "value": "pixel.quantserve.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 82, "frame_number": 9296, "display_filter": "frame.number == 9296", "timestamp_epoch": "1575413262.590656000" }, { "udp_stream": 82, "frame_number": 9360, "display_filter": "frame.number == 9360", "timestamp_epoch": "1575413262.717743000" }, { "tcp_stream": 217, "frame_number": 9477, "display_filter": "frame.number == 9477", "timestamp_epoch": "1575413262.891237000" }, { "tcp_stream": 218, "frame_number": 9489, "display_filter": "frame.number == 9489", "timestamp_epoch": "1575413262.912758000" }, { "tcp_stream": 325, "frame_number": 12761, "display_filter": "frame.number == 12761", "timestamp_epoch": "1575413305.324462000" }, { "tcp_stream": 326, "frame_number": 12763, "display_filter": "frame.number == 12763", "timestamp_epoch": "1575413305.324617000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3b094461d1602835f7d1843e", "type": "domain", "value": "pixel.tapad.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 132, "frame_number": 13991, "display_filter": "frame.number == 13991", "timestamp_epoch": "1575413307.175029000" }, { "udp_stream": 132, "frame_number": 14090, "display_filter": "frame.number == 14090", "timestamp_epoch": "1575413307.406763000" }, { "tcp_stream": 399, "frame_number": 14145, "display_filter": "frame.number == 14145", "timestamp_epoch": "1575413307.595452000" }, { "tcp_stream": 398, "frame_number": 14149, "display_filter": "frame.number == 14149", "timestamp_epoch": "1575413307.596410000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8b91c5b8304afcdb836bdf05", "type": "domain", "value": "pm.w55c.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 87, "frame_number": 9894, "display_filter": "frame.number == 9894", "timestamp_epoch": "1575413264.533633000" }, { "udp_stream": 87, "frame_number": 9974, "display_filter": "frame.number == 9974", "timestamp_epoch": "1575413264.859950000" }, { "tcp_stream": 233, "frame_number": 10076, "display_filter": "frame.number == 10076", "timestamp_epoch": "1575413265.180775000" }, { "tcp_stream": 234, "frame_number": 10107, "display_filter": "frame.number == 10107", "timestamp_epoch": "1575413265.187818000" }, { "tcp_stream": 341, "frame_number": 13107, "display_filter": "frame.number == 13107", "timestamp_epoch": "1575413306.090359000" }, { "tcp_stream": 342, "frame_number": 13125, "display_filter": "frame.number == 13125", "timestamp_epoch": "1575413306.124143000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d5c4addb65d3ccd4113ac6f4", "type": "domain", "value": "pmp.mxptint.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 104, "frame_number": 10794, "display_filter": "frame.number == 10794", "timestamp_epoch": "1575413267.660148000" }, { "udp_stream": 104, "frame_number": 10858, "display_filter": "frame.number == 10858", "timestamp_epoch": "1575413267.969283000" }, { "tcp_stream": 268, "frame_number": 10964, "display_filter": "frame.number == 10964", "timestamp_epoch": "1575413268.302484000" }, { "tcp_stream": 269, "frame_number": 10965, "display_filter": "frame.number == 10965", "timestamp_epoch": "1575413268.302562000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5fa076919fc50b1a0c413556", "type": "domain", "value": "pr-bh.ybp.yahoo.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 83, "frame_number": 9748, "display_filter": "frame.number == 9748", "timestamp_epoch": "1575413263.778707000" }, { "udp_stream": 83, "frame_number": 9810, "display_filter": "frame.number == 9810", "timestamp_epoch": "1575413264.126151000" }, { "tcp_stream": 224, "frame_number": 9917, "display_filter": "frame.number == 9917", "timestamp_epoch": "1575413264.686859000" }, { "tcp_stream": 223, "frame_number": 9928, "display_filter": "frame.number == 9928", "timestamp_epoch": "1575413264.710393000" }, { "tcp_stream": 332, "frame_number": 13017, "display_filter": "frame.number == 13017", "timestamp_epoch": "1575413305.959219000" }, { "tcp_stream": 333, "frame_number": 13029, "display_filter": "frame.number == 13029", "timestamp_epoch": "1575413305.965354000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5b7302d8816de737b27a04de", "type": "domain", "value": "prod-lb-10-490190718.us-east-1.elb.amazonaws.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 184, "frame_number": 17359, "display_filter": "frame.number == 17359", "timestamp_epoch": "1575414489.334625000" }, { "udp_stream": 185, "frame_number": 17386, "display_filter": "frame.number == 17386", "timestamp_epoch": "1575414489.544905000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1ef520f2bf32d0b1064d1b42", "type": "domain", "value": "prod-lb-13-1730166618.us-east-1.elb.amazonaws.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 189, "frame_number": 18913, "display_filter": "frame.number == 18913", "timestamp_epoch": "1575414494.106735000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-25976c10c301eb50ffd9077e", "type": "domain", "value": "prod-lb-8-1772099769.us-east-1.elb.amazonaws.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 182, "frame_number": 17363, "display_filter": "frame.number == 17363", "timestamp_epoch": "1575414489.352624000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0c357a35f9c7c5bdec9481e3", "type": "domain", "value": "prod-lb-9-1476932994.us-east-1.elb.amazonaws.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 183, "frame_number": 17364, "display_filter": "frame.number == 17364", "timestamp_epoch": "1575414489.352724000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b54b867b83bde222cbb0d403", "type": "domain", "value": "prod-m-node-1111.ssp.advertising.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 56, "frame_number": 7650, "display_filter": "frame.number == 7650", "timestamp_epoch": "1575413255.026754000" }, { "udp_stream": 56, "frame_number": 7655, "display_filter": "frame.number == 7655", "timestamp_epoch": "1575413255.099136000" }, { "tcp_stream": 145, "frame_number": 7681, "display_filter": "frame.number == 7681", "timestamp_epoch": "1575413255.191849000" }, { "tcp_stream": 144, "frame_number": 7683, "display_filter": "frame.number == 7683", "timestamp_epoch": "1575413255.192007000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9b2ffba1f40b340a7e40b780", "type": "domain", "value": "prod.contextweb.map.fastlylb.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 16, "frame_number": 13337, "display_filter": "frame.number == 13337", "timestamp_epoch": "1575413306.294911000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-481ec601c3a2027f9d6f6c85", "type": "domain", "value": "prod.gxp.pse.public.aol.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 43, "frame_number": 4892, "display_filter": "frame.number == 4892", "timestamp_epoch": "1575413246.304051000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b7fdf827e1feba830b1e43a9", "type": "domain", "value": "prod.ups-yahoo.aolp-ds-prd.aws.oath.cloud", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 84, "frame_number": 9864, "display_filter": "frame.number == 9864", "timestamp_epoch": "1575413264.518110000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f31208813a865270d769da72", "type": "domain", "value": "pubmatic-match.dotomi.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 102, "frame_number": 10790, "display_filter": "frame.number == 10790", "timestamp_epoch": "1575413267.656198000" }, { "udp_stream": 102, "frame_number": 10873, "display_filter": "frame.number == 10873", "timestamp_epoch": "1575413268.023538000" }, { "tcp_stream": 270, "frame_number": 10988, "display_filter": "frame.number == 10988", "timestamp_epoch": "1575413268.347144000" }, { "tcp_stream": 271, "frame_number": 10998, "display_filter": "frame.number == 10998", "timestamp_epoch": "1575413268.361812000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4e65b7432b29bd6dacb1e0b5", "type": "domain", "value": "pubmatic2waycm-atl.netmng.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 129, "frame_number": 13200, "display_filter": "frame.number == 13200", "timestamp_epoch": "1575413306.158220000" }, { "udp_stream": 129, "frame_number": 13307, "display_filter": "frame.number == 13307", "timestamp_epoch": "1575413306.288918000" }, { "tcp_stream": 373, "frame_number": 13530, "display_filter": "frame.number == 13530", "timestamp_epoch": "1575413306.471385000" }, { "tcp_stream": 375, "frame_number": 13532, "display_filter": "frame.number == 13532", "timestamp_epoch": "1575413306.471738000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c9cc81d4e17d62d082b5622e", "type": "domain", "value": "px.adhigh.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 126, "frame_number": 13193, "display_filter": "frame.number == 13193", "timestamp_epoch": "1575413306.150408000" }, { "udp_stream": 126, "frame_number": 13408, "display_filter": "frame.number == 13408", "timestamp_epoch": "1575413306.386965000" }, { "tcp_stream": 385, "frame_number": 13609, "display_filter": "frame.number == 13609", "timestamp_epoch": "1575413306.599021000" }, { "tcp_stream": 386, "frame_number": 13610, "display_filter": "frame.number == 13610", "timestamp_epoch": "1575413306.599079000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a6b21fa380975bf85bd65968", "type": "domain", "value": "px.moatads.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 55, "frame_number": 7649, "display_filter": "frame.number == 7649", "timestamp_epoch": "1575413255.007713000" }, { "udp_stream": 55, "frame_number": 7652, "display_filter": "frame.number == 7652", "timestamp_epoch": "1575413255.067988000" }, { "tcp_stream": 142, "frame_number": 7663, "display_filter": "frame.number == 7663", "timestamp_epoch": "1575413255.152653000" }, { "tcp_stream": 143, "frame_number": 7667, "display_filter": "frame.number == 7667", "timestamp_epoch": "1575413255.157961000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-72994fdda319d5f7ccf7cab7", "type": "domain", "value": "px.owneriq.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 121, "frame_number": 13170, "display_filter": "frame.number == 13170", "timestamp_epoch": "1575413306.135970000" }, { "udp_stream": 121, "frame_number": 13263, "display_filter": "frame.number == 13263", "timestamp_epoch": "1575413306.258315000" }, { "tcp_stream": 365, "frame_number": 13415, "display_filter": "frame.number == 13415", "timestamp_epoch": "1575413306.390056000" }, { "tcp_stream": 366, "frame_number": 13422, "display_filter": "frame.number == 13422", "timestamp_epoch": "1575413306.394547000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5bedfe444935b59c24799f14", "type": "domain", "value": "r20swj13mr.microsoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 35, "frame_number": 2891, "display_filter": "frame.number == 2891", "timestamp_epoch": "1575413185.149481000" }, { "udp_stream": 35, "frame_number": 2904, "display_filter": "frame.number == 2904", "timestamp_epoch": "1575413185.267497000" }, { "tcp_stream": 75, "frame_number": 2921, "display_filter": "frame.number == 2921", "timestamp_epoch": "1575413185.333679000" }, { "tcp_stream": 76, "frame_number": 2937, "display_filter": "frame.number == 2937", "timestamp_epoch": "1575413185.386287000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-bb8fe26944a95d3d50d88e0d", "type": "domain", "value": "rail.bankofamerica.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 185, "frame_number": 17347, "display_filter": "frame.number == 17347", "timestamp_epoch": "1575414489.232049000" }, { "udp_stream": 185, "frame_number": 17386, "display_filter": "frame.number == 17386", "timestamp_epoch": "1575414489.544905000" }, { "tcp_stream": 461, "frame_number": 17656, "display_filter": "frame.number == 17656", "timestamp_epoch": "1575414489.980687000" }, { "tcp_stream": 462, "frame_number": 17658, "display_filter": "frame.number == 17658", "timestamp_epoch": "1575414489.980891000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-12a7feee0433050805a2ee47", "type": "domain", "value": "resolver1.opendns.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 147, "frame_number": 16128, "display_filter": "frame.number == 16128", "timestamp_epoch": "1575413450.199517000" }, { "udp_stream": 148, "frame_number": 16129, "display_filter": "frame.number == 16129", "timestamp_epoch": "1575413450.209086000" }, { "udp_stream": 148, "frame_number": 16130, "display_filter": "frame.number == 16130", "timestamp_epoch": "1575413450.595849000" }, { "udp_stream": 147, "frame_number": 16131, "display_filter": "frame.number == 16131", "timestamp_epoch": "1575413450.595932000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b4736cbf9fedab0bb3a8d531", "type": "domain", "value": "rp.gwallet.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 130, "frame_number": 13201, "display_filter": "frame.number == 13201", "timestamp_epoch": "1575413306.159653000" }, { "udp_stream": 130, "frame_number": 13311, "display_filter": "frame.number == 13311", "timestamp_epoch": "1575413306.289844000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-682b974103ec352440ad2b2c", "type": "domain", "value": "rtb.adentifi.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 61, "frame_number": 8073, "display_filter": "frame.number == 8073", "timestamp_epoch": "1575413257.790729000" }, { "udp_stream": 61, "frame_number": 8080, "display_filter": "frame.number == 8080", "timestamp_epoch": "1575413257.956936000" }, { "tcp_stream": 157, "frame_number": 8104, "display_filter": "frame.number == 8104", "timestamp_epoch": "1575413258.098025000" }, { "tcp_stream": 156, "frame_number": 8108, "display_filter": "frame.number == 8108", "timestamp_epoch": "1575413258.099351000" }, { "tcp_stream": 168, "frame_number": 8352, "display_filter": "frame.number == 8352", "timestamp_epoch": "1575413258.899477000" }, { "tcp_stream": 170, "frame_number": 8360, "display_filter": "frame.number == 8360", "timestamp_epoch": "1575413258.899980000" }, { "tcp_stream": 171, "frame_number": 8366, "display_filter": "frame.number == 8366", "timestamp_epoch": "1575413258.908848000" }, { "tcp_stream": 169, "frame_number": 8368, "display_filter": "frame.number == 8368", "timestamp_epoch": "1575413258.909021000" }, { "tcp_stream": 358, "frame_number": 13333, "display_filter": "frame.number == 13333", "timestamp_epoch": "1575413306.294208000" }, { "tcp_stream": 357, "frame_number": 13342, "display_filter": "frame.number == 13342", "timestamp_epoch": "1575413306.296982000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-283ed453e356b509ee285331", "type": "domain", "value": "rtb.mfadsrvr.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 120, "frame_number": 13057, "display_filter": "frame.number == 13057", "timestamp_epoch": "1575413306.033399000" }, { "udp_stream": 120, "frame_number": 13146, "display_filter": "frame.number == 13146", "timestamp_epoch": "1575413306.126479000" }, { "tcp_stream": 353, "frame_number": 13281, "display_filter": "frame.number == 13281", "timestamp_epoch": "1575413306.266962000" }, { "tcp_stream": 354, "frame_number": 13315, "display_filter": "frame.number == 13315", "timestamp_epoch": "1575413306.290358000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6d5c07c3653035dd514656cb", "type": "domain", "value": "s.aolcdn.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 41, "frame_number": 4182, "display_filter": "frame.number == 4182", "timestamp_epoch": "1575413244.526729000" }, { "udp_stream": 41, "frame_number": 4184, "display_filter": "frame.number == 4184", "timestamp_epoch": "1575413244.602338000" }, { "tcp_stream": 103, "frame_number": 4202, "display_filter": "frame.number == 4202", "timestamp_epoch": "1575413244.664685000" }, { "tcp_stream": 102, "frame_number": 4204, "display_filter": "frame.number == 4204", "timestamp_epoch": "1575413244.665010000" }, { "tcp_stream": 106, "frame_number": 4902, "display_filter": "frame.number == 4902", "timestamp_epoch": "1575413246.318317000" }, { "tcp_stream": 107, "frame_number": 4912, "display_filter": "frame.number == 4912", "timestamp_epoch": "1575413246.341642000" }, { "tcp_stream": 108, "frame_number": 4918, "display_filter": "frame.number == 4918", "timestamp_epoch": "1575413246.393099000" }, { "tcp_stream": 115, "frame_number": 5290, "display_filter": "frame.number == 5290", "timestamp_epoch": "1575413248.076689000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6e986dbdfe1abe164c01493d", "type": "domain", "value": "s.blogsmithmedia.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 46, "frame_number": 5160, "display_filter": "frame.number == 5160", "timestamp_epoch": "1575413247.781242000" }, { "udp_stream": 46, "frame_number": 5225, "display_filter": "frame.number == 5225", "timestamp_epoch": "1575413248.059796000" }, { "tcp_stream": 117, "frame_number": 5359, "display_filter": "frame.number == 5359", "timestamp_epoch": "1575413248.204550000" }, { "tcp_stream": 116, "frame_number": 5361, "display_filter": "frame.number == 5361", "timestamp_epoch": "1575413248.206180000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ddbc888d826c1476d369afd9", "type": "domain", "value": "s.yimg.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 9, "frame_number": 502, "display_filter": "frame.number == 502", "timestamp_epoch": "1575413158.880779000" }, { "udp_stream": 9, "frame_number": 504, "display_filter": "frame.number == 504", "timestamp_epoch": "1575413158.967341000" }, { "tcp_stream": 31, "frame_number": 524, "display_filter": "frame.number == 524", "timestamp_epoch": "1575413159.150193000" }, { "tcp_stream": 32, "frame_number": 526, "display_filter": "frame.number == 526", "timestamp_epoch": "1575413159.150917000" }, { "tcp_stream": 33, "frame_number": 535, "display_filter": "frame.number == 535", "timestamp_epoch": "1575413159.388361000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c2106cc7816dc4bd75092498", "type": "domain", "value": "s0-2mdn-net.l.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 25, "frame_number": 1448, "display_filter": "frame.number == 1448", "timestamp_epoch": "1575413164.452822000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-632e18cb886b8e3be3bc8bcf", "type": "domain", "value": "s0.2mdn.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 25, "frame_number": 1395, "display_filter": "frame.number == 1395", "timestamp_epoch": "1575413164.035420000" }, { "udp_stream": 25, "frame_number": 1448, "display_filter": "frame.number == 1448", "timestamp_epoch": "1575413164.452822000" }, { "tcp_stream": 51, "frame_number": 2333, "display_filter": "frame.number == 2333", "timestamp_epoch": "1575413166.025194000" }, { "tcp_stream": 52, "frame_number": 2352, "display_filter": "frame.number == 2352", "timestamp_epoch": "1575413166.046867000" }, { "tcp_stream": 149, "frame_number": 7819, "display_filter": "frame.number == 7819", "timestamp_epoch": "1575413255.911366000" }, { "tcp_stream": 148, "frame_number": 7821, "display_filter": "frame.number == 7821", "timestamp_epoch": "1575413255.911536000" }, { "tcp_stream": 164, "frame_number": 8328, "display_filter": "frame.number == 8328", "timestamp_epoch": "1575413258.869116000" }, { "tcp_stream": 166, "frame_number": 8338, "display_filter": "frame.number == 8338", "timestamp_epoch": "1575413258.874067000" }, { "tcp_stream": 165, "frame_number": 8339, "display_filter": "frame.number == 8339", "timestamp_epoch": "1575413258.874115000" }, { "tcp_stream": 167, "frame_number": 8348, "display_filter": "frame.number == 8348", "timestamp_epoch": "1575413258.878255000" }, { "tcp_stream": 176, "frame_number": 8480, "display_filter": "frame.number == 8480", "timestamp_epoch": "1575413259.415505000" }, { "tcp_stream": 177, "frame_number": 8481, "display_filter": "frame.number == 8481", "timestamp_epoch": "1575413259.415564000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-334490b561f380e92dcf7d71", "type": "domain", "value": "sb.scorecardresearch.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 45, "frame_number": 5058, "display_filter": "frame.number == 5058", "timestamp_epoch": "1575413247.024624000" }, { "udp_stream": 45, "frame_number": 5073, "display_filter": "frame.number == 5073", "timestamp_epoch": "1575413247.091636000" }, { "tcp_stream": 113, "frame_number": 5108, "display_filter": "frame.number == 5108", "timestamp_epoch": "1575413247.249279000" }, { "tcp_stream": 114, "frame_number": 5112, "display_filter": "frame.number == 5112", "timestamp_epoch": "1575413247.250557000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d3dfff5021eca73472170600", "type": "domain", "value": "sdarlasplitroute.gapx.yahoodns.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 18, "frame_number": 648, "display_filter": "frame.number == 648", "timestamp_epoch": "1575413160.623583000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1ddd49cf2a1babebfd180982", "type": "domain", "value": "secure.adnxs.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 131, "frame_number": 13968, "display_filter": "frame.number == 13968", "timestamp_epoch": "1575413307.128376000" }, { "udp_stream": 131, "frame_number": 14067, "display_filter": "frame.number == 14067", "timestamp_epoch": "1575413307.383718000" }, { "tcp_stream": 397, "frame_number": 14131, "display_filter": "frame.number == 14131", "timestamp_epoch": "1575413307.537978000" }, { "tcp_stream": 396, "frame_number": 14137, "display_filter": "frame.number == 14137", "timestamp_epoch": "1575413307.541121000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1255b9de94ef10e30b30f08d", "type": "domain", "value": "secure.bankofamerica.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 169, "frame_number": 16501, "display_filter": "frame.number == 16501", "timestamp_epoch": "1575414483.432527000" }, { "udp_stream": 169, "frame_number": 16502, "display_filter": "frame.number == 16502", "timestamp_epoch": "1575414483.604203000" }, { "tcp_stream": 443, "frame_number": 16513, "display_filter": "frame.number == 16513", "timestamp_epoch": "1575414483.886699000" }, { "tcp_stream": 444, "frame_number": 16561, "display_filter": "frame.number == 16561", "timestamp_epoch": "1575414484.898618000" }, { "tcp_stream": 445, "frame_number": 16597, "display_filter": "frame.number == 16597", "timestamp_epoch": "1575414484.907482000" }, { "tcp_stream": 446, "frame_number": 16599, "display_filter": "frame.number == 16599", "timestamp_epoch": "1575414484.908213000" }, { "tcp_stream": 447, "frame_number": 16601, "display_filter": "frame.number == 16601", "timestamp_epoch": "1575414484.908685000" }, { "tcp_stream": 448, "frame_number": 17143, "display_filter": "frame.number == 17143", "timestamp_epoch": "1575414487.178444000" }, { "tcp_stream": 455, "frame_number": 17525, "display_filter": "frame.number == 17525", "timestamp_epoch": "1575414489.714375000" }, { "tcp_stream": 460, "frame_number": 17662, "display_filter": "frame.number == 17662", "timestamp_epoch": "1575414489.981171000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4c72d28717c3ed3f1c3d99a7", "type": "domain", "value": "secure.ecglb.bac.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 169, "frame_number": 16502, "display_filter": "frame.number == 16502", "timestamp_epoch": "1575414483.604203000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1498e5a94ff2c760c483ada3", "type": "domain", "value": "service.idsync.analytics.yahoo.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 29, "frame_number": 2499, "display_filter": "frame.number == 2499", "timestamp_epoch": "1575413166.433997000" }, { "udp_stream": 29, "frame_number": 2546, "display_filter": "frame.number == 2546", "timestamp_epoch": "1575413166.668934000" }, { "tcp_stream": 62, "frame_number": 2615, "display_filter": "frame.number == 2615", "timestamp_epoch": "1575413166.956048000" }, { "tcp_stream": 63, "frame_number": 2621, "display_filter": "frame.number == 2621", "timestamp_epoch": "1575413166.958828000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1eb7b7fa39e8bbe6da83fb0e", "type": "domain", "value": "service.sp.aolp-ds-prd.aws.oath.cloud", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 29, "frame_number": 2546, "display_filter": "frame.number == 2546", "timestamp_epoch": "1575413166.668934000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3cc26248f8bdc8df886e1f62", "type": "domain", "value": "simage2.pubmatic.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 109, "frame_number": 10839, "display_filter": "frame.number == 10839", "timestamp_epoch": "1575413267.846641000" }, { "udp_stream": 109, "frame_number": 10931, "display_filter": "frame.number == 10931", "timestamp_epoch": "1575413268.278653000" }, { "tcp_stream": 282, "frame_number": 11076, "display_filter": "frame.number == 11076", "timestamp_epoch": "1575413268.504574000" }, { "tcp_stream": 281, "frame_number": 11091, "display_filter": "frame.number == 11091", "timestamp_epoch": "1575413268.514941000" }, { "tcp_stream": 284, "frame_number": 11101, "display_filter": "frame.number == 11101", "timestamp_epoch": "1575413268.526883000" }, { "tcp_stream": 283, "frame_number": 11112, "display_filter": "frame.number == 11112", "timestamp_epoch": "1575413268.540611000" }, { "tcp_stream": 290, "frame_number": 11505, "display_filter": "frame.number == 11505", "timestamp_epoch": "1575413269.468173000" }, { "tcp_stream": 292, "frame_number": 11521, "display_filter": "frame.number == 11521", "timestamp_epoch": "1575413269.551960000" }, { "tcp_stream": 294, "frame_number": 11616, "display_filter": "frame.number == 11616", "timestamp_epoch": "1575413269.902094000" }, { "tcp_stream": 360, "frame_number": 13362, "display_filter": "frame.number == 13362", "timestamp_epoch": "1575413306.310531000" }, { "tcp_stream": 359, "frame_number": 13368, "display_filter": "frame.number == 13368", "timestamp_epoch": "1575413306.324693000" }, { "tcp_stream": 393, "frame_number": 14117, "display_filter": "frame.number == 14117", "timestamp_epoch": "1575413307.507969000" }, { "tcp_stream": 394, "frame_number": 14124, "display_filter": "frame.number == 14124", "timestamp_epoch": "1575413307.520512000" }, { "tcp_stream": 395, "frame_number": 14141, "display_filter": "frame.number == 14141", "timestamp_epoch": "1575413307.560586000" }, { "tcp_stream": 402, "frame_number": 14167, "display_filter": "frame.number == 14167", "timestamp_epoch": "1575413307.686141000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f682e34ea79181f09aa6d5cb", "type": "domain", "value": "simage4.pubmatic.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 112, "frame_number": 11551, "display_filter": "frame.number == 11551", "timestamp_epoch": "1575413269.662704000" }, { "udp_stream": 112, "frame_number": 11592, "display_filter": "frame.number == 11592", "timestamp_epoch": "1575413269.831186000" }, { "tcp_stream": 295, "frame_number": 11628, "display_filter": "frame.number == 11628", "timestamp_epoch": "1575413269.978848000" }, { "tcp_stream": 296, "frame_number": 11632, "display_filter": "frame.number == 11632", "timestamp_epoch": "1575413269.996746000" }, { "tcp_stream": 410, "frame_number": 14362, "display_filter": "frame.number == 14362", "timestamp_epoch": "1575413308.270866000" }, { "tcp_stream": 409, "frame_number": 14368, "display_filter": "frame.number == 14368", "timestamp_epoch": "1575413308.278250000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-dea853c8c094bf7b849dda99", "type": "domain", "value": "sofa.bankofamerica.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 186, "frame_number": 17348, "display_filter": "frame.number == 17348", "timestamp_epoch": "1575414489.271248000" }, { "udp_stream": 186, "frame_number": 17389, "display_filter": "frame.number == 17389", "timestamp_epoch": "1575414489.558324000" }, { "tcp_stream": 464, "frame_number": 17654, "display_filter": "frame.number == 17654", "timestamp_epoch": "1575414489.980469000" }, { "tcp_stream": 463, "frame_number": 17660, "display_filter": "frame.number == 17660", "timestamp_epoch": "1575414489.980961000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2f8ad240a36ba423c8a32725", "type": "domain", "value": "spcms-global.pbp.gysm.yahoodns.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 28, "frame_number": 2224, "display_filter": "frame.number == 2224", "timestamp_epoch": "1575413165.993066000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ba06596a16003e6588584551", "type": "domain", "value": "ssum-sec.casalemedia.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 76, "frame_number": 9290, "display_filter": "frame.number == 9290", "timestamp_epoch": "1575413262.576039000" }, { "udp_stream": 76, "frame_number": 9336, "display_filter": "frame.number == 9336", "timestamp_epoch": "1575413262.649448000" }, { "tcp_stream": 207, "frame_number": 9403, "display_filter": "frame.number == 9403", "timestamp_epoch": "1575413262.791698000" }, { "tcp_stream": 208, "frame_number": 9420, "display_filter": "frame.number == 9420", "timestamp_epoch": "1575413262.804217000" }, { "tcp_stream": 315, "frame_number": 12686, "display_filter": "frame.number == 12686", "timestamp_epoch": "1575413305.265959000" }, { "tcp_stream": 316, "frame_number": 12694, "display_filter": "frame.number == 12694", "timestamp_epoch": "1575413305.278976000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-eb2e495b91f621b99538d99b", "type": "domain", "value": "sync-tm.everesttech.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 99, "frame_number": 10777, "display_filter": "frame.number == 10777", "timestamp_epoch": "1575413267.639995000" }, { "udp_stream": 99, "frame_number": 10840, "display_filter": "frame.number == 10840", "timestamp_epoch": "1575413267.869627000" }, { "tcp_stream": 261, "frame_number": 10940, "display_filter": "frame.number == 10940", "timestamp_epoch": "1575413268.281017000" }, { "tcp_stream": 260, "frame_number": 10941, "display_filter": "frame.number == 10941", "timestamp_epoch": "1575413268.281065000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d8c6efa893ddc5a548ed5994", "type": "domain", "value": "sync.1rx.io", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 122, "frame_number": 13182, "display_filter": "frame.number == 13182", "timestamp_epoch": "1575413306.139497000" }, { "udp_stream": 122, "frame_number": 13288, "display_filter": "frame.number == 13288", "timestamp_epoch": "1575413306.271668000" }, { "tcp_stream": 370, "frame_number": 13508, "display_filter": "frame.number == 13508", "timestamp_epoch": "1575413306.454776000" }, { "tcp_stream": 369, "frame_number": 13510, "display_filter": "frame.number == 13510", "timestamp_epoch": "1575413306.454882000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-49abd37753c4bd1fde9667be", "type": "domain", "value": "sync.ipredictive.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 105, "frame_number": 10799, "display_filter": "frame.number == 10799", "timestamp_epoch": "1575413267.663441000" }, { "udp_stream": 105, "frame_number": 10876, "display_filter": "frame.number == 10876", "timestamp_epoch": "1575413268.026147000" }, { "tcp_stream": 273, "frame_number": 10986, "display_filter": "frame.number == 10986", "timestamp_epoch": "1575413268.346940000" }, { "tcp_stream": 272, "frame_number": 10987, "display_filter": "frame.number == 10987", "timestamp_epoch": "1575413268.347073000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e780d2eb559368217c4935b4", "type": "domain", "value": "sync.mathtag.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 77, "frame_number": 9291, "display_filter": "frame.number == 9291", "timestamp_epoch": "1575413262.579955000" }, { "udp_stream": 77, "frame_number": 9305, "display_filter": "frame.number == 9305", "timestamp_epoch": "1575413262.640867000" }, { "tcp_stream": 198, "frame_number": 9393, "display_filter": "frame.number == 9393", "timestamp_epoch": "1575413262.754707000" }, { "tcp_stream": 196, "frame_number": 9394, "display_filter": "frame.number == 9394", "timestamp_epoch": "1575413262.754778000" }, { "tcp_stream": 318, "frame_number": 12715, "display_filter": "frame.number == 12715", "timestamp_epoch": "1575413305.294515000" }, { "tcp_stream": 317, "frame_number": 12723, "display_filter": "frame.number == 12723", "timestamp_epoch": "1575413305.297035000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-92632e260d68d24bc0ad84d0", "type": "domain", "value": "sync.srv.stackadapt.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 110, "frame_number": 10887, "display_filter": "frame.number == 10887", "timestamp_epoch": "1575413268.077678000" }, { "udp_stream": 110, "frame_number": 10993, "display_filter": "frame.number == 10993", "timestamp_epoch": "1575413268.359202000" }, { "tcp_stream": 286, "frame_number": 11186, "display_filter": "frame.number == 11186", "timestamp_epoch": "1575413268.632096000" }, { "tcp_stream": 287, "frame_number": 11194, "display_filter": "frame.number == 11194", "timestamp_epoch": "1575413268.636240000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b4fab1a373a658a89498600a", "type": "domain", "value": "t.myvisualiq.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 70, "frame_number": 9117, "display_filter": "frame.number == 9117", "timestamp_epoch": "1575413262.140958000" }, { "udp_stream": 70, "frame_number": 9126, "display_filter": "frame.number == 9126", "timestamp_epoch": "1575413262.266157000" }, { "tcp_stream": 189, "frame_number": 9161, "display_filter": "frame.number == 9161", "timestamp_epoch": "1575413262.345766000" }, { "tcp_stream": 190, "frame_number": 9165, "display_filter": "frame.number == 9165", "timestamp_epoch": "1575413262.358195000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-38a2e63ff09d8ac03fef0a08", "type": "domain", "value": "tag.idsync.analytics.yahoo.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 24, "frame_number": 1103, "display_filter": "frame.number == 1103", "timestamp_epoch": "1575413163.334867000" }, { "udp_stream": 24, "frame_number": 1144, "display_filter": "frame.number == 1144", "timestamp_epoch": "1575413163.522891000" }, { "tcp_stream": 49, "frame_number": 1227, "display_filter": "frame.number == 1227", "timestamp_epoch": "1575413163.806683000" }, { "tcp_stream": 50, "frame_number": 1264, "display_filter": "frame.number == 1264", "timestamp_epoch": "1575413163.881841000" }, { "tcp_stream": 192, "frame_number": 9171, "display_filter": "frame.number == 9171", "timestamp_epoch": "1575413262.403917000" }, { "tcp_stream": 191, "frame_number": 9175, "display_filter": "frame.number == 9175", "timestamp_epoch": "1575413262.406188000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-29ee337d456e8a9bdce327b3", "type": "domain", "value": "tag.sp.advertising.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 21, "frame_number": 921, "display_filter": "frame.number == 921", "timestamp_epoch": "1575413162.716337000" }, { "udp_stream": 21, "frame_number": 929, "display_filter": "frame.number == 929", "timestamp_epoch": "1575413162.912621000" }, { "tcp_stream": 39, "frame_number": 958, "display_filter": "frame.number == 958", "timestamp_epoch": "1575413162.970253000" }, { "tcp_stream": 41, "frame_number": 970, "display_filter": "frame.number == 970", "timestamp_epoch": "1575413162.992961000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2e671db1746fe7483b24456a", "type": "domain", "value": "tags.bkrtx.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 62, "frame_number": 8074, "display_filter": "frame.number == 8074", "timestamp_epoch": "1575413257.791396000" }, { "udp_stream": 62, "frame_number": 8085, "display_filter": "frame.number == 8085", "timestamp_epoch": "1575413257.988658000" }, { "tcp_stream": 159, "frame_number": 8096, "display_filter": "frame.number == 8096", "timestamp_epoch": "1575413258.085108000" }, { "tcp_stream": 158, "frame_number": 8100, "display_filter": "frame.number == 8100", "timestamp_epoch": "1575413258.092454000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-57adbb2de2b690c5cb8dc7cf", "type": "domain", "value": "tags.bluekai.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 30, "frame_number": 2643, "display_filter": "frame.number == 2643", "timestamp_epoch": "1575413167.102944000" }, { "udp_stream": 30, "frame_number": 2668, "display_filter": "frame.number == 2668", "timestamp_epoch": "1575413167.222296000" }, { "tcp_stream": 69, "frame_number": 2688, "display_filter": "frame.number == 2688", "timestamp_epoch": "1575413167.302056000" }, { "tcp_stream": 68, "frame_number": 2691, "display_filter": "frame.number == 2691", "timestamp_epoch": "1575413167.302925000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a84960ca6b5cc5fede9eb6ca", "type": "domain", "value": "tpc.googlesyndication.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 58, "frame_number": 7806, "display_filter": "frame.number == 7806", "timestamp_epoch": "1575413255.813989000" }, { "udp_stream": 58, "frame_number": 7823, "display_filter": "frame.number == 7823", "timestamp_epoch": "1575413255.913526000" }, { "tcp_stream": 150, "frame_number": 7834, "display_filter": "frame.number == 7834", "timestamp_epoch": "1575413256.285928000" }, { "tcp_stream": 151, "frame_number": 7842, "display_filter": "frame.number == 7842", "timestamp_epoch": "1575413256.290477000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6dfd88579bb5f50bfa25b5fc", "type": "domain", "value": "track-eu.adformnet.akadns.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 38, "frame_number": 3635, "display_filter": "frame.number == 3635", "timestamp_epoch": "1575413213.479991000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8ef21ddbdde08a4dae6d5fe5", "type": "domain", "value": "track.adform.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 38, "frame_number": 3632, "display_filter": "frame.number == 3632", "timestamp_epoch": "1575413213.379305000" }, { "udp_stream": 38, "frame_number": 3635, "display_filter": "frame.number == 3635", "timestamp_epoch": "1575413213.479991000" }, { "tcp_stream": 88, "frame_number": 3640, "display_filter": "frame.number == 3640", "timestamp_epoch": "1575413213.661480000" }, { "tcp_stream": 89, "frame_number": 3644, "display_filter": "frame.number == 3644", "timestamp_epoch": "1575413213.662436000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2e87e4be4fb5eeaa5ded4ebd", "type": "domain", "value": "trc.taboola.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 123, "frame_number": 13183, "display_filter": "frame.number == 13183", "timestamp_epoch": "1575413306.141232000" }, { "udp_stream": 123, "frame_number": 13306, "display_filter": "frame.number == 13306", "timestamp_epoch": "1575413306.288790000" }, { "tcp_stream": 374, "frame_number": 13502, "display_filter": "frame.number == 13502", "timestamp_epoch": "1575413306.454455000" }, { "tcp_stream": 376, "frame_number": 13506, "display_filter": "frame.number == 13506", "timestamp_epoch": "1575413306.454720000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a3f18b195b20258f249b38b4", "type": "domain", "value": "trc.taboola.map.fastly.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 133, "frame_number": 14095, "display_filter": "frame.number == 14095", "timestamp_epoch": "1575413307.419283000" }, { "udp_stream": 134, "frame_number": 14321, "display_filter": "frame.number == 14321", "timestamp_epoch": "1575413308.123917000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ec835da501b440a7893751df", "type": "domain", "value": "uca20a5adbe8d64fd0c7a816e1ec.dl.dropboxusercontent.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 136, "frame_number": 14462, "display_filter": "frame.number == 14462", "timestamp_epoch": "1575413312.368596000" }, { "udp_stream": 136, "frame_number": 14467, "display_filter": "frame.number == 14467", "timestamp_epoch": "1575413312.488886000" }, { "tcp_stream": 417, "frame_number": 14472, "display_filter": "frame.number == 14472", "timestamp_epoch": "1575413312.544103000" }, { "tcp_stream": 418, "frame_number": 14476, "display_filter": "frame.number == 14476", "timestamp_epoch": "1575413312.558850000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-249161752c98b681ba61fff5", "type": "domain", "value": "udc.yahoo.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 16, "frame_number": 639, "display_filter": "frame.number == 639", "timestamp_epoch": "1575413160.313364000" }, { "udp_stream": 16, "frame_number": 644, "display_filter": "frame.number == 644", "timestamp_epoch": "1575413160.441484000" }, { "tcp_stream": 34, "frame_number": 658, "display_filter": "frame.number == 658", "timestamp_epoch": "1575413160.625245000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-33d496bb4fcc17b08e2b8857", "type": "domain", "value": "uipus.semasio.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 37, "frame_number": 3572, "display_filter": "frame.number == 3572", "timestamp_epoch": "1575413212.793168000" }, { "udp_stream": 37, "frame_number": 3573, "display_filter": "frame.number == 3573", "timestamp_epoch": "1575413212.855201000" }, { "tcp_stream": 85, "frame_number": 3578, "display_filter": "frame.number == 3578", "timestamp_epoch": "1575413212.926880000" }, { "tcp_stream": 86, "frame_number": 3582, "display_filter": "frame.number == 3582", "timestamp_epoch": "1575413212.935659000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1a5e02e7cada0f4978dcc449", "type": "domain", "value": "um.simpli.fi", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 103, "frame_number": 10791, "display_filter": "frame.number == 10791", "timestamp_epoch": "1575413267.658014000" }, { "udp_stream": 103, "frame_number": 10851, "display_filter": "frame.number == 10851", "timestamp_epoch": "1575413267.965671000" }, { "tcp_stream": 266, "frame_number": 10956, "display_filter": "frame.number == 10956", "timestamp_epoch": "1575413268.297506000" }, { "tcp_stream": 267, "frame_number": 10958, "display_filter": "frame.number == 10958", "timestamp_epoch": "1575413268.297953000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-dc0b04c8d6a2001f2dd19f7a", "type": "domain", "value": "ups.analytics.yahoo.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 84, "frame_number": 9786, "display_filter": "frame.number == 9786", "timestamp_epoch": "1575413264.031399000" }, { "udp_stream": 84, "frame_number": 9864, "display_filter": "frame.number == 9864", "timestamp_epoch": "1575413264.518110000" }, { "tcp_stream": 226, "frame_number": 9945, "display_filter": "frame.number == 9945", "timestamp_epoch": "1575413264.761913000" }, { "tcp_stream": 225, "frame_number": 9949, "display_filter": "frame.number == 9949", "timestamp_epoch": "1575413264.767142000" }, { "tcp_stream": 227, "frame_number": 9958, "display_filter": "frame.number == 9958", "timestamp_epoch": "1575413264.781322000" }, { "tcp_stream": 228, "frame_number": 9967, "display_filter": "frame.number == 9967", "timestamp_epoch": "1575413264.809328000" }, { "tcp_stream": 231, "frame_number": 10046, "display_filter": "frame.number == 10046", "timestamp_epoch": "1575413265.135652000" }, { "tcp_stream": 232, "frame_number": 10075, "display_filter": "frame.number == 10075", "timestamp_epoch": "1575413265.180626000" }, { "tcp_stream": 339, "frame_number": 13088, "display_filter": "frame.number == 13088", "timestamp_epoch": "1575413306.076614000" }, { "tcp_stream": 340, "frame_number": 13090, "display_filter": "frame.number == 13090", "timestamp_epoch": "1575413306.076939000" }, { "tcp_stream": 347, "frame_number": 13212, "display_filter": "frame.number == 13212", "timestamp_epoch": "1575413306.180845000" }, { "tcp_stream": 350, "frame_number": 13240, "display_filter": "frame.number == 13240", "timestamp_epoch": "1575413306.232839000" }, { "tcp_stream": 363, "frame_number": 13384, "display_filter": "frame.number == 13384", "timestamp_epoch": "1575413306.357452000" }, { "tcp_stream": 364, "frame_number": 13421, "display_filter": "frame.number == 13421", "timestamp_epoch": "1575413306.394494000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-67f0b87758e1e22aacf02a0b", "type": "domain", "value": "us-east-1.onemobile.yahoo.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 71, "frame_number": 9151, "display_filter": "frame.number == 9151", "timestamp_epoch": "1575413262.342123000" }, { "udp_stream": 71, "frame_number": 9152, "display_filter": "frame.number == 9152", "timestamp_epoch": "1575413262.342458000" }, { "tcp_stream": 194, "frame_number": 9223, "display_filter": "frame.number == 9223", "timestamp_epoch": "1575413262.518154000" }, { "tcp_stream": 193, "frame_number": 9230, "display_filter": "frame.number == 9230", "timestamp_epoch": "1575413262.519436000" }, { "tcp_stream": 302, "frame_number": 12576, "display_filter": "frame.number == 12576", "timestamp_epoch": "1575413304.669487000" }, { "tcp_stream": 301, "frame_number": 12577, "display_filter": "frame.number == 12577", "timestamp_epoch": "1575413304.669548000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-64816507c90535f8f2dc4861", "type": "domain", "value": "us.y.atwola.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 19, "frame_number": 919, "display_filter": "frame.number == 919", "timestamp_epoch": "1575413162.712452000" }, { "udp_stream": 19, "frame_number": 934, "display_filter": "frame.number == 934", "timestamp_epoch": "1575413162.915618000" }, { "tcp_stream": 43, "frame_number": 974, "display_filter": "frame.number == 974", "timestamp_epoch": "1575413162.993239000" }, { "tcp_stream": 44, "frame_number": 978, "display_filter": "frame.number == 978", "timestamp_epoch": "1575413162.998330000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-92302ffc29d33e2ec022cabc", "type": "domain", "value": "w8.wensa.at", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:52.017176+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:52.011531+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 137, "frame_number": 15280, "display_filter": "frame.number == 15280", "timestamp_epoch": "1575413425.196289000" }, { "udp_stream": 137, "frame_number": 15281, "display_filter": "frame.number == 15281", "timestamp_epoch": "1575413425.403718000" }, { "udp_stream": 138, "frame_number": 15575, "display_filter": "frame.number == 15575", "timestamp_epoch": "1575413428.383528000" }, { "udp_stream": 138, "frame_number": 15576, "display_filter": "frame.number == 15576", "timestamp_epoch": "1575413428.584602000" }, { "udp_stream": 145, "frame_number": 15950, "display_filter": "frame.number == 15950", "timestamp_epoch": "1575413433.872759000" }, { "udp_stream": 145, "frame_number": 15951, "display_filter": "frame.number == 15951", "timestamp_epoch": "1575413434.109141000" }, { "tcp_stream": 420, "frame_number": 15288, "display_filter": "frame.number == 15288", "timestamp_epoch": "1575413425.959473000" }, { "tcp_stream": 422, "frame_number": 15581, "display_filter": "frame.number == 15581", "timestamp_epoch": "1575413428.857662000" }, { "tcp_stream": 424, "frame_number": 15956, "display_filter": "frame.number == 15956", "timestamp_epoch": "1575413434.456567000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:52.006333+00:00" }, { "observable_id": "observable-31034cb0bf2481f4c9756fb1", "type": "domain", "value": "wpad.icemaiden.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 170, "frame_number": 16503, "display_filter": "frame.number == 16503", "timestamp_epoch": "1575414483.742573000" }, { "udp_stream": 170, "frame_number": 16504, "display_filter": "frame.number == 16504", "timestamp_epoch": "1575414483.742885000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-401235d4cc9b6da23fe80a2e", "type": "domain", "value": "wpad.localdomain", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 171, "frame_number": 16505, "display_filter": "frame.number == 16505", "timestamp_epoch": "1575414483.743130000" }, { "udp_stream": 171, "frame_number": 16509, "display_filter": "frame.number == 16509", "timestamp_epoch": "1575414483.793161000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b3a7449f7eb29dd256815c62", "type": "domain", "value": "www.aol.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 44, "frame_number": 4889, "display_filter": "frame.number == 4889", "timestamp_epoch": "1575413246.290389000" }, { "udp_stream": 44, "frame_number": 4922, "display_filter": "frame.number == 4922", "timestamp_epoch": "1575413246.488601000" }, { "tcp_stream": 111, "frame_number": 4971, "display_filter": "frame.number == 4971", "timestamp_epoch": "1575413246.594631000" }, { "tcp_stream": 112, "frame_number": 4972, "display_filter": "frame.number == 4972", "timestamp_epoch": "1575413246.594703000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-49c3a49e67450740ad70a995", "type": "domain", "value": "www.bankofamerica.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 188, "frame_number": 18643, "display_filter": "frame.number == 18643", "timestamp_epoch": "1575414491.729589000" }, { "udp_stream": 188, "frame_number": 18644, "display_filter": "frame.number == 18644", "timestamp_epoch": "1575414491.788534000" }, { "tcp_stream": 471, "frame_number": 18673, "display_filter": "frame.number == 18673", "timestamp_epoch": "1575414491.901387000" }, { "tcp_stream": 472, "frame_number": 18675, "display_filter": "frame.number == 18675", "timestamp_epoch": "1575414491.901956000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-997e0546c817cbb378c61b65", "type": "domain", "value": "www.bing.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 10, "frame_number": 550, "display_filter": "frame.number == 550", "timestamp_epoch": "1575413159.406992000" }, { "udp_stream": 13, "frame_number": 553, "display_filter": "frame.number == 553", "timestamp_epoch": "1575413159.407451000" }, { "udp_stream": 14, "frame_number": 554, "display_filter": "frame.number == 554", "timestamp_epoch": "1575413159.407503000" }, { "udp_stream": 15, "frame_number": 555, "display_filter": "frame.number == 555", "timestamp_epoch": "1575413159.407726000" }, { "udp_stream": 13, "frame_number": 556, "display_filter": "frame.number == 556", "timestamp_epoch": "1575413159.571651000" }, { "udp_stream": 14, "frame_number": 557, "display_filter": "frame.number == 557", "timestamp_epoch": "1575413159.571721000" }, { "udp_stream": 15, "frame_number": 558, "display_filter": "frame.number == 558", "timestamp_epoch": "1575413159.571772000" }, { "udp_stream": 10, "frame_number": 559, "display_filter": "frame.number == 559", "timestamp_epoch": "1575413159.571825000" }, { "udp_stream": 113, "frame_number": 12656, "display_filter": "frame.number == 12656", "timestamp_epoch": "1575413305.238225000" }, { "udp_stream": 114, "frame_number": 12657, "display_filter": "frame.number == 12657", "timestamp_epoch": "1575413305.239167000" }, { "udp_stream": 115, "frame_number": 12662, "display_filter": "frame.number == 12662", "timestamp_epoch": "1575413305.242542000" }, { "udp_stream": 116, "frame_number": 12663, "display_filter": "frame.number == 12663", "timestamp_epoch": "1575413305.243188000" }, { "udp_stream": 114, "frame_number": 12765, "display_filter": "frame.number == 12765", "timestamp_epoch": "1575413305.326078000" }, { "udp_stream": 115, "frame_number": 12766, "display_filter": "frame.number == 12766", "timestamp_epoch": "1575413305.326160000" }, { "udp_stream": 116, "frame_number": 12767, "display_filter": "frame.number == 12767", "timestamp_epoch": "1575413305.326217000" }, { "udp_stream": 113, "frame_number": 12768, "display_filter": "frame.number == 12768", "timestamp_epoch": "1575413305.326272000" }, { "udp_stream": 141, "frame_number": 15896, "display_filter": "frame.number == 15896", "timestamp_epoch": "1575413432.610799000" }, { "udp_stream": 142, "frame_number": 15897, "display_filter": "frame.number == 15897", "timestamp_epoch": "1575413432.611022000" }, { "udp_stream": 143, "frame_number": 15900, "display_filter": "frame.number == 15900", "timestamp_epoch": "1575413432.612065000" }, { "udp_stream": 144, "frame_number": 15901, "display_filter": "frame.number == 15901", "timestamp_epoch": "1575413432.612721000" } ], "roles": [ "dns-query", "http-host", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b156e1af2781b5fd861b3b04", "type": "domain", "value": "www.download.windowsupdate.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 96, "frame_number": 10540, "display_filter": "frame.number == 10540", "timestamp_epoch": "1575413266.407974000" }, { "udp_stream": 97, "frame_number": 10559, "display_filter": "frame.number == 10559", "timestamp_epoch": "1575413266.470287000" }, { "udp_stream": 97, "frame_number": 10617, "display_filter": "frame.number == 10617", "timestamp_epoch": "1575413266.894861000" }, { "udp_stream": 96, "frame_number": 10618, "display_filter": "frame.number == 10618", "timestamp_epoch": "1575413266.894952000" }, { "tcp_stream": 256, "frame_number": 10681, "display_filter": "frame.number == 10681", "timestamp_epoch": "1575413267.275134000" }, { "tcp_stream": 257, "frame_number": 10684, "display_filter": "frame.number == 10684", "timestamp_epoch": "1575413267.275288000" }, { "tcp_stream": 256, "frame_number": 10744, "display_filter": "frame.number == 10744", "timestamp_epoch": "1575413267.573647000" }, { "tcp_stream": 257, "frame_number": 10746, "display_filter": "frame.number == 10746", "timestamp_epoch": "1575413267.574570000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-da4c633bb5911121aa3e0378", "type": "domain", "value": "www.dropbox-dns.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 135, "frame_number": 14419, "display_filter": "frame.number == 14419", "timestamp_epoch": "1575413311.311989000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c49c5c1ffd8c15bc4d3ab37d", "type": "domain", "value": "www.dropbox.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 135, "frame_number": 14418, "display_filter": "frame.number == 14418", "timestamp_epoch": "1575413311.212281000" }, { "udp_stream": 135, "frame_number": 14419, "display_filter": "frame.number == 14419", "timestamp_epoch": "1575413311.311989000" }, { "tcp_stream": 415, "frame_number": 14424, "display_filter": "frame.number == 14424", "timestamp_epoch": "1575413311.393541000" }, { "tcp_stream": 416, "frame_number": 14428, "display_filter": "frame.number == 14428", "timestamp_epoch": "1575413311.400103000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4d779cc905bd60ec4ef799bd", "type": "domain", "value": "www.googletagservices.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 57, "frame_number": 7651, "display_filter": "frame.number == 7651", "timestamp_epoch": "1575413255.030588000" }, { "udp_stream": 57, "frame_number": 7658, "display_filter": "frame.number == 7658", "timestamp_epoch": "1575413255.123657000" }, { "tcp_stream": 147, "frame_number": 7673, "display_filter": "frame.number == 7673", "timestamp_epoch": "1575413255.177741000" }, { "tcp_stream": 146, "frame_number": 7675, "display_filter": "frame.number == 7675", "timestamp_epoch": "1575413255.177936000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4ce79b1c2dc53deecfffa286", "type": "domain", "value": "wwwui.ecglb.bac.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 188, "frame_number": 18644, "display_filter": "frame.number == 18644", "timestamp_epoch": "1575414491.788534000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a39a17d5bad1845605c59bca", "type": "domain", "value": "x.bidswitch.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 79, "frame_number": 9293, "display_filter": "frame.number == 9293", "timestamp_epoch": "1575413262.584920000" }, { "udp_stream": 79, "frame_number": 9350, "display_filter": "frame.number == 9350", "timestamp_epoch": "1575413262.658303000" }, { "tcp_stream": 213, "frame_number": 9446, "display_filter": "frame.number == 9446", "timestamp_epoch": "1575413262.859490000" }, { "tcp_stream": 214, "frame_number": 9463, "display_filter": "frame.number == 9463", "timestamp_epoch": "1575413262.866931000" }, { "tcp_stream": 321, "frame_number": 12748, "display_filter": "frame.number == 12748", "timestamp_epoch": "1575413305.323686000" }, { "tcp_stream": 322, "frame_number": 12750, "display_filter": "frame.number == 12750", "timestamp_epoch": "1575413305.323733000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-18bf3edf5097d06c55687782", "type": "domain", "value": "z.moatads.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 54, "frame_number": 7490, "display_filter": "frame.number == 7490", "timestamp_epoch": "1575413254.183995000" }, { "udp_stream": 54, "frame_number": 7496, "display_filter": "frame.number == 7496", "timestamp_epoch": "1575413254.362555000" }, { "tcp_stream": 140, "frame_number": 7501, "display_filter": "frame.number == 7501", "timestamp_epoch": "1575413254.454880000" }, { "tcp_stream": 141, "frame_number": 7505, "display_filter": "frame.number == 7505", "timestamp_epoch": "1575413254.478688000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ec64f490a016be45d2598e23", "type": "ipv4", "value": "10.18.20.255", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d31c7d261bf8696ac872b605", "type": "ipv4", "value": "10.18.20.8", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9224b2fac6a83caa6e9b14d0", "type": "ipv4", "value": "10.18.20.97", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-abf73086dfc3da1242c2d051", "type": "ipv4", "value": "100.24.88.255", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 70, "frame_number": 9126, "display_filter": "frame.number == 9126", "timestamp_epoch": "1575413262.266157000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1626197846f93bd04777382f", "type": "ipv4", "value": "101.226.79.205", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 137, "frame_number": 15281, "display_filter": "frame.number == 15281", "timestamp_epoch": "1575413425.403718000" }, { "udp_stream": 138, "frame_number": 15576, "display_filter": "frame.number == 15576", "timestamp_epoch": "1575413428.584602000" }, { "udp_stream": 145, "frame_number": 15951, "display_filter": "frame.number == 15951", "timestamp_epoch": "1575413434.109141000" }, { "udp_stream": 146, "frame_number": 15967, "display_filter": "frame.number == 15967", "timestamp_epoch": "1575413440.498835000" }, { "udp_stream": 159, "frame_number": 16149, "display_filter": "frame.number == 16149", "timestamp_epoch": "1575413455.357740000" }, { "udp_stream": 160, "frame_number": 16160, "display_filter": "frame.number == 16160", "timestamp_epoch": "1575413456.425216000" }, { "udp_stream": 161, "frame_number": 16179, "display_filter": "frame.number == 16179", "timestamp_epoch": "1575413457.526856000" }, { "udp_stream": 162, "frame_number": 16196, "display_filter": "frame.number == 16196", "timestamp_epoch": "1575413468.760703000" }, { "udp_stream": 163, "frame_number": 16209, "display_filter": "frame.number == 16209", "timestamp_epoch": "1575413469.819055000" }, { "udp_stream": 164, "frame_number": 16309, "display_filter": "frame.number == 16309", "timestamp_epoch": "1575413756.347599000" }, { "udp_stream": 165, "frame_number": 16432, "display_filter": "frame.number == 16432", "timestamp_epoch": "1575414056.349092000" }, { "udp_stream": 166, "frame_number": 16443, "display_filter": "frame.number == 16443", "timestamp_epoch": "1575414057.413839000" }, { "udp_stream": 168, "frame_number": 16487, "display_filter": "frame.number == 16487", "timestamp_epoch": "1575414357.417756000" }, { "udp_stream": 190, "frame_number": 21099, "display_filter": "frame.number == 21099", "timestamp_epoch": "1575414657.443819000" }, { "udp_stream": 191, "frame_number": 21110, "display_filter": "frame.number == 21110", "timestamp_epoch": "1575414658.500356000" }, { "udp_stream": 192, "frame_number": 21123, "display_filter": "frame.number == 21123", "timestamp_epoch": "1575414669.784425000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b58a2df6f2b7daa30049a8ff", "type": "ipv4", "value": "104.17.119.107", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 125, "frame_number": 13293, "display_filter": "frame.number == 13293", "timestamp_epoch": "1575413306.272141000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3a6d731eaa5b21ac0937494c", "type": "ipv4", "value": "104.17.120.107", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 125, "frame_number": 13293, "display_filter": "frame.number == 13293", "timestamp_epoch": "1575413306.272141000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7c48f815ef43b61f855afb4e", "type": "ipv4", "value": "104.193.80.60", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 118, "frame_number": 13081, "display_filter": "frame.number == 13081", "timestamp_epoch": "1575413306.074332000" }, { "udp_stream": 129, "frame_number": 13307, "display_filter": "frame.number == 13307", "timestamp_epoch": "1575413306.288918000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e2123fe179d9a2574663aca9", "type": "ipv4", "value": "104.254.148.133", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 81, "frame_number": 9344, "display_filter": "frame.number == 9344", "timestamp_epoch": "1575413262.653946000" }, { "udp_stream": 131, "frame_number": 14067, "display_filter": "frame.number == 14067", "timestamp_epoch": "1575413307.383718000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4d342cb1c4055ab826d4ef2e", "type": "ipv4", "value": "104.254.148.165", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 81, "frame_number": 9344, "display_filter": "frame.number == 9344", "timestamp_epoch": "1575413262.653946000" }, { "udp_stream": 131, "frame_number": 14067, "display_filter": "frame.number == 14067", "timestamp_epoch": "1575413307.383718000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4852f1425157e3ac4c2381c6", "type": "ipv4", "value": "104.254.148.196", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 81, "frame_number": 9344, "display_filter": "frame.number == 9344", "timestamp_epoch": "1575413262.653946000" }, { "udp_stream": 131, "frame_number": 14067, "display_filter": "frame.number == 14067", "timestamp_epoch": "1575413307.383718000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ecfce700c068823a4315cfed", "type": "ipv4", "value": "104.254.148.198", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 81, "frame_number": 9344, "display_filter": "frame.number == 9344", "timestamp_epoch": "1575413262.653946000" }, { "udp_stream": 131, "frame_number": 14067, "display_filter": "frame.number == 14067", "timestamp_epoch": "1575413307.383718000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-441def818ba878faa869f0a1", "type": "ipv4", "value": "104.254.149.100", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 81, "frame_number": 9344, "display_filter": "frame.number == 9344", "timestamp_epoch": "1575413262.653946000" }, { "udp_stream": 131, "frame_number": 14067, "display_filter": "frame.number == 14067", "timestamp_epoch": "1575413307.383718000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f56ed31669039b387efa21e1", "type": "ipv4", "value": "104.254.149.101", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 81, "frame_number": 9344, "display_filter": "frame.number == 9344", "timestamp_epoch": "1575413262.653946000" }, { "udp_stream": 131, "frame_number": 14067, "display_filter": "frame.number == 14067", "timestamp_epoch": "1575413307.383718000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-911d93e6eadbdf909f7eb5b9", "type": "ipv4", "value": "104.254.149.68", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 81, "frame_number": 9344, "display_filter": "frame.number == 9344", "timestamp_epoch": "1575413262.653946000" }, { "udp_stream": 131, "frame_number": 14067, "display_filter": "frame.number == 14067", "timestamp_epoch": "1575413307.383718000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2212c28fc2dff9f7e55dce5d", "type": "ipv4", "value": "104.254.149.69", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 81, "frame_number": 9344, "display_filter": "frame.number == 9344", "timestamp_epoch": "1575413262.653946000" }, { "udp_stream": 131, "frame_number": 14067, "display_filter": "frame.number == 14067", "timestamp_epoch": "1575413307.383718000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cebc1da97b8c4e766d15bdd9", "type": "ipv4", "value": "104.36.113.17", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 108, "frame_number": 10910, "display_filter": "frame.number == 10910", "timestamp_epoch": "1575413268.262916000" }, { "udp_stream": 109, "frame_number": 10931, "display_filter": "frame.number == 10931", "timestamp_epoch": "1575413268.278653000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2d53ca4541325d978de539f3", "type": "ipv4", "value": "104.36.113.23", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 85, "frame_number": 9934, "display_filter": "frame.number == 9934", "timestamp_epoch": "1575413264.714628000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e46cafa851fdbebecbca94bc", "type": "ipv4", "value": "104.36.113.24", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 107, "frame_number": 10924, "display_filter": "frame.number == 10924", "timestamp_epoch": "1575413268.273846000" }, { "udp_stream": 112, "frame_number": 11592, "display_filter": "frame.number == 11592", "timestamp_epoch": "1575413269.831186000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4626bfafbad8683a0e5dae17", "type": "ipv4", "value": "104.69.23.209", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 117, "frame_number": 12826, "display_filter": "frame.number == 12826", "timestamp_epoch": "1575413305.449366000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4ceaeeecaef2130a058af2d2", "type": "ipv4", "value": "107.178.246.49", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 132, "frame_number": 14090, "display_filter": "frame.number == 14090", "timestamp_epoch": "1575413307.406763000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3b4157b52c5b538a2715f5c1", "type": "ipv4", "value": "107.23.111.253", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 70, "frame_number": 9126, "display_filter": "frame.number == 9126", "timestamp_epoch": "1575413262.266157000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3bf55c691ba6a14f147f37db", "type": "ipv4", "value": "107.23.112.106", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 52, "frame_number": 7233, "display_filter": "frame.number == 7233", "timestamp_epoch": "1575413253.235151000" }, { "udp_stream": 56, "frame_number": 7655, "display_filter": "frame.number == 7655", "timestamp_epoch": "1575413255.099136000" }, { "udp_stream": 71, "frame_number": 9152, "display_filter": "frame.number == 9152", "timestamp_epoch": "1575413262.342458000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-295a8bfb49942cf0b0951cd1", "type": "ipv4", "value": "107.23.26.245", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 84, "frame_number": 9864, "display_filter": "frame.number == 9864", "timestamp_epoch": "1575413264.518110000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-38c6ad687751a49e7297ec5c", "type": "ipv4", "value": "107.23.4.236", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 92, "frame_number": 9982, "display_filter": "frame.number == 9982", "timestamp_epoch": "1575413264.913423000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e84b57f76ea13b0ef5fae632", "type": "ipv4", "value": "107.23.73.96", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 39, "frame_number": 3795, "display_filter": "frame.number == 3795", "timestamp_epoch": "1575413237.897960000" }, { "udp_stream": 40, "frame_number": 3837, "display_filter": "frame.number == 3837", "timestamp_epoch": "1575413238.558263000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0fbd669116dceddddeacc579", "type": "ipv4", "value": "119.28.48.231", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 137, "frame_number": 15281, "display_filter": "frame.number == 15281", "timestamp_epoch": "1575413425.403718000" }, { "udp_stream": 138, "frame_number": 15576, "display_filter": "frame.number == 15576", "timestamp_epoch": "1575413428.584602000" }, { "udp_stream": 145, "frame_number": 15951, "display_filter": "frame.number == 15951", "timestamp_epoch": "1575413434.109141000" }, { "udp_stream": 146, "frame_number": 15967, "display_filter": "frame.number == 15967", "timestamp_epoch": "1575413440.498835000" }, { "udp_stream": 159, "frame_number": 16149, "display_filter": "frame.number == 16149", "timestamp_epoch": "1575413455.357740000" }, { "udp_stream": 160, "frame_number": 16160, "display_filter": "frame.number == 16160", "timestamp_epoch": "1575413456.425216000" }, { "udp_stream": 161, "frame_number": 16179, "display_filter": "frame.number == 16179", "timestamp_epoch": "1575413457.526856000" }, { "udp_stream": 162, "frame_number": 16196, "display_filter": "frame.number == 16196", "timestamp_epoch": "1575413468.760703000" }, { "udp_stream": 163, "frame_number": 16209, "display_filter": "frame.number == 16209", "timestamp_epoch": "1575413469.819055000" }, { "udp_stream": 164, "frame_number": 16309, "display_filter": "frame.number == 16309", "timestamp_epoch": "1575413756.347599000" }, { "udp_stream": 165, "frame_number": 16432, "display_filter": "frame.number == 16432", "timestamp_epoch": "1575414056.349092000" }, { "udp_stream": 166, "frame_number": 16443, "display_filter": "frame.number == 16443", "timestamp_epoch": "1575414057.413839000" }, { "udp_stream": 168, "frame_number": 16487, "display_filter": "frame.number == 16487", "timestamp_epoch": "1575414357.417756000" }, { "udp_stream": 190, "frame_number": 21099, "display_filter": "frame.number == 21099", "timestamp_epoch": "1575414657.443819000" }, { "udp_stream": 191, "frame_number": 21110, "display_filter": "frame.number == 21110", "timestamp_epoch": "1575414658.500356000" }, { "udp_stream": 192, "frame_number": 21123, "display_filter": "frame.number == 21123", "timestamp_epoch": "1575414669.784425000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-83b3fc5871fc74b10b2d759e", "type": "ipv4", "value": "129.33.138.31", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 187, "frame_number": 18068, "display_filter": "frame.number == 18068", "timestamp_epoch": "1575414490.617736000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5777453edd2690d75fad9b05", "type": "ipv4", "value": "13.107.21.200", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 13, "frame_number": 556, "display_filter": "frame.number == 556", "timestamp_epoch": "1575413159.571651000" }, { "udp_stream": 14, "frame_number": 557, "display_filter": "frame.number == 557", "timestamp_epoch": "1575413159.571721000" }, { "udp_stream": 15, "frame_number": 558, "display_filter": "frame.number == 558", "timestamp_epoch": "1575413159.571772000" }, { "udp_stream": 10, "frame_number": 559, "display_filter": "frame.number == 559", "timestamp_epoch": "1575413159.571825000" }, { "udp_stream": 114, "frame_number": 12765, "display_filter": "frame.number == 12765", "timestamp_epoch": "1575413305.326078000" }, { "udp_stream": 115, "frame_number": 12766, "display_filter": "frame.number == 12766", "timestamp_epoch": "1575413305.326160000" }, { "udp_stream": 116, "frame_number": 12767, "display_filter": "frame.number == 12767", "timestamp_epoch": "1575413305.326217000" }, { "udp_stream": 113, "frame_number": 12768, "display_filter": "frame.number == 12768", "timestamp_epoch": "1575413305.326272000" }, { "udp_stream": 142, "frame_number": 15930, "display_filter": "frame.number == 15930", "timestamp_epoch": "1575413432.778153000" }, { "udp_stream": 143, "frame_number": 15931, "display_filter": "frame.number == 15931", "timestamp_epoch": "1575413432.778226000" }, { "udp_stream": 144, "frame_number": 15932, "display_filter": "frame.number == 15932", "timestamp_epoch": "1575413432.778283000" }, { "udp_stream": 141, "frame_number": 15933, "display_filter": "frame.number == 15933", "timestamp_epoch": "1575413432.778338000" }, { "udp_stream": 176, "frame_number": 17248, "display_filter": "frame.number == 17248", "timestamp_epoch": "1575414487.898629000" }, { "udp_stream": 178, "frame_number": 17249, "display_filter": "frame.number == 17249", "timestamp_epoch": "1575414487.898713000" }, { "udp_stream": 179, "frame_number": 17250, "display_filter": "frame.number == 17250", "timestamp_epoch": "1575414487.898793000" }, { "udp_stream": 175, "frame_number": 17251, "display_filter": "frame.number == 17251", "timestamp_epoch": "1575414487.898873000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-444fae800ecdaeb798557f74", "type": "ipv4", "value": "13.107.5.80", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 11, "frame_number": 560, "display_filter": "frame.number == 560", "timestamp_epoch": "1575413159.571932000" }, { "udp_stream": 12, "frame_number": 561, "display_filter": "frame.number == 561", "timestamp_epoch": "1575413159.572020000" }, { "udp_stream": 140, "frame_number": 15924, "display_filter": "frame.number == 15924", "timestamp_epoch": "1575413432.761525000" }, { "udp_stream": 139, "frame_number": 15925, "display_filter": "frame.number == 15925", "timestamp_epoch": "1575413432.761612000" }, { "udp_stream": 180, "frame_number": 17245, "display_filter": "frame.number == 17245", "timestamp_epoch": "1575414487.898383000" }, { "udp_stream": 177, "frame_number": 17247, "display_filter": "frame.number == 17247", "timestamp_epoch": "1575414487.898510000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-019e7520dd77dc655c14b706", "type": "ipv4", "value": "13.249.22.105", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 64, "frame_number": 8202, "display_filter": "frame.number == 8202", "timestamp_epoch": "1575413258.371041000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-514300caa1e6feec3bd00c0c", "type": "ipv4", "value": "13.249.22.83", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 64, "frame_number": 8202, "display_filter": "frame.number == 8202", "timestamp_epoch": "1575413258.371041000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8d95d7e6db80bd76409691f9", "type": "ipv4", "value": "13.249.22.84", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 64, "frame_number": 8202, "display_filter": "frame.number == 8202", "timestamp_epoch": "1575413258.371041000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-697c4a7feb91fdfd1b25450a", "type": "ipv4", "value": "13.249.22.87", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 64, "frame_number": 8202, "display_filter": "frame.number == 8202", "timestamp_epoch": "1575413258.371041000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2bce9bb7a1bcdd51ffbdfcb2", "type": "ipv4", "value": "130.248.144.16", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 181, "frame_number": 17335, "display_filter": "frame.number == 17335", "timestamp_epoch": "1575414489.184029000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8bf3732fa5d71b4098955de5", "type": "ipv4", "value": "130.248.144.17", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 181, "frame_number": 17335, "display_filter": "frame.number == 17335", "timestamp_epoch": "1575414489.184029000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ded2b8249a70d699f9fe94dc", "type": "ipv4", "value": "130.248.144.18", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 181, "frame_number": 17335, "display_filter": "frame.number == 17335", "timestamp_epoch": "1575414489.184029000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c3102a39d68eee7a8e413128", "type": "ipv4", "value": "130.248.144.19", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 181, "frame_number": 17335, "display_filter": "frame.number == 17335", "timestamp_epoch": "1575414489.184029000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4ecf0a0b046b5bb5c46d7481", "type": "ipv4", "value": "130.248.144.23", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 181, "frame_number": 17335, "display_filter": "frame.number == 17335", "timestamp_epoch": "1575414489.184029000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cd312c13da125f8c4c1f02c8", "type": "ipv4", "value": "131.107.255.255", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 2, "frame_number": 257, "display_filter": "frame.number == 257", "timestamp_epoch": "1575413123.352446000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8dc2b8aa2d347bb415f91cc8", "type": "ipv4", "value": "134.209.129.254", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 128, "frame_number": 13344, "display_filter": "frame.number == 13344", "timestamp_epoch": "1575413306.297988000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b52f047ac24984f0adc15af4", "type": "ipv4", "value": "151.101.0.166", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 16, "frame_number": 13337, "display_filter": "frame.number == 13337", "timestamp_epoch": "1575413306.294911000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f6ee905a2676b897eb906ba0", "type": "ipv4", "value": "151.101.128.166", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 16, "frame_number": 13337, "display_filter": "frame.number == 13337", "timestamp_epoch": "1575413306.294911000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9d55340d034c37eaf0e2803b", "type": "ipv4", "value": "151.101.130.2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 123, "frame_number": 13306, "display_filter": "frame.number == 13306", "timestamp_epoch": "1575413306.288790000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ef52dadc716702ec36a69e7e", "type": "ipv4", "value": "151.101.130.49", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 99, "frame_number": 10840, "display_filter": "frame.number == 10840", "timestamp_epoch": "1575413267.869627000" }, { "udp_stream": 133, "frame_number": 14095, "display_filter": "frame.number == 14095", "timestamp_epoch": "1575413307.419283000" }, { "udp_stream": 134, "frame_number": 14321, "display_filter": "frame.number == 14321", "timestamp_epoch": "1575413308.123917000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8db610826d35e418eb0434b2", "type": "ipv4", "value": "151.101.192.166", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 16, "frame_number": 13337, "display_filter": "frame.number == 13337", "timestamp_epoch": "1575413306.294911000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8281da5f1499ae8725bd39d6", "type": "ipv4", "value": "151.101.194.2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 123, "frame_number": 13306, "display_filter": "frame.number == 13306", "timestamp_epoch": "1575413306.288790000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-12f75831784690ec4c0544ea", "type": "ipv4", "value": "151.101.194.49", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 99, "frame_number": 10840, "display_filter": "frame.number == 10840", "timestamp_epoch": "1575413267.869627000" }, { "udp_stream": 133, "frame_number": 14095, "display_filter": "frame.number == 14095", "timestamp_epoch": "1575413307.419283000" }, { "udp_stream": 134, "frame_number": 14321, "display_filter": "frame.number == 14321", "timestamp_epoch": "1575413308.123917000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3780aaaeafee23ffabe8c9f0", "type": "ipv4", "value": "151.101.2.2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 123, "frame_number": 13306, "display_filter": "frame.number == 13306", "timestamp_epoch": "1575413306.288790000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2dacfd2063f084a073586c6d", "type": "ipv4", "value": "151.101.2.49", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 99, "frame_number": 10840, "display_filter": "frame.number == 10840", "timestamp_epoch": "1575413267.869627000" }, { "udp_stream": 133, "frame_number": 14095, "display_filter": "frame.number == 14095", "timestamp_epoch": "1575413307.419283000" }, { "udp_stream": 134, "frame_number": 14321, "display_filter": "frame.number == 14321", "timestamp_epoch": "1575413308.123917000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-bd3bc059462cd6c537490550", "type": "ipv4", "value": "151.101.64.166", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 16, "frame_number": 13337, "display_filter": "frame.number == 13337", "timestamp_epoch": "1575413306.294911000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d2b494563fd89c0b32284de2", "type": "ipv4", "value": "151.101.66.2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 123, "frame_number": 13306, "display_filter": "frame.number == 13306", "timestamp_epoch": "1575413306.288790000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7c79a5ea695879350448e5da", "type": "ipv4", "value": "151.101.66.49", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 99, "frame_number": 10840, "display_filter": "frame.number == 10840", "timestamp_epoch": "1575413267.869627000" }, { "udp_stream": 133, "frame_number": 14095, "display_filter": "frame.number == 14095", "timestamp_epoch": "1575413307.419283000" }, { "udp_stream": 134, "frame_number": 14321, "display_filter": "frame.number == 14321", "timestamp_epoch": "1575413308.123917000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b345365ded2c8f9b851755bf", "type": "ipv4", "value": "152.195.14.41", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 24, "frame_number": 1144, "display_filter": "frame.number == 1144", "timestamp_epoch": "1575413163.522891000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1f53c052aec38f4bac302b18", "type": "ipv4", "value": "152.195.32.163", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 21, "frame_number": 929, "display_filter": "frame.number == 929", "timestamp_epoch": "1575413162.912621000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7ae363b7060bc984ac75344f", "type": "ipv4", "value": "152.195.55.192", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 42, "frame_number": 4187, "display_filter": "frame.number == 4187", "timestamp_epoch": "1575413244.607312000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-edbd045df04e0ba0a1c10e1d", "type": "ipv4", "value": "152.199.24.48", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 20, "frame_number": 928, "display_filter": "frame.number == 928", "timestamp_epoch": "1575413162.912415000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ec543c049dedd0606b4cc346", "type": "ipv4", "value": "152.199.6.11", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 22, "frame_number": 1072, "display_filter": "frame.number == 1072", "timestamp_epoch": "1575413163.219942000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7265c12fe24ef62c7910de21", "type": "ipv4", "value": "152.199.6.14", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 19, "frame_number": 934, "display_filter": "frame.number == 934", "timestamp_epoch": "1575413162.915618000" }, { "udp_stream": 48, "frame_number": 5656, "display_filter": "frame.number == 5656", "timestamp_epoch": "1575413248.903560000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cd1486b21b81e91390b9d8d7", "type": "ipv4", "value": "152.199.6.24", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 50, "frame_number": 6899, "display_filter": "frame.number == 6899", "timestamp_epoch": "1575413251.062084000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6d6679e5a03ae654a7dd134f", "type": "ipv4", "value": "156.154.136.36", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 31, "frame_number": 2659, "display_filter": "frame.number == 2659", "timestamp_epoch": "1575413167.210776000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-40e90a0eb9c1ca963aac1043", "type": "ipv4", "value": "156.154.202.36", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 31, "frame_number": 2659, "display_filter": "frame.number == 2659", "timestamp_epoch": "1575413167.210776000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e521cc1e5c5ffc7900caee8c", "type": "ipv4", "value": "162.125.8.1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 135, "frame_number": 14419, "display_filter": "frame.number == 14419", "timestamp_epoch": "1575413311.311989000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-dbb7647a68b9557e4ce3aea8", "type": "ipv4", "value": "162.125.8.6", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 136, "frame_number": 14467, "display_filter": "frame.number == 14467", "timestamp_epoch": "1575413312.488886000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-56e9638f5ae4fa161c868a5b", "type": "ipv4", "value": "169.62.192.207", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 103, "frame_number": 10851, "display_filter": "frame.number == 10851", "timestamp_epoch": "1575413267.965671000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d9a0ceb19a8a0a575d607ace", "type": "ipv4", "value": "171.161.198.200", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 169, "frame_number": 16502, "display_filter": "frame.number == 16502", "timestamp_epoch": "1575414483.604203000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6a4ce0958aa0de1b0433a911", "type": "ipv4", "value": "171.161.202.100", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 188, "frame_number": 18644, "display_filter": "frame.number == 18644", "timestamp_epoch": "1575414491.788534000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-550aa9326df0c8efce222f13", "type": "ipv4", "value": "172.217.1.130", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 57, "frame_number": 7658, "display_filter": "frame.number == 7658", "timestamp_epoch": "1575413255.123657000" }, { "udp_stream": 59, "frame_number": 7972, "display_filter": "frame.number == 7972", "timestamp_epoch": "1575413257.008584000" }, { "udp_stream": 74, "frame_number": 9306, "display_filter": "frame.number == 9306", "timestamp_epoch": "1575413262.640954000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cc3c93d60f7ea73c07ad7d20", "type": "ipv4", "value": "172.217.12.38", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 25, "frame_number": 1448, "display_filter": "frame.number == 1448", "timestamp_epoch": "1575413164.452822000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-573007f493d45b464f5bdb1e", "type": "ipv4", "value": "172.217.12.65", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 58, "frame_number": 7823, "display_filter": "frame.number == 7823", "timestamp_epoch": "1575413255.913526000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-269d6bfdf7f801ab5d5b96fc", "type": "ipv4", "value": "172.217.12.67", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 67, "frame_number": 8615, "display_filter": "frame.number == 8615", "timestamp_epoch": "1575413260.271166000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6c6d7cc79d29283d5ceda043", "type": "ipv4", "value": "172.217.14.166", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 23, "frame_number": 1069, "display_filter": "frame.number == 1069", "timestamp_epoch": "1575413163.198550000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5caf8dc4f2de755244e1d53c", "type": "ipv4", "value": "173.231.184.20", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 91, "frame_number": 9990, "display_filter": "frame.number == 9990", "timestamp_epoch": "1575413264.924248000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-78cdea9642dc3164d8528b0c", "type": "ipv4", "value": "174.129.98.238", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 189, "frame_number": 18913, "display_filter": "frame.number == 18913", "timestamp_epoch": "1575414494.106735000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f7cacf564d4c0a88d8a2784e", "type": "ipv4", "value": "18.190.121.125", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 26, "frame_number": 2223, "display_filter": "frame.number == 2223", "timestamp_epoch": "1575413165.992964000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-afb03954389d024b342587c7", "type": "ipv4", "value": "18.207.32.160", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 184, "frame_number": 17359, "display_filter": "frame.number == 17359", "timestamp_epoch": "1575414489.334625000" }, { "udp_stream": 185, "frame_number": 17386, "display_filter": "frame.number == 17386", "timestamp_epoch": "1575414489.544905000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-24ce2f21c1e572e120cbe3ca", "type": "ipv4", "value": "18.208.41.141", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 39, "frame_number": 3795, "display_filter": "frame.number == 3795", "timestamp_epoch": "1575413237.897960000" }, { "udp_stream": 40, "frame_number": 3837, "display_filter": "frame.number == 3837", "timestamp_epoch": "1575413238.558263000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-89256dea8f119075b7a778ee", "type": "ipv4", "value": "18.209.186.85", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 70, "frame_number": 9126, "display_filter": "frame.number == 9126", "timestamp_epoch": "1575413262.266157000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-dd9581387a14bb8410678c7c", "type": "ipv4", "value": "18.210.147.153", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 70, "frame_number": 9126, "display_filter": "frame.number == 9126", "timestamp_epoch": "1575413262.266157000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4cfc9267cf64704e5af6829f", "type": "ipv4", "value": "18.211.132.79", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 70, "frame_number": 9126, "display_filter": "frame.number == 9126", "timestamp_epoch": "1575413262.266157000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c8d40ffb1f0996dfb1ff5450", "type": "ipv4", "value": "18.214.122.84", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 184, "frame_number": 17359, "display_filter": "frame.number == 17359", "timestamp_epoch": "1575414489.334625000" }, { "udp_stream": 185, "frame_number": 17386, "display_filter": "frame.number == 17386", "timestamp_epoch": "1575414489.544905000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a6bba22da108d9081179911c", "type": "ipv4", "value": "18.215.90.62", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 182, "frame_number": 17363, "display_filter": "frame.number == 17363", "timestamp_epoch": "1575414489.352624000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-824c188a20227041c456f31f", "type": "ipv4", "value": "18.232.193.181", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 39, "frame_number": 3795, "display_filter": "frame.number == 3795", "timestamp_epoch": "1575413237.897960000" }, { "udp_stream": 40, "frame_number": 3837, "display_filter": "frame.number == 3837", "timestamp_epoch": "1575413238.558263000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-48de171fac5d1f0325515e48", "type": "ipv4", "value": "18.233.175.78", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 70, "frame_number": 9126, "display_filter": "frame.number == 9126", "timestamp_epoch": "1575413262.266157000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-951e65f6e507a2c584b23275", "type": "ipv4", "value": "18.233.219.152", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 70, "frame_number": 9126, "display_filter": "frame.number == 9126", "timestamp_epoch": "1575413262.266157000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f64ea3ee382d988de68251db", "type": "ipv4", "value": "18.235.19.208", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 87, "frame_number": 9974, "display_filter": "frame.number == 9974", "timestamp_epoch": "1575413264.859950000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4b9ef054aab81ab8a6fb6b9c", "type": "ipv4", "value": "18.235.25.252", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 70, "frame_number": 9126, "display_filter": "frame.number == 9126", "timestamp_epoch": "1575413262.266157000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cb5862ade133b232d2ffa802", "type": "ipv4", "value": "180.163.8.114", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 137, "frame_number": 15281, "display_filter": "frame.number == 15281", "timestamp_epoch": "1575413425.403718000" }, { "udp_stream": 138, "frame_number": 15576, "display_filter": "frame.number == 15576", "timestamp_epoch": "1575413428.584602000" }, { "udp_stream": 145, "frame_number": 15951, "display_filter": "frame.number == 15951", "timestamp_epoch": "1575413434.109141000" }, { "udp_stream": 146, "frame_number": 15967, "display_filter": "frame.number == 15967", "timestamp_epoch": "1575413440.498835000" }, { "udp_stream": 159, "frame_number": 16149, "display_filter": "frame.number == 16149", "timestamp_epoch": "1575413455.357740000" }, { "udp_stream": 160, "frame_number": 16160, "display_filter": "frame.number == 16160", "timestamp_epoch": "1575413456.425216000" }, { "udp_stream": 161, "frame_number": 16179, "display_filter": "frame.number == 16179", "timestamp_epoch": "1575413457.526856000" }, { "udp_stream": 162, "frame_number": 16196, "display_filter": "frame.number == 16196", "timestamp_epoch": "1575413468.760703000" }, { "udp_stream": 163, "frame_number": 16209, "display_filter": "frame.number == 16209", "timestamp_epoch": "1575413469.819055000" }, { "udp_stream": 164, "frame_number": 16309, "display_filter": "frame.number == 16309", "timestamp_epoch": "1575413756.347599000" }, { "udp_stream": 165, "frame_number": 16432, "display_filter": "frame.number == 16432", "timestamp_epoch": "1575414056.349092000" }, { "udp_stream": 166, "frame_number": 16443, "display_filter": "frame.number == 16443", "timestamp_epoch": "1575414057.413839000" }, { "udp_stream": 168, "frame_number": 16487, "display_filter": "frame.number == 16487", "timestamp_epoch": "1575414357.417756000" }, { "udp_stream": 190, "frame_number": 21099, "display_filter": "frame.number == 21099", "timestamp_epoch": "1575414657.443819000" }, { "udp_stream": 191, "frame_number": 21110, "display_filter": "frame.number == 21110", "timestamp_epoch": "1575414658.500356000" }, { "udp_stream": 192, "frame_number": 21123, "display_filter": "frame.number == 21123", "timestamp_epoch": "1575414669.784425000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3bb361ff3506a9e1771f8d91", "type": "ipv4", "value": "184.172.48.71", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 103, "frame_number": 10851, "display_filter": "frame.number == 10851", "timestamp_epoch": "1575413267.965671000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c9fb67f0dae058f4624cb71e", "type": "ipv4", "value": "184.203.37.188", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 155, "frame_number": 16142, "display_filter": "frame.number == 16142", "timestamp_epoch": "1575413455.067315000" }, { "udp_stream": 156, "frame_number": 16144, "display_filter": "frame.number == 16144", "timestamp_epoch": "1575413455.075680000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-67bdef73c947d1c9995eeaff", "type": "ipv4", "value": "184.86.155.127", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 45, "frame_number": 5073, "display_filter": "frame.number == 5073", "timestamp_epoch": "1575413247.091636000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-bba1d7785044d632c3212dc4", "type": "ipv4", "value": "185.167.164.42", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 90, "frame_number": 9997, "display_filter": "frame.number == 9997", "timestamp_epoch": "1575413264.964593000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-51dac8e51a0d5350ce4cfaa6", "type": "ipv4", "value": "185.167.164.43", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 90, "frame_number": 9997, "display_filter": "frame.number == 9997", "timestamp_epoch": "1575413264.964593000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6d1006ebcd51ca7f504849c0", "type": "ipv4", "value": "185.167.164.49", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 90, "frame_number": 9997, "display_filter": "frame.number == 9997", "timestamp_epoch": "1575413264.964593000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b8ea62a680c21db4d49943a7", "type": "ipv4", "value": "185.167.164.51", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 90, "frame_number": 9997, "display_filter": "frame.number == 9997", "timestamp_epoch": "1575413264.964593000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6ab63c6c4a700e1d46163e67", "type": "ipv4", "value": "192.184.69.155", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 82, "frame_number": 9360, "display_filter": "frame.number == 9360", "timestamp_epoch": "1575413262.717743000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fc204f7e0082b0be14f6af0a", "type": "ipv4", "value": "192.184.69.156", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 82, "frame_number": 9360, "display_filter": "frame.number == 9360", "timestamp_epoch": "1575413262.717743000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6bd85929f84b67ef2a4a7bae", "type": "ipv4", "value": "192.184.69.183", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 82, "frame_number": 9360, "display_filter": "frame.number == 9360", "timestamp_epoch": "1575413262.717743000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b9db4f1c1937872982f91cd1", "type": "ipv4", "value": "192.184.69.197", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 82, "frame_number": 9360, "display_filter": "frame.number == 9360", "timestamp_epoch": "1575413262.717743000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4b99db10171e4428e06c07a4", "type": "ipv4", "value": "192.184.69.204", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 82, "frame_number": 9360, "display_filter": "frame.number == 9360", "timestamp_epoch": "1575413262.717743000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0cafb19380d920cd90022381", "type": "ipv4", "value": "192.184.69.225", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 82, "frame_number": 9360, "display_filter": "frame.number == 9360", "timestamp_epoch": "1575413262.717743000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6f15b5822ed3d9ee61dcc305", "type": "ipv4", "value": "192.184.69.243", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 82, "frame_number": 9360, "display_filter": "frame.number == 9360", "timestamp_epoch": "1575413262.717743000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5a76df3445c61f8d08ee6c23", "type": "ipv4", "value": "192.184.69.244", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 82, "frame_number": 9360, "display_filter": "frame.number == 9360", "timestamp_epoch": "1575413262.717743000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ab5b144237527f61d800146c", "type": "ipv4", "value": "192.229.210.141", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 46, "frame_number": 5225, "display_filter": "frame.number == 5225", "timestamp_epoch": "1575413248.059796000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5a9a5ecbf9b0051bb88859e2", "type": "ipv4", "value": "192.229.211.36", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 41, "frame_number": 4184, "display_filter": "frame.number == 4184", "timestamp_epoch": "1575413244.602338000" }, { "udp_stream": 47, "frame_number": 5418, "display_filter": "frame.number == 5418", "timestamp_epoch": "1575413248.467142000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-86985aa49b1a045aa11fd98c", "type": "ipv4", "value": "193.183.98.66", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ba7483382bc3edd59f2f7b3a", "type": "ipv4", "value": "198.70.69.154", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 97, "frame_number": 10617, "display_filter": "frame.number == 10617", "timestamp_epoch": "1575413266.894861000" }, { "udp_stream": 96, "frame_number": 10618, "display_filter": "frame.number == 10618", "timestamp_epoch": "1575413266.894952000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ef01ebc7bef18dec2ec44f43", "type": "ipv4", "value": "198.70.69.161", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 97, "frame_number": 10617, "display_filter": "frame.number == 10617", "timestamp_epoch": "1575413266.894861000" }, { "udp_stream": 96, "frame_number": 10618, "display_filter": "frame.number == 10618", "timestamp_epoch": "1575413266.894952000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fad8af9fc558dee4cc3c425f", "type": "ipv4", "value": "198.8.70.128", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 86, "frame_number": 9983, "display_filter": "frame.number == 9983", "timestamp_epoch": "1575413264.913538000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-157882c01902966bc15b9402", "type": "ipv4", "value": "199.255.32.89", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 186, "frame_number": 17389, "display_filter": "frame.number == 17389", "timestamp_epoch": "1575414489.558324000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a70a0e2a4468089d022b60c8", "type": "ipv4", "value": "204.74.252.20", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 126, "frame_number": 13408, "display_filter": "frame.number == 13408", "timestamp_epoch": "1575413306.386965000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5fe6de0b69ec58f1575ac0bc", "type": "ipv4", "value": "204.74.252.28", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 126, "frame_number": 13408, "display_filter": "frame.number == 13408", "timestamp_epoch": "1575413306.386965000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-04e2557fec513ca02ec4c652", "type": "ipv4", "value": "204.79.197.200", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 13, "frame_number": 556, "display_filter": "frame.number == 556", "timestamp_epoch": "1575413159.571651000" }, { "udp_stream": 14, "frame_number": 557, "display_filter": "frame.number == 557", "timestamp_epoch": "1575413159.571721000" }, { "udp_stream": 15, "frame_number": 558, "display_filter": "frame.number == 558", "timestamp_epoch": "1575413159.571772000" }, { "udp_stream": 10, "frame_number": 559, "display_filter": "frame.number == 559", "timestamp_epoch": "1575413159.571825000" }, { "udp_stream": 114, "frame_number": 12765, "display_filter": "frame.number == 12765", "timestamp_epoch": "1575413305.326078000" }, { "udp_stream": 115, "frame_number": 12766, "display_filter": "frame.number == 12766", "timestamp_epoch": "1575413305.326160000" }, { "udp_stream": 116, "frame_number": 12767, "display_filter": "frame.number == 12767", "timestamp_epoch": "1575413305.326217000" }, { "udp_stream": 113, "frame_number": 12768, "display_filter": "frame.number == 12768", "timestamp_epoch": "1575413305.326272000" }, { "udp_stream": 142, "frame_number": 15930, "display_filter": "frame.number == 15930", "timestamp_epoch": "1575413432.778153000" }, { "udp_stream": 143, "frame_number": 15931, "display_filter": "frame.number == 15931", "timestamp_epoch": "1575413432.778226000" }, { "udp_stream": 144, "frame_number": 15932, "display_filter": "frame.number == 15932", "timestamp_epoch": "1575413432.778283000" }, { "udp_stream": 141, "frame_number": 15933, "display_filter": "frame.number == 15933", "timestamp_epoch": "1575413432.778338000" }, { "udp_stream": 176, "frame_number": 17248, "display_filter": "frame.number == 17248", "timestamp_epoch": "1575414487.898629000" }, { "udp_stream": 178, "frame_number": 17249, "display_filter": "frame.number == 17249", "timestamp_epoch": "1575414487.898713000" }, { "udp_stream": 179, "frame_number": 17250, "display_filter": "frame.number == 17250", "timestamp_epoch": "1575414487.898793000" }, { "udp_stream": 175, "frame_number": 17251, "display_filter": "frame.number == 17251", "timestamp_epoch": "1575414487.898873000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8918a982f46c7d6289576bb5", "type": "ipv4", "value": "205.180.86.172", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 88, "frame_number": 10032, "display_filter": "frame.number == 10032", "timestamp_epoch": "1575413265.132382000" }, { "udp_stream": 102, "frame_number": 10873, "display_filter": "frame.number == 10873", "timestamp_epoch": "1575413268.023538000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c90673b3b9499536abac2604", "type": "ipv4", "value": "208.67.222.222", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 148, "frame_number": 16130, "display_filter": "frame.number == 16130", "timestamp_epoch": "1575413450.595849000" }, { "udp_stream": 147, "frame_number": 16131, "display_filter": "frame.number == 16131", "timestamp_epoch": "1575413450.595932000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6276f5efb51efa07442bea52", "type": "ipv4", "value": "209.15.36.35", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 101, "frame_number": 10850, "display_filter": "frame.number == 10850", "timestamp_epoch": "1575413267.965591000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9a29e85c628ac3181db74d76", "type": "ipv4", "value": "216.200.232.201", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 77, "frame_number": 9305, "display_filter": "frame.number == 9305", "timestamp_epoch": "1575413262.640867000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a7199643c60390b3b4771e2e", "type": "ipv4", "value": "216.200.232.221", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 77, "frame_number": 9305, "display_filter": "frame.number == 9305", "timestamp_epoch": "1575413262.640867000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-09295d5e01b2eb4cf020d04b", "type": "ipv4", "value": "216.58.193.130", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 63, "frame_number": 8199, "display_filter": "frame.number == 8199", "timestamp_epoch": "1575413258.370803000" }, { "udp_stream": 72, "frame_number": 9322, "display_filter": "frame.number == 9322", "timestamp_epoch": "1575413262.643180000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7f9f6575f2a0ea01ee52a552", "type": "ipv4", "value": "216.58.194.106", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 65, "frame_number": 8315, "display_filter": "frame.number == 8315", "timestamp_epoch": "1575413258.762246000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-936831f168096fa700c90659", "type": "ipv4", "value": "224.0.0.22", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d6357c0371ba87f642b89d1f", "type": "ipv4", "value": "224.0.0.252", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-10e6b7b280ccc73ee40f0b33", "type": "ipv4", "value": "23.11.217.11", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 80, "frame_number": 9345, "display_filter": "frame.number == 9345", "timestamp_epoch": "1575413262.654064000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4f6925b684b68889408ecbcb", "type": "ipv4", "value": "23.11.217.71", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 76, "frame_number": 9336, "display_filter": "frame.number == 9336", "timestamp_epoch": "1575413262.649448000" }, { "udp_stream": 93, "frame_number": 10059, "display_filter": "frame.number == 10059", "timestamp_epoch": "1575413265.173234000" }, { "udp_stream": 111, "frame_number": 11250, "display_filter": "frame.number == 11250", "timestamp_epoch": "1575413268.813668000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d9c3b73862ec72f1aef5ee1f", "type": "ipv4", "value": "23.11.218.15", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 54, "frame_number": 7496, "display_filter": "frame.number == 7496", "timestamp_epoch": "1575413254.362555000" }, { "udp_stream": 55, "frame_number": 7652, "display_filter": "frame.number == 7652", "timestamp_epoch": "1575413255.067988000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cdffad18321c16dfc0d95b4e", "type": "ipv4", "value": "23.67.118.68", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 62, "frame_number": 8085, "display_filter": "frame.number == 8085", "timestamp_epoch": "1575413257.988658000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8729e07b290f08394fcdb12d", "type": "ipv4", "value": "23.67.120.135", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 121, "frame_number": 13263, "display_filter": "frame.number == 13263", "timestamp_epoch": "1575413306.258315000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d4183688314d4160d7893aa1", "type": "ipv4", "value": "23.7.93.115", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 124, "frame_number": 13357, "display_filter": "frame.number == 13357", "timestamp_epoch": "1575413306.307779000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-856c8a5eb0af5a409dd1322c", "type": "ipv4", "value": "239.255.255.250", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "frame_number": 3182, "display_filter": "frame.number == 3182", "timestamp_epoch": "1575413205.860754000" }, { "frame_number": 3184, "display_filter": "frame.number == 3184", "timestamp_epoch": "1575413206.181964000" }, { "frame_number": 3199, "display_filter": "frame.number == 3199", "timestamp_epoch": "1575413208.859570000" }, { "frame_number": 3218, "display_filter": "frame.number == 3218", "timestamp_epoch": "1575413209.186580000" }, { "frame_number": 3498, "display_filter": "frame.number == 3498", "timestamp_epoch": "1575413211.874717000" }, { "frame_number": 3534, "display_filter": "frame.number == 3534", "timestamp_epoch": "1575413212.187013000" } ], "roles": [ "http-host", "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a6d3b339b7275673bb60b70b", "type": "ipv4", "value": "255.255.255.255", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ded7f05c1af8b2cb1cdf8b90", "type": "ipv4", "value": "3.13.100.77", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 26, "frame_number": 2223, "display_filter": "frame.number == 2223", "timestamp_epoch": "1575413165.992964000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8da81b0fa6a3f4365386b297", "type": "ipv4", "value": "3.135.8.221", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 26, "frame_number": 2223, "display_filter": "frame.number == 2223", "timestamp_epoch": "1575413165.992964000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-192652a35367578be005b5ac", "type": "ipv4", "value": "3.136.2.145", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 26, "frame_number": 2223, "display_filter": "frame.number == 2223", "timestamp_epoch": "1575413165.992964000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9aa105d2bd26e51b3f7ebe5d", "type": "ipv4", "value": "3.136.4.126", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 26, "frame_number": 2223, "display_filter": "frame.number == 2223", "timestamp_epoch": "1575413165.992964000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f904f658e186e1247f183a21", "type": "ipv4", "value": "3.136.40.187", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 26, "frame_number": 2223, "display_filter": "frame.number == 2223", "timestamp_epoch": "1575413165.992964000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-69d9da9f83d1c34812bfe04a", "type": "ipv4", "value": "3.18.142.126", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 26, "frame_number": 2223, "display_filter": "frame.number == 2223", "timestamp_epoch": "1575413165.992964000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-aac52f7d6086501ac050cdd8", "type": "ipv4", "value": "3.19.254.171", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 26, "frame_number": 2223, "display_filter": "frame.number == 2223", "timestamp_epoch": "1575413165.992964000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-64b84e4d1f087491d6e946f5", "type": "ipv4", "value": "3.213.234.38", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 110, "frame_number": 10993, "display_filter": "frame.number == 10993", "timestamp_epoch": "1575413268.359202000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2183f1c9baa6f81b76680f2a", "type": "ipv4", "value": "3.213.8.28", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 73, "frame_number": 9324, "display_filter": "frame.number == 9324", "timestamp_epoch": "1575413262.643694000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d03cd857bfaf77e48a44d60a", "type": "ipv4", "value": "3.215.246.105", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 73, "frame_number": 9324, "display_filter": "frame.number == 9324", "timestamp_epoch": "1575413262.643694000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-74db95b279ca3f5d493acf22", "type": "ipv4", "value": "3.216.103.132", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 84, "frame_number": 9864, "display_filter": "frame.number == 9864", "timestamp_epoch": "1575413264.518110000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-dd0110cdbfa1a521cd565eab", "type": "ipv4", "value": "3.218.16.73", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 43, "frame_number": 4892, "display_filter": "frame.number == 4892", "timestamp_epoch": "1575413246.304051000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3e4244f35fc1b0cef3b0f8ff", "type": "ipv4", "value": "3.220.227.225", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 29, "frame_number": 2546, "display_filter": "frame.number == 2546", "timestamp_epoch": "1575413166.668934000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-dc8b6c49110ac26100310901", "type": "ipv4", "value": "3.221.250.206", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 105, "frame_number": 10876, "display_filter": "frame.number == 10876", "timestamp_epoch": "1575413268.026147000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-18840df1b8deb0796581255d", "type": "ipv4", "value": "3.223.16.87", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 105, "frame_number": 10876, "display_filter": "frame.number == 10876", "timestamp_epoch": "1575413268.026147000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f02543800ff642450668612a", "type": "ipv4", "value": "3.225.187.149", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 39, "frame_number": 3795, "display_filter": "frame.number == 3795", "timestamp_epoch": "1575413237.897960000" }, { "udp_stream": 40, "frame_number": 3837, "display_filter": "frame.number == 3837", "timestamp_epoch": "1575413238.558263000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2e7c5447282fa8b33d185a2d", "type": "ipv4", "value": "3.226.23.55", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 189, "frame_number": 18913, "display_filter": "frame.number == 18913", "timestamp_epoch": "1575414494.106735000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-47de3f25a2ddb3bd5afb9ab6", "type": "ipv4", "value": "3.232.65.116", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 84, "frame_number": 9864, "display_filter": "frame.number == 9864", "timestamp_epoch": "1575413264.518110000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7fd9626ab2eaca439b748d59", "type": "ipv4", "value": "3.83.197.207", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 184, "frame_number": 17359, "display_filter": "frame.number == 17359", "timestamp_epoch": "1575414489.334625000" }, { "udp_stream": 185, "frame_number": 17386, "display_filter": "frame.number == 17386", "timestamp_epoch": "1575414489.544905000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7a407b4c4e726429adae9b13", "type": "ipv4", "value": "34.193.46.35", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 84, "frame_number": 9864, "display_filter": "frame.number == 9864", "timestamp_epoch": "1575413264.518110000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4561f8f4a23dca047d0cdebe", "type": "ipv4", "value": "34.194.106.87", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 189, "frame_number": 18913, "display_filter": "frame.number == 18913", "timestamp_epoch": "1575414494.106735000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4c596c56ca45be56de843fe4", "type": "ipv4", "value": "34.196.158.70", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 75, "frame_number": 9334, "display_filter": "frame.number == 9334", "timestamp_epoch": "1575413262.647446000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4738f80700305ad4f18f476a", "type": "ipv4", "value": "34.197.7.23", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 183, "frame_number": 17364, "display_filter": "frame.number == 17364", "timestamp_epoch": "1575414489.352724000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a17726e1629ed9d42802f8b8", "type": "ipv4", "value": "34.199.169.142", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 182, "frame_number": 17363, "display_filter": "frame.number == 17363", "timestamp_epoch": "1575414489.352624000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e568cace9dd4d659e37f2c10", "type": "ipv4", "value": "34.200.67.128", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 105, "frame_number": 10876, "display_filter": "frame.number == 10876", "timestamp_epoch": "1575413268.026147000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e8179306bab887a89dd62e32", "type": "ipv4", "value": "34.201.90.208", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 60, "frame_number": 8009, "display_filter": "frame.number == 8009", "timestamp_epoch": "1575413257.314055000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-16d51c4c455b18a1cf566957", "type": "ipv4", "value": "34.204.123.32", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 52, "frame_number": 7233, "display_filter": "frame.number == 7233", "timestamp_epoch": "1575413253.235151000" }, { "udp_stream": 56, "frame_number": 7655, "display_filter": "frame.number == 7655", "timestamp_epoch": "1575413255.099136000" }, { "udp_stream": 71, "frame_number": 9152, "display_filter": "frame.number == 9152", "timestamp_epoch": "1575413262.342458000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5c244ab5be8b670656954256", "type": "ipv4", "value": "34.204.232.247", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 60, "frame_number": 8009, "display_filter": "frame.number == 8009", "timestamp_epoch": "1575413257.314055000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3a8fe68b8d94e7e662dd1023", "type": "ipv4", "value": "34.204.4.212", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 52, "frame_number": 7233, "display_filter": "frame.number == 7233", "timestamp_epoch": "1575413253.235151000" }, { "udp_stream": 56, "frame_number": 7655, "display_filter": "frame.number == 7655", "timestamp_epoch": "1575413255.099136000" }, { "udp_stream": 71, "frame_number": 9152, "display_filter": "frame.number == 9152", "timestamp_epoch": "1575413262.342458000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cdacb4f9e120baac8e1faf98", "type": "ipv4", "value": "34.224.172.188", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 75, "frame_number": 9334, "display_filter": "frame.number == 9334", "timestamp_epoch": "1575413262.647446000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-46865c1bff4f250db2ebc543", "type": "ipv4", "value": "34.225.20.218", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 84, "frame_number": 9864, "display_filter": "frame.number == 9864", "timestamp_epoch": "1575413264.518110000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-248bb3ba8c3170487aa3128c", "type": "ipv4", "value": "34.226.173.88", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 105, "frame_number": 10876, "display_filter": "frame.number == 10876", "timestamp_epoch": "1575413268.026147000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-82e5d34d6fbf46d48bc84a23", "type": "ipv4", "value": "34.228.100.37", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 75, "frame_number": 9334, "display_filter": "frame.number == 9334", "timestamp_epoch": "1575413262.647446000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ed97a160dd745ca9c6cfa22e", "type": "ipv4", "value": "34.231.235.125", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 52, "frame_number": 7233, "display_filter": "frame.number == 7233", "timestamp_epoch": "1575413253.235151000" }, { "udp_stream": 56, "frame_number": 7655, "display_filter": "frame.number == 7655", "timestamp_epoch": "1575413255.099136000" }, { "udp_stream": 71, "frame_number": 9152, "display_filter": "frame.number == 9152", "timestamp_epoch": "1575413262.342458000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cfc7a909fecb4943454d7df4", "type": "ipv4", "value": "34.232.21.42", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 182, "frame_number": 17363, "display_filter": "frame.number == 17363", "timestamp_epoch": "1575414489.352624000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-762b37d8975c5a28b351cf61", "type": "ipv4", "value": "34.232.64.168", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 27, "frame_number": 2214, "display_filter": "frame.number == 2214", "timestamp_epoch": "1575413165.990675000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0a8d5aad0aac5f6519e808b1", "type": "ipv4", "value": "34.233.8.16", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 105, "frame_number": 10876, "display_filter": "frame.number == 10876", "timestamp_epoch": "1575413268.026147000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c6b83ead36aa14ab20a92fe9", "type": "ipv4", "value": "34.235.254.111", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 75, "frame_number": 9334, "display_filter": "frame.number == 9334", "timestamp_epoch": "1575413262.647446000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-caf874f62f1debebf188d945", "type": "ipv4", "value": "34.235.45.38", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 105, "frame_number": 10876, "display_filter": "frame.number == 10876", "timestamp_epoch": "1575413268.026147000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f19c6e4bf437ca585475550e", "type": "ipv4", "value": "34.236.118.184", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 105, "frame_number": 10876, "display_filter": "frame.number == 10876", "timestamp_epoch": "1575413268.026147000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1979d5f40f68ae20ab92cffb", "type": "ipv4", "value": "34.236.135.105", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 105, "frame_number": 10876, "display_filter": "frame.number == 10876", "timestamp_epoch": "1575413268.026147000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cd34721d9896b91c1c39e734", "type": "ipv4", "value": "34.236.202.21", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 98, "frame_number": 10815, "display_filter": "frame.number == 10815", "timestamp_epoch": "1575413267.789823000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-950d101c75f49a4add508aee", "type": "ipv4", "value": "34.237.248.89", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 87, "frame_number": 9974, "display_filter": "frame.number == 9974", "timestamp_epoch": "1575413264.859950000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-87b928c885a26d9a8322cdb7", "type": "ipv4", "value": "34.238.112.88", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 110, "frame_number": 10993, "display_filter": "frame.number == 10993", "timestamp_epoch": "1575413268.359202000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4cae5e558c99338b67eae5fd", "type": "ipv4", "value": "34.239.215.228", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 106, "frame_number": 10888, "display_filter": "frame.number == 10888", "timestamp_epoch": "1575413268.087189000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-315408110d5353a97523afb7", "type": "ipv4", "value": "35.153.187.227", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 52, "frame_number": 7233, "display_filter": "frame.number == 7233", "timestamp_epoch": "1575413253.235151000" }, { "udp_stream": 56, "frame_number": 7655, "display_filter": "frame.number == 7655", "timestamp_epoch": "1575413255.099136000" }, { "udp_stream": 71, "frame_number": 9152, "display_filter": "frame.number == 9152", "timestamp_epoch": "1575413262.342458000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-36780b13b2284b1ad59d4795", "type": "ipv4", "value": "35.153.21.25", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 87, "frame_number": 9974, "display_filter": "frame.number == 9974", "timestamp_epoch": "1575413264.859950000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-45c1ae8921fcb2172f7f780f", "type": "ipv4", "value": "35.153.252.120", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 184, "frame_number": 17359, "display_filter": "frame.number == 17359", "timestamp_epoch": "1575414489.334625000" }, { "udp_stream": 185, "frame_number": 17386, "display_filter": "frame.number == 17386", "timestamp_epoch": "1575414489.544905000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-28b874b6e587e64fce09a17f", "type": "ipv4", "value": "35.161.118.229", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 33, "frame_number": 2703, "display_filter": "frame.number == 2703", "timestamp_epoch": "1575413167.311200000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fd06130632e2745eeda62977", "type": "ipv4", "value": "35.165.180.187", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 33, "frame_number": 2703, "display_filter": "frame.number == 2703", "timestamp_epoch": "1575413167.311200000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-242368323c2072b7f79dd7bd", "type": "ipv4", "value": "35.169.207.73", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 92, "frame_number": 9982, "display_filter": "frame.number == 9982", "timestamp_epoch": "1575413264.913423000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-75f98d3101f878714e039888", "type": "ipv4", "value": "35.170.121.134", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 75, "frame_number": 9334, "display_filter": "frame.number == 9334", "timestamp_epoch": "1575413262.647446000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f05cacd6b22638bbd2a39cab", "type": "ipv4", "value": "35.170.22.17", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 110, "frame_number": 10993, "display_filter": "frame.number == 10993", "timestamp_epoch": "1575413268.359202000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b4bb6055ddea709a20999aac", "type": "ipv4", "value": "35.171.168.180", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 52, "frame_number": 7233, "display_filter": "frame.number == 7233", "timestamp_epoch": "1575413253.235151000" }, { "udp_stream": 56, "frame_number": 7655, "display_filter": "frame.number == 7655", "timestamp_epoch": "1575413255.099136000" }, { "udp_stream": 71, "frame_number": 9152, "display_filter": "frame.number == 9152", "timestamp_epoch": "1575413262.342458000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-809481340acce0a59f9e1ca1", "type": "ipv4", "value": "35.171.202.176", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 106, "frame_number": 10888, "display_filter": "frame.number == 10888", "timestamp_epoch": "1575413268.087189000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-daab9e34ed86e707701a1a4c", "type": "ipv4", "value": "35.171.48.153", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 98, "frame_number": 10815, "display_filter": "frame.number == 10815", "timestamp_epoch": "1575413267.789823000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-53615dde138f7030908c71a7", "type": "ipv4", "value": "35.172.104.215", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 52, "frame_number": 7233, "display_filter": "frame.number == 7233", "timestamp_epoch": "1575413253.235151000" }, { "udp_stream": 56, "frame_number": 7655, "display_filter": "frame.number == 7655", "timestamp_epoch": "1575413255.099136000" }, { "udp_stream": 71, "frame_number": 9152, "display_filter": "frame.number == 9152", "timestamp_epoch": "1575413262.342458000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e38f87318de2b864cde08779", "type": "ipv4", "value": "35.173.158.96", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 183, "frame_number": 17364, "display_filter": "frame.number == 17364", "timestamp_epoch": "1575414489.352724000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ea8df95b2fc7e0d856824d13", "type": "ipv4", "value": "35.174.30.193", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 92, "frame_number": 9982, "display_filter": "frame.number == 9982", "timestamp_epoch": "1575413264.913423000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-28947f5eb77231777e426a82", "type": "ipv4", "value": "35.186.239.238", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 89, "frame_number": 9979, "display_filter": "frame.number == 9979", "timestamp_epoch": "1575413264.894068000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8bee1cd4d6799d36b3ef0518", "type": "ipv4", "value": "35.190.36.172", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 68, "frame_number": 8643, "display_filter": "frame.number == 8643", "timestamp_epoch": "1575413260.379428000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4d6b6853f811ef495278b091", "type": "ipv4", "value": "35.190.72.161", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 66, "frame_number": 8331, "display_filter": "frame.number == 8331", "timestamp_epoch": "1575413258.871609000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c988b0ee39060f6ecc837bca", "type": "ipv4", "value": "35.207.24.140", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 120, "frame_number": 13146, "display_filter": "frame.number == 13146", "timestamp_epoch": "1575413306.126479000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b4b01a9efc3cbb5327052afc", "type": "ipv4", "value": "35.211.144.153", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 79, "frame_number": 9350, "display_filter": "frame.number == 9350", "timestamp_epoch": "1575413262.658303000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-238b09044bda7270b18214ef", "type": "ipv4", "value": "35.211.183.51", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 79, "frame_number": 9350, "display_filter": "frame.number == 9350", "timestamp_epoch": "1575413262.658303000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8d2460214d0f5858bff1af8c", "type": "ipv4", "value": "37.157.2.236", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 38, "frame_number": 3635, "display_filter": "frame.number == 3635", "timestamp_epoch": "1575413213.479991000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-001ad0d95198b9995b771891", "type": "ipv4", "value": "37.157.2.237", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 38, "frame_number": 3635, "display_filter": "frame.number == 3635", "timestamp_epoch": "1575413213.479991000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1f412396f15767a60ff5b904", "type": "ipv4", "value": "37.157.4.23", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 38, "frame_number": 3635, "display_filter": "frame.number == 3635", "timestamp_epoch": "1575413213.479991000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-40f567398583c66b9639b319", "type": "ipv4", "value": "37.157.4.41", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 38, "frame_number": 3635, "display_filter": "frame.number == 3635", "timestamp_epoch": "1575413213.479991000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7e3e13c33a393840fffec975", "type": "ipv4", "value": "37.157.6.246", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 38, "frame_number": 3635, "display_filter": "frame.number == 3635", "timestamp_epoch": "1575413213.479991000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-642eab2df5782850069c4e57", "type": "ipv4", "value": "37.157.6.252", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 38, "frame_number": 3635, "display_filter": "frame.number == 3635", "timestamp_epoch": "1575413213.479991000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-37c0e20dc55862c5af86bd92", "type": "ipv4", "value": "38.67.14.233", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 104, "frame_number": 10858, "display_filter": "frame.number == 10858", "timestamp_epoch": "1575413267.969283000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6b09dfc3af6d4c4f950625ef", "type": "ipv4", "value": "50.116.194.21", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 78, "frame_number": 9357, "display_filter": "frame.number == 9357", "timestamp_epoch": "1575413262.702392000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b041c61a5ebe3c8d9bd70c12", "type": "ipv4", "value": "50.16.169.17", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 92, "frame_number": 9982, "display_filter": "frame.number == 9982", "timestamp_epoch": "1575413264.913423000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0af7e410a1ec1c905466b7ac", "type": "ipv4", "value": "50.57.31.206", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 37, "frame_number": 3573, "display_filter": "frame.number == 3573", "timestamp_epoch": "1575413212.855201000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-76e13ded5fc4f6cc9a79a945", "type": "ipv4", "value": "50.97.145.208", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 103, "frame_number": 10851, "display_filter": "frame.number == 10851", "timestamp_epoch": "1575413267.965671000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-806f22b109941f95825f8d52", "type": "ipv4", "value": "52.0.90.21", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 43, "frame_number": 4892, "display_filter": "frame.number == 4892", "timestamp_epoch": "1575413246.304051000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7b316242fd42bbde5fd8c1ec", "type": "ipv4", "value": "52.2.220.123", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 183, "frame_number": 17364, "display_filter": "frame.number == 17364", "timestamp_epoch": "1575414489.352724000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9502dcc94e310e0b2481ac21", "type": "ipv4", "value": "52.20.183.229", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 189, "frame_number": 18913, "display_filter": "frame.number == 18913", "timestamp_epoch": "1575414494.106735000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6fc38197bac4a7ca56990701", "type": "ipv4", "value": "52.20.71.5", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 183, "frame_number": 17364, "display_filter": "frame.number == 17364", "timestamp_epoch": "1575414489.352724000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e5675b59d0bb35fe58ee3e1c", "type": "ipv4", "value": "52.200.145.54", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 183, "frame_number": 17364, "display_filter": "frame.number == 17364", "timestamp_epoch": "1575414489.352724000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a6420c710a2733de311273b9", "type": "ipv4", "value": "52.201.28.115", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 110, "frame_number": 10993, "display_filter": "frame.number == 10993", "timestamp_epoch": "1575413268.359202000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-36682e6e53f38429c914ff66", "type": "ipv4", "value": "52.202.0.127", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 84, "frame_number": 9864, "display_filter": "frame.number == 9864", "timestamp_epoch": "1575413264.518110000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1a9b513f087dc7571b74a3e3", "type": "ipv4", "value": "52.202.126.226", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 87, "frame_number": 9974, "display_filter": "frame.number == 9974", "timestamp_epoch": "1575413264.859950000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d926a3cb24f527f527c9cad9", "type": "ipv4", "value": "52.202.174.197", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 75, "frame_number": 9334, "display_filter": "frame.number == 9334", "timestamp_epoch": "1575413262.647446000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-92552260408c29a8b96c584a", "type": "ipv4", "value": "52.202.55.102", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 182, "frame_number": 17363, "display_filter": "frame.number == 17363", "timestamp_epoch": "1575414489.352624000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c3ac2ae319d632bd7d4d25d5", "type": "ipv4", "value": "52.203.83.158", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 92, "frame_number": 9982, "display_filter": "frame.number == 9982", "timestamp_epoch": "1575413264.913423000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c2d0ded54053e14b5689b206", "type": "ipv4", "value": "52.204.252.186", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 98, "frame_number": 10815, "display_filter": "frame.number == 10815", "timestamp_epoch": "1575413267.789823000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3c2cf0f3061325b16c985f2f", "type": "ipv4", "value": "52.204.50.104", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 92, "frame_number": 9982, "display_filter": "frame.number == 9982", "timestamp_epoch": "1575413264.913423000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f4c0989970215b1d2c1ab39c", "type": "ipv4", "value": "52.206.226.12", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 52, "frame_number": 7233, "display_filter": "frame.number == 7233", "timestamp_epoch": "1575413253.235151000" }, { "udp_stream": 56, "frame_number": 7655, "display_filter": "frame.number == 7655", "timestamp_epoch": "1575413255.099136000" }, { "udp_stream": 71, "frame_number": 9152, "display_filter": "frame.number == 9152", "timestamp_epoch": "1575413262.342458000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-62a0980790bbd1ec8cdfb433", "type": "ipv4", "value": "52.21.200.160", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 84, "frame_number": 9864, "display_filter": "frame.number == 9864", "timestamp_epoch": "1575413264.518110000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-197fbe00ff85c9b368d36083", "type": "ipv4", "value": "52.21.98.231", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 92, "frame_number": 9982, "display_filter": "frame.number == 9982", "timestamp_epoch": "1575413264.913423000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-73c995b781a776a095920269", "type": "ipv4", "value": "52.22.131.123", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 92, "frame_number": 9982, "display_filter": "frame.number == 9982", "timestamp_epoch": "1575413264.913423000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-db7ea7e6365c32306ca8fea8", "type": "ipv4", "value": "52.22.146.21", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 75, "frame_number": 9334, "display_filter": "frame.number == 9334", "timestamp_epoch": "1575413262.647446000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-64c8be63300d2af82d71fa91", "type": "ipv4", "value": "52.22.184.73", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 73, "frame_number": 9324, "display_filter": "frame.number == 9324", "timestamp_epoch": "1575413262.643694000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-33e51978c7e143a7c4601519", "type": "ipv4", "value": "52.3.11.61", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 60, "frame_number": 8009, "display_filter": "frame.number == 8009", "timestamp_epoch": "1575413257.314055000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-110d312d6d125b165cd3177e", "type": "ipv4", "value": "52.3.158.69", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 73, "frame_number": 9324, "display_filter": "frame.number == 9324", "timestamp_epoch": "1575413262.643694000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2b18a92f0c602bb095368c26", "type": "ipv4", "value": "52.36.218.9", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 33, "frame_number": 2703, "display_filter": "frame.number == 2703", "timestamp_epoch": "1575413167.311200000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-830578ecf0f4222216a861d1", "type": "ipv4", "value": "52.38.185.101", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 33, "frame_number": 2703, "display_filter": "frame.number == 2703", "timestamp_epoch": "1575413167.311200000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-63d93f89ad12204d9e250933", "type": "ipv4", "value": "52.39.132.98", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 33, "frame_number": 2703, "display_filter": "frame.number == 2703", "timestamp_epoch": "1575413167.311200000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6771e47b31602c59c6d24136", "type": "ipv4", "value": "52.42.99.244", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 33, "frame_number": 2703, "display_filter": "frame.number == 2703", "timestamp_epoch": "1575413167.311200000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-08da2d5a005b1ed529227673", "type": "ipv4", "value": "52.43.190.106", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 33, "frame_number": 2703, "display_filter": "frame.number == 2703", "timestamp_epoch": "1575413167.311200000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8c12dfd7e353433ef04b56d6", "type": "ipv4", "value": "52.44.42.164", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 60, "frame_number": 8009, "display_filter": "frame.number == 8009", "timestamp_epoch": "1575413257.314055000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c268ed23d0b0fc7a446bd63a", "type": "ipv4", "value": "52.45.100.81", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 98, "frame_number": 10815, "display_filter": "frame.number == 10815", "timestamp_epoch": "1575413267.789823000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-62bdc6bd90a5d69b513fbfa8", "type": "ipv4", "value": "52.45.29.95", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 61, "frame_number": 8080, "display_filter": "frame.number == 8080", "timestamp_epoch": "1575413257.956936000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-365c91bf7ea9f2fdc0ed28f6", "type": "ipv4", "value": "52.45.82.224", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 119, "frame_number": 13113, "display_filter": "frame.number == 13113", "timestamp_epoch": "1575413306.103126000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-14e3680253a802ab470510ac", "type": "ipv4", "value": "52.5.227.122", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 87, "frame_number": 9974, "display_filter": "frame.number == 9974", "timestamp_epoch": "1575413264.859950000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3fe59f137eb29797c231fd27", "type": "ipv4", "value": "52.54.122.125", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 61, "frame_number": 8080, "display_filter": "frame.number == 8080", "timestamp_epoch": "1575413257.956936000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-35579aa27eb812a31bec6163", "type": "ipv4", "value": "52.55.150.239", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 110, "frame_number": 10993, "display_filter": "frame.number == 10993", "timestamp_epoch": "1575413268.359202000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-dbef03c98bbef299d39d376e", "type": "ipv4", "value": "52.6.242.143", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 61, "frame_number": 8080, "display_filter": "frame.number == 8080", "timestamp_epoch": "1575413257.956936000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b5c70369668dcae048453fd4", "type": "ipv4", "value": "52.6.39.34", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 73, "frame_number": 9324, "display_filter": "frame.number == 9324", "timestamp_epoch": "1575413262.643694000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cfae031c2a937a636534e1ac", "type": "ipv4", "value": "52.7.147.140", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 87, "frame_number": 9974, "display_filter": "frame.number == 9974", "timestamp_epoch": "1575413264.859950000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-34e4f3332dea8a6a7fc09d23", "type": "ipv4", "value": "52.70.198.170", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 61, "frame_number": 8080, "display_filter": "frame.number == 8080", "timestamp_epoch": "1575413257.956936000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-27d065fcc85a5d5a22538d16", "type": "ipv4", "value": "52.70.56.26", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 184, "frame_number": 17359, "display_filter": "frame.number == 17359", "timestamp_epoch": "1575414489.334625000" }, { "udp_stream": 185, "frame_number": 17386, "display_filter": "frame.number == 17386", "timestamp_epoch": "1575414489.544905000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d8217fe7424fec51bfd067d0", "type": "ipv4", "value": "52.71.118.158", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 43, "frame_number": 4892, "display_filter": "frame.number == 4892", "timestamp_epoch": "1575413246.304051000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9271a1b92de8c4e4f38c9e04", "type": "ipv4", "value": "52.71.154.85", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 189, "frame_number": 18913, "display_filter": "frame.number == 18913", "timestamp_epoch": "1575414494.106735000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d0b09d8697e2c3c053b33d2c", "type": "ipv4", "value": "52.71.168.120", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 110, "frame_number": 10993, "display_filter": "frame.number == 10993", "timestamp_epoch": "1575413268.359202000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fcbed6d57bc9e4a77324e3fe", "type": "ipv4", "value": "52.72.249.172", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 98, "frame_number": 10815, "display_filter": "frame.number == 10815", "timestamp_epoch": "1575413267.789823000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-077e247b22616982724ba6d8", "type": "ipv4", "value": "52.73.155.113", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 60, "frame_number": 8009, "display_filter": "frame.number == 8009", "timestamp_epoch": "1575413257.314055000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-939fe9c2aa3702c3a44b56c7", "type": "ipv4", "value": "52.73.52.157", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 182, "frame_number": 17363, "display_filter": "frame.number == 17363", "timestamp_epoch": "1575414489.352624000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0019f4273661de717d4b8ba7", "type": "ipv4", "value": "52.73.69.206", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 60, "frame_number": 8009, "display_filter": "frame.number == 8009", "timestamp_epoch": "1575413257.314055000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1b03595d45972a94ccecea02", "type": "ipv4", "value": "52.73.9.0", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 61, "frame_number": 8080, "display_filter": "frame.number == 8080", "timestamp_epoch": "1575413257.956936000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-08ffc226e23aba55a051132c", "type": "ipv4", "value": "52.86.28.222", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 110, "frame_number": 10993, "display_filter": "frame.number == 10993", "timestamp_epoch": "1575413268.359202000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c8a18c604cdcba44f410f901", "type": "ipv4", "value": "52.86.75.171", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 60, "frame_number": 8009, "display_filter": "frame.number == 8009", "timestamp_epoch": "1575413257.314055000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-05a7229153c0974cb0e07a2b", "type": "ipv4", "value": "52.87.22.170", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 61, "frame_number": 8080, "display_filter": "frame.number == 8080", "timestamp_epoch": "1575413257.956936000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-576badc482c95005c7f02ea6", "type": "ipv4", "value": "52.87.90.62", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 98, "frame_number": 10815, "display_filter": "frame.number == 10815", "timestamp_epoch": "1575413267.789823000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a983d6441ddc1c7c18b9cec5", "type": "ipv4", "value": "54.145.171.0", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 39, "frame_number": 3795, "display_filter": "frame.number == 3795", "timestamp_epoch": "1575413237.897960000" }, { "udp_stream": 40, "frame_number": 3837, "display_filter": "frame.number == 3837", "timestamp_epoch": "1575413238.558263000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5818a970463bc714a55a51b0", "type": "ipv4", "value": "54.152.229.194", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 61, "frame_number": 8080, "display_filter": "frame.number == 8080", "timestamp_epoch": "1575413257.956936000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9404daf673e6454fd214d1d1", "type": "ipv4", "value": "54.152.30.174", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 73, "frame_number": 9324, "display_filter": "frame.number == 9324", "timestamp_epoch": "1575413262.643694000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1921371a35d995affe330354", "type": "ipv4", "value": "54.156.168.222", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 61, "frame_number": 8080, "display_filter": "frame.number == 8080", "timestamp_epoch": "1575413257.956936000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e11c22f4dc51d9520f82efc0", "type": "ipv4", "value": "54.158.57.141", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 73, "frame_number": 9324, "display_filter": "frame.number == 9324", "timestamp_epoch": "1575413262.643694000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-262a2a8fcf3d0929f63110d1", "type": "ipv4", "value": "54.164.248.61", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 87, "frame_number": 9974, "display_filter": "frame.number == 9974", "timestamp_epoch": "1575413264.859950000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7949cbb80a1756c674323b8b", "type": "ipv4", "value": "54.165.26.158", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 98, "frame_number": 10815, "display_filter": "frame.number == 10815", "timestamp_epoch": "1575413267.789823000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-193165302e963e19625fc9f4", "type": "ipv4", "value": "54.175.7.235", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 183, "frame_number": 17364, "display_filter": "frame.number == 17364", "timestamp_epoch": "1575414489.352724000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d4813034575ffa8ffd6a0041", "type": "ipv4", "value": "54.175.88.188", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 110, "frame_number": 10993, "display_filter": "frame.number == 10993", "timestamp_epoch": "1575413268.359202000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c7890c1a63b6e098de1387e4", "type": "ipv4", "value": "54.186.165.46", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 33, "frame_number": 2703, "display_filter": "frame.number == 2703", "timestamp_epoch": "1575413167.311200000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a7173b7f45ce592c4eab36ac", "type": "ipv4", "value": "54.208.163.85", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 98, "frame_number": 10815, "display_filter": "frame.number == 10815", "timestamp_epoch": "1575413267.789823000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-469792b65c3b9c1706950d06", "type": "ipv4", "value": "54.209.191.239", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 189, "frame_number": 18913, "display_filter": "frame.number == 18913", "timestamp_epoch": "1575414494.106735000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-97e6a694369dc4997fb15797", "type": "ipv4", "value": "54.209.242.98", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 106, "frame_number": 10888, "display_filter": "frame.number == 10888", "timestamp_epoch": "1575413268.087189000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-222137882f5c5ca3c4b700ee", "type": "ipv4", "value": "54.209.58.223", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 29, "frame_number": 2546, "display_filter": "frame.number == 2546", "timestamp_epoch": "1575413166.668934000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-adcf1cee3efd84665fd95059", "type": "ipv4", "value": "54.209.91.178", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 182, "frame_number": 17363, "display_filter": "frame.number == 17363", "timestamp_epoch": "1575414489.352624000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-647670111627ef36fd4ab2cb", "type": "ipv4", "value": "54.209.98.151", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 60, "frame_number": 8009, "display_filter": "frame.number == 8009", "timestamp_epoch": "1575413257.314055000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d31ea48d9b8d342056fd1a16", "type": "ipv4", "value": "54.226.243.22", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 73, "frame_number": 9324, "display_filter": "frame.number == 9324", "timestamp_epoch": "1575413262.643694000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a3c6be663c6a01d973e6ce16", "type": "ipv4", "value": "54.236.178.170", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 39, "frame_number": 3795, "display_filter": "frame.number == 3795", "timestamp_epoch": "1575413237.897960000" }, { "udp_stream": 40, "frame_number": 3837, "display_filter": "frame.number == 3837", "timestamp_epoch": "1575413238.558263000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0d773138152baf4f3fa669e9", "type": "ipv4", "value": "54.236.214.197", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 184, "frame_number": 17359, "display_filter": "frame.number == 17359", "timestamp_epoch": "1575414489.334625000" }, { "udp_stream": 185, "frame_number": 17386, "display_filter": "frame.number == 17386", "timestamp_epoch": "1575414489.544905000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-03adb873196351ec145021d5", "type": "ipv4", "value": "54.82.194.252", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 119, "frame_number": 13113, "display_filter": "frame.number == 13113", "timestamp_epoch": "1575413306.103126000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3b7bf8396306dac6f3a6db16", "type": "ipv4", "value": "54.84.47.220", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 75, "frame_number": 9334, "display_filter": "frame.number == 9334", "timestamp_epoch": "1575413262.647446000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-030d0ddc3a76821c297b8a1c", "type": "ipv4", "value": "54.85.102.186", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 106, "frame_number": 10888, "display_filter": "frame.number == 10888", "timestamp_epoch": "1575413268.087189000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5a2d9223add3879847ccd18f", "type": "ipv4", "value": "54.88.83.158", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 84, "frame_number": 9864, "display_filter": "frame.number == 9864", "timestamp_epoch": "1575413264.518110000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d4bf676f3e996f4b005521ff", "type": "ipv4", "value": "54.88.96.255", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 29, "frame_number": 2546, "display_filter": "frame.number == 2546", "timestamp_epoch": "1575413166.668934000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e460ffa09217c7a9f7ecd346", "type": "ipv4", "value": "54.89.56.97", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 87, "frame_number": 9974, "display_filter": "frame.number == 9974", "timestamp_epoch": "1575413264.859950000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-950a640a3dc0ee10275e8a3d", "type": "ipv4", "value": "58.251.121.110", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 137, "frame_number": 15281, "display_filter": "frame.number == 15281", "timestamp_epoch": "1575413425.403718000" }, { "udp_stream": 138, "frame_number": 15576, "display_filter": "frame.number == 15576", "timestamp_epoch": "1575413428.584602000" }, { "udp_stream": 145, "frame_number": 15951, "display_filter": "frame.number == 15951", "timestamp_epoch": "1575413434.109141000" }, { "udp_stream": 146, "frame_number": 15967, "display_filter": "frame.number == 15967", "timestamp_epoch": "1575413440.498835000" }, { "udp_stream": 159, "frame_number": 16149, "display_filter": "frame.number == 16149", "timestamp_epoch": "1575413455.357740000" }, { "udp_stream": 160, "frame_number": 16160, "display_filter": "frame.number == 16160", "timestamp_epoch": "1575413456.425216000" }, { "udp_stream": 161, "frame_number": 16179, "display_filter": "frame.number == 16179", "timestamp_epoch": "1575413457.526856000" }, { "udp_stream": 162, "frame_number": 16196, "display_filter": "frame.number == 16196", "timestamp_epoch": "1575413468.760703000" }, { "udp_stream": 163, "frame_number": 16209, "display_filter": "frame.number == 16209", "timestamp_epoch": "1575413469.819055000" }, { "udp_stream": 164, "frame_number": 16309, "display_filter": "frame.number == 16309", "timestamp_epoch": "1575413756.347599000" }, { "udp_stream": 165, "frame_number": 16432, "display_filter": "frame.number == 16432", "timestamp_epoch": "1575414056.349092000" }, { "udp_stream": 166, "frame_number": 16443, "display_filter": "frame.number == 16443", "timestamp_epoch": "1575414057.413839000" }, { "udp_stream": 168, "frame_number": 16487, "display_filter": "frame.number == 16487", "timestamp_epoch": "1575414357.417756000" }, { "udp_stream": 190, "frame_number": 21099, "display_filter": "frame.number == 21099", "timestamp_epoch": "1575414657.443819000" }, { "udp_stream": 191, "frame_number": 21110, "display_filter": "frame.number == 21110", "timestamp_epoch": "1575414658.500356000" }, { "udp_stream": 192, "frame_number": 21123, "display_filter": "frame.number == 21123", "timestamp_epoch": "1575414669.784425000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-71aa80c53555f571891b3a0b", "type": "ipv4", "value": "64.58.116.196", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 126, "frame_number": 13408, "display_filter": "frame.number == 13408", "timestamp_epoch": "1575413306.386965000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3c09ec8a15d2190c19ab13ec", "type": "ipv4", "value": "64.58.116.236", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 126, "frame_number": 13408, "display_filter": "frame.number == 13408", "timestamp_epoch": "1575413306.386965000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3fbb69d56f81029991a93f1d", "type": "ipv4", "value": "64.58.119.36", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 126, "frame_number": 13408, "display_filter": "frame.number == 13408", "timestamp_epoch": "1575413306.386965000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-21ac632502395d7df3a57b3b", "type": "ipv4", "value": "66.218.84.42", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 16, "frame_number": 644, "display_filter": "frame.number == 644", "timestamp_epoch": "1575413160.441484000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-20b9386a80dce79e5194ef15", "type": "ipv4", "value": "66.218.84.43", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 16, "frame_number": 644, "display_filter": "frame.number == 644", "timestamp_epoch": "1575413160.441484000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b1d57a74c4cec4677f233738", "type": "ipv4", "value": "66.218.87.13", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 44, "frame_number": 4922, "display_filter": "frame.number == 4922", "timestamp_epoch": "1575413246.488601000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a9880152b69cba0953a442c8", "type": "ipv4", "value": "66.218.87.15", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 17, "frame_number": 647, "display_filter": "frame.number == 647", "timestamp_epoch": "1575413160.623478000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-44bbe19a6301086368948297", "type": "ipv4", "value": "66.235.147.232", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 181, "frame_number": 17335, "display_filter": "frame.number == 17335", "timestamp_epoch": "1575414489.184029000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-905b1736023538321501e5d4", "type": "ipv4", "value": "66.235.147.233", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 181, "frame_number": 17335, "display_filter": "frame.number == 17335", "timestamp_epoch": "1575414489.184029000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-41145260387bd79d756d84d5", "type": "ipv4", "value": "66.235.147.234", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 181, "frame_number": 17335, "display_filter": "frame.number == 17335", "timestamp_epoch": "1575414489.184029000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-53f68e869e22eea3b384710a", "type": "ipv4", "value": "66.235.147.235", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 181, "frame_number": 17335, "display_filter": "frame.number == 17335", "timestamp_epoch": "1575414489.184029000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-65e7710e0aaae1409d18e694", "type": "ipv4", "value": "66.235.147.236", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 181, "frame_number": 17335, "display_filter": "frame.number == 17335", "timestamp_epoch": "1575414489.184029000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-83cfa1ffc9204eac8e6f83f9", "type": "ipv4", "value": "66.235.147.237", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 181, "frame_number": 17335, "display_filter": "frame.number == 17335", "timestamp_epoch": "1575414489.184029000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e4d688045a38af5ea8346e8a", "type": "ipv4", "value": "66.235.147.238", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 181, "frame_number": 17335, "display_filter": "frame.number == 17335", "timestamp_epoch": "1575414489.184029000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-33d662dfaec9bff26b81f9f1", "type": "ipv4", "value": "66.235.147.239", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 181, "frame_number": 17335, "display_filter": "frame.number == 17335", "timestamp_epoch": "1575414489.184029000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-36a8409e278a5e9e557d483a", "type": "ipv4", "value": "66.235.147.240", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 181, "frame_number": 17335, "display_filter": "frame.number == 17335", "timestamp_epoch": "1575414489.184029000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-47f5b4fd5f492ef23ea729f2", "type": "ipv4", "value": "66.235.147.244", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 181, "frame_number": 17335, "display_filter": "frame.number == 17335", "timestamp_epoch": "1575414489.184029000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1394e46215b0972ccc8709ae", "type": "ipv4", "value": "66.235.147.246", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 181, "frame_number": 17335, "display_filter": "frame.number == 17335", "timestamp_epoch": "1575414489.184029000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-64a0cd61dbc091a34bb113e0", "type": "ipv4", "value": "67.195.204.151", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 6, "frame_number": 308, "display_filter": "frame.number == 308", "timestamp_epoch": "1575413156.734046000" }, { "udp_stream": 7, "frame_number": 352, "display_filter": "frame.number == 352", "timestamp_epoch": "1575413157.278971000" }, { "udp_stream": 8, "frame_number": 399, "display_filter": "frame.number == 399", "timestamp_epoch": "1575413157.843186000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7a61a58a9a2c0af8550ab7e6", "type": "ipv4", "value": "69.147.64.33", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 4, "frame_number": 276, "display_filter": "frame.number == 276", "timestamp_epoch": "1575413155.227694000" }, { "udp_stream": 9, "frame_number": 504, "display_filter": "frame.number == 504", "timestamp_epoch": "1575413158.967341000" }, { "udp_stream": 18, "frame_number": 648, "display_filter": "frame.number == 648", "timestamp_epoch": "1575413160.623583000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b3169ba94cd2601fd69e02e5", "type": "ipv4", "value": "69.147.64.34", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 4, "frame_number": 276, "display_filter": "frame.number == 276", "timestamp_epoch": "1575413155.227694000" }, { "udp_stream": 9, "frame_number": 504, "display_filter": "frame.number == 504", "timestamp_epoch": "1575413158.967341000" }, { "udp_stream": 18, "frame_number": 648, "display_filter": "frame.number == 648", "timestamp_epoch": "1575413160.623583000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f19eab796c60a950a6883b1b", "type": "ipv4", "value": "70.42.32.63", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 127, "frame_number": 13285, "display_filter": "frame.number == 13285", "timestamp_epoch": "1575413306.270237000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-31028ffaaf8d3e7fc2a3cdd5", "type": "ipv4", "value": "72.21.81.200", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 34, "frame_number": 2902, "display_filter": "frame.number == 2902", "timestamp_epoch": "1575413185.249277000" }, { "udp_stream": 35, "frame_number": 2904, "display_filter": "frame.number == 2904", "timestamp_epoch": "1575413185.267497000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-30373f8458d92ffb739136b2", "type": "ipv4", "value": "72.5.64.63", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 130, "frame_number": 13311, "display_filter": "frame.number == 13311", "timestamp_epoch": "1575413306.289844000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e64b93d6e7b7effd94ae24c6", "type": "ipv4", "value": "74.119.118.138", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 100, "frame_number": 10847, "display_filter": "frame.number == 10847", "timestamp_epoch": "1575413267.948443000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-033c632538dfc86eba6a21d9", "type": "ipv4", "value": "74.121.138.36", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 77, "frame_number": 9305, "display_filter": "frame.number == 9305", "timestamp_epoch": "1575413262.640867000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-02558c400da39ed25650183f", "type": "ipv4", "value": "74.121.138.90", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 77, "frame_number": 9305, "display_filter": "frame.number == 9305", "timestamp_epoch": "1575413262.640867000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9dc01ef46aa3efb7c24b949d", "type": "ipv4", "value": "74.6.138.64", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 49, "frame_number": 6460, "display_filter": "frame.number == 6460", "timestamp_epoch": "1575413250.068987000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-afe7fe4558316a8b1f183cb5", "type": "ipv4", "value": "74.6.138.72", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 51, "frame_number": 7139, "display_filter": "frame.number == 7139", "timestamp_epoch": "1575413252.926670000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8f8c519f97fbc2509f57ec48", "type": "ipv4", "value": "74.6.138.75", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 83, "frame_number": 9810, "display_filter": "frame.number == 9810", "timestamp_epoch": "1575413264.126151000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-205e824adb5f7118fb361a4c", "type": "ipv4", "value": "74.6.143.14", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 69, "frame_number": 8646, "display_filter": "frame.number == 8646", "timestamp_epoch": "1575413260.432992000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-30eb8700f26d07ed050d1edc", "type": "ipv4", "value": "74.6.228.136", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 16, "frame_number": 644, "display_filter": "frame.number == 644", "timestamp_epoch": "1575413160.441484000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-201365a25ed86d190a811b84", "type": "ipv4", "value": "74.6.228.137", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 16, "frame_number": 644, "display_filter": "frame.number == 644", "timestamp_epoch": "1575413160.441484000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6c0b824554011425125b7986", "type": "ipv4", "value": "74.6.231.10", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 69, "frame_number": 8646, "display_filter": "frame.number == 8646", "timestamp_epoch": "1575413260.432992000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f94d3aa9e3221707e70204a7", "type": "ipv4", "value": "76.13.32.137", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 69, "frame_number": 8646, "display_filter": "frame.number == 8646", "timestamp_epoch": "1575413260.432992000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-17d14a27c223b2f53d17b43a", "type": "ipv4", "value": "8.208.24.139", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:52.211664+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:52.207217+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 137, "frame_number": 15281, "display_filter": "frame.number == 15281", "timestamp_epoch": "1575413425.403718000" }, { "udp_stream": 138, "frame_number": 15576, "display_filter": "frame.number == 15576", "timestamp_epoch": "1575413428.584602000" }, { "udp_stream": 145, "frame_number": 15951, "display_filter": "frame.number == 15951", "timestamp_epoch": "1575413434.109141000" }, { "udp_stream": 146, "frame_number": 15967, "display_filter": "frame.number == 15967", "timestamp_epoch": "1575413440.498835000" }, { "udp_stream": 159, "frame_number": 16149, "display_filter": "frame.number == 16149", "timestamp_epoch": "1575413455.357740000" }, { "udp_stream": 160, "frame_number": 16160, "display_filter": "frame.number == 16160", "timestamp_epoch": "1575413456.425216000" }, { "udp_stream": 161, "frame_number": 16179, "display_filter": "frame.number == 16179", "timestamp_epoch": "1575413457.526856000" }, { "udp_stream": 162, "frame_number": 16196, "display_filter": "frame.number == 16196", "timestamp_epoch": "1575413468.760703000" }, { "udp_stream": 163, "frame_number": 16209, "display_filter": "frame.number == 16209", "timestamp_epoch": "1575413469.819055000" }, { "udp_stream": 164, "frame_number": 16309, "display_filter": "frame.number == 16309", "timestamp_epoch": "1575413756.347599000" }, { "udp_stream": 165, "frame_number": 16432, "display_filter": "frame.number == 16432", "timestamp_epoch": "1575414056.349092000" }, { "udp_stream": 166, "frame_number": 16443, "display_filter": "frame.number == 16443", "timestamp_epoch": "1575414057.413839000" }, { "udp_stream": 168, "frame_number": 16487, "display_filter": "frame.number == 16487", "timestamp_epoch": "1575414357.417756000" }, { "udp_stream": 190, "frame_number": 21099, "display_filter": "frame.number == 21099", "timestamp_epoch": "1575414657.443819000" }, { "udp_stream": 191, "frame_number": 21110, "display_filter": "frame.number == 21110", "timestamp_epoch": "1575414658.500356000" }, { "udp_stream": 192, "frame_number": 21123, "display_filter": "frame.number == 21123", "timestamp_epoch": "1575414669.784425000" }, { "tcp_stream": 421, "frame_number": 15569, "display_filter": "frame.number == 15569", "timestamp_epoch": "1575413427.772846000" }, { "tcp_stream": 423, "frame_number": 15944, "display_filter": "frame.number == 15944", "timestamp_epoch": "1575413432.842336000" } ], "roles": [ "dns-answer", "http-host", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:52.202334+00:00" }, { "observable_id": "observable-d4fab433c0d07dc62447758e", "type": "ipv4", "value": "8.41.222.150", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 122, "frame_number": 13288, "display_filter": "frame.number == 13288", "timestamp_epoch": "1575413306.271668000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d3e99ed55e4db86c249e448a", "type": "ipv4", "value": "91.199.212.52", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 95, "frame_number": 10536, "display_filter": "frame.number == 10536", "timestamp_epoch": "1575413266.379001000" }, { "udp_stream": 94, "frame_number": 10537, "display_filter": "frame.number == 10537", "timestamp_epoch": "1575413266.379122000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5d5be013f088d3596c344284", "type": "ipv4", "value": "96.6.83.178", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 30, "frame_number": 2668, "display_filter": "frame.number == 2668", "timestamp_epoch": "1575413167.222296000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9ffe4088db736fbafc8d9dc6", "type": "ipv4", "value": "98.136.96.149", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 49, "frame_number": 6460, "display_filter": "frame.number == 6460", "timestamp_epoch": "1575413250.068987000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0e20feb79454b70c5514fa7c", "type": "ipv4", "value": "98.137.155.9", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 28, "frame_number": 2224, "display_filter": "frame.number == 2224", "timestamp_epoch": "1575413165.993066000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-61f87aba05dc914eddffdf1b", "type": "ipv4", "value": "98.137.156.136", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 6, "frame_number": 308, "display_filter": "frame.number == 308", "timestamp_epoch": "1575413156.734046000" }, { "udp_stream": 7, "frame_number": 352, "display_filter": "frame.number == 352", "timestamp_epoch": "1575413157.278971000" }, { "udp_stream": 8, "frame_number": 399, "display_filter": "frame.number == 399", "timestamp_epoch": "1575413157.843186000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e2ef891c0828192beb5346cc", "type": "ipv4", "value": "98.137.156.137", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 17, "frame_number": 647, "display_filter": "frame.number == 647", "timestamp_epoch": "1575413160.623478000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f46f09251e7d7e078dc975d5", "type": "ipv4", "value": "98.138.71.148", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 51, "frame_number": 7139, "display_filter": "frame.number == 7139", "timestamp_epoch": "1575413252.926670000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0bf5b98d6c5d64d0dd9d4da1", "type": "ipv4", "value": "98.138.71.149", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 69, "frame_number": 8646, "display_filter": "frame.number == 8646", "timestamp_epoch": "1575413260.432992000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-74dc1ee542b4613c2c7b6f39", "type": "ipv4", "value": "99.86.77.108", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 32, "frame_number": 2663, "display_filter": "frame.number == 2663", "timestamp_epoch": "1575413167.216789000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1d114d99b74a135daee72bce", "type": "ipv4", "value": "99.86.77.3", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 32, "frame_number": 2663, "display_filter": "frame.number == 2663", "timestamp_epoch": "1575413167.216789000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9aa081356111d70b5853d808", "type": "ipv4", "value": "99.86.77.5", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 32, "frame_number": 2663, "display_filter": "frame.number == 2663", "timestamp_epoch": "1575413167.216789000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3cac7f333836d16cadebd094", "type": "ipv4", "value": "99.86.77.59", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 32, "frame_number": 2663, "display_filter": "frame.number == 2663", "timestamp_epoch": "1575413167.216789000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9b9e67774c144d63d68c7515", "type": "ipv6", "value": "fd3e:4f5a:5b81::1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 3, "frame_number": 259, "display_filter": "frame.number == 259", "timestamp_epoch": "1575413123.412011000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f2b177fc91e9f6435596fac8", "type": "sha256", "value": "0b504e7f3cec848c7a1c25720cc40e7fd6919e217b4f56e50f645bda49259a39", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a532952f1ddea355cc7dd963", "type": "sha256", "value": "1a5174980a294a528a110726d5855650266c48d9883bea692b67b6d726da98c5", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b142bca25c30d58367f14dd9", "type": "sha256", "value": "1f0bad278e2bf2f41979f2144a94cb85ac19d93abd041230b236463a992d9190", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c97fe5cd53607b4c4a201952", "type": "sha256", "value": "52307c67a1d0d310baf70fb8c346eb51856b73c08f9cf67535720b900023ee5e", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f1f32b32dbfc3116cc209b30", "type": "sha256", "value": "5b80b1566219a6c3321b14127ebae23f73a18fd50a0751d2179e42d461e9ad39", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-14a742869b29e21ef4bfd6ce", "type": "sha256", "value": "6c0c18274fed35e973d1c060f2f4137bb91444a78fbafd3be6c5f6d2f3cc63b8", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2ef5f60ecfc8e16eb9b0a94a", "type": "sha256", "value": "6d8a01dc7647bc218d003b58fe04049e24a9359900b7e0cebae76edf85b8b914", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d6277528832b17ff12667299", "type": "sha256", "value": "78f53c3a83a6e9d23f3903efc3a5635ea95fd21264ada13ebb8af23eb761fa40", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-de4352773e8ad91a0ccb43a7", "type": "sha256", "value": "7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ecedf3a97463338f5ebb2dee", "type": "sha256", "value": "839488ebc08446a096a893996ed23eac321ac166724cd8c5d9092057834d2d79", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3855ab944bd33c5847b5abc5", "type": "sha256", "value": "8bbbecf9c7b14eab33a19f0ab1529dd595dbd2ba51ef0dab65201aef80ce18b6", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-aa623d8c42fb2c1c20dab455", "type": "sha256", "value": "a08902c478721cb65ddbb075d5dea373db29f80c15d67cdb23f25ebfb6284fc7", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c2e3b0f5ba40eb47063610ca", "type": "sha256", "value": "a2f75fb154555d2877b0648f52b549a947b9c82bcff786d7c81ba712e9c3f3f8", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fa739bbed164870fcb39de40", "type": "sha256", "value": "afb96043d1f8390179fe445d5063c434d4df10fa0194e7879ecadf4c9e8f9b78", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3c29ab9db064545ed00a8246", "type": "sha256", "value": "c65cb1829bda38e033f2c42d891e2f0cf9cb5bf2352a74a05ffc27049a98cb56", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8769b7b3d3d02eee500a81df", "type": "sha256", "value": "cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-57fe67d7de3860096889ee0e", "type": "sha256", "value": "cf63a226cdfefcc50f0ebd036df2729d1a6493cac1a5b814eec81ce4eed0f948", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d7fdc4de0d69c2abfe4071a1", "type": "sha256", "value": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9c958ec3eaf056d99725b146", "type": "url", "value": "http://239.255.255.250:1900*", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "frame_number": 3182, "display_filter": "frame.number == 3182", "timestamp_epoch": "1575413205.860754000" }, { "frame_number": 3184, "display_filter": "frame.number == 3184", "timestamp_epoch": "1575413206.181964000" }, { "frame_number": 3199, "display_filter": "frame.number == 3199", "timestamp_epoch": "1575413208.859570000" }, { "frame_number": 3218, "display_filter": "frame.number == 3218", "timestamp_epoch": "1575413209.186580000" }, { "frame_number": 3498, "display_filter": "frame.number == 3498", "timestamp_epoch": "1575413211.874717000" }, { "frame_number": 3534, "display_filter": "frame.number == 3534", "timestamp_epoch": "1575413212.187013000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b2a34f309652cc731ccad47c", "type": "url", "value": "http://8.208.24.139/favicon.ico", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 421, "frame_number": 15569, "display_filter": "frame.number == 15569", "timestamp_epoch": "1575413427.772846000" }, { "tcp_stream": 423, "frame_number": 15944, "display_filter": "frame.number == 15944", "timestamp_epoch": "1575413432.842336000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d7453842750d3e483ce29a09", "type": "url", "value": "http://api2.casus.at/jvassets/xI/t64.dat", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 426, "frame_number": 15971, "display_filter": "frame.number == 15971", "timestamp_epoch": "1575413440.713801000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ad5ecf9910b64fe84029da62", "type": "url", "value": "http://crt.usertrust.com/USERTrustRSAAddTrustCA.crt", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 254, "frame_number": 10625, "display_filter": "frame.number == 10625", "timestamp_epoch": "1575413266.902247000" }, { "tcp_stream": 253, "frame_number": 10629, "display_filter": "frame.number == 10629", "timestamp_epoch": "1575413266.906579000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cf02ba62ab549db9e4277cc4", "type": "url", "value": "http://go.microsoft.com/fwlink/?LinkID=403856&language=en-US&scale=100&contrast=gray", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 329, "frame_number": 12951, "display_filter": "frame.number == 12951", "timestamp_epoch": "1575413305.661450000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d63004ef7f76b8f9b4f97172", "type": "url", "value": "http://h1.wensa.at/api1/0H5UepzG6l8VMC2Pmj/sEZknMRGq/cYV1WzhM9pu8ZeXH_2FY/oc3TLTu7RSq8d2PoCnQ/WIHBDOGJ2GjfbSowy7j5_2/B0EOfL_2FpbXE/rJfdKuzL/_2BbCSo6csLXLP5vO8R_2B3/TMvCcGFAgV/Th0Hwc6reCySrBkAd/zlQ4OLgNqPb5/5W5WAQ0SxwW/yInFoimw547dUm/IVywwkc_2Bkxi4Udvkm3V/9UMNcvy_2B5tDJ4t/_2BE7_2BHXb_2FQ/BIG44mS62Qdr1DeRku/CSQbSS_0A/_0DsSVK_2Fymf4t8ngQi/oa2u69rQ2Fjk5_2BI7m/oQFncyREXFVbCQDDNqU92w/hsPYdmJIpMMIr/_2B", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 440, "frame_number": 16449, "display_filter": "frame.number == 16449", "timestamp_epoch": "1575414057.593994000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fe9d3abe33c9578e4231fe85", "type": "url", "value": "http://h1.wensa.at/api1/4G0Wr6wO0HVb0ZSY2qm1/K1Uti_2FLNMYqzVrRDZ/USwqUHH_2BR0sNak0R4hRv/pjmVHxq_2FHK7/gwr3QR_2/F95tBCofLSdp1GzKpWuUbPl/LkP69828Bg/sLa1g3aY92ruiOrwK/B6AOBbGIQkio/LQLsJMyJVoH/biNOzDGmPi2Uwb/4jTXSNpqxsQcNUBMrPQbG/5Z7IUjAPqkHv58af/nup7A2KuNKzkTI_/2B70soMb_2B1oRHobL/K3X5EHhbt/zI_2BkMzoLvAQQP8D5_0/A_0Dmg_2Baf6QCX7ZjI/7qKQ4rQKPPaCrEDkSgpBbL/ALG4SCtaG/5p6", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 429, "frame_number": 16185, "display_filter": "frame.number == 16185", "timestamp_epoch": "1575413457.706444000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cf27ab8a36bd09818da567c1", "type": "url", "value": "http://h1.wensa.at/api1/g_2Bx7tr9ZryzLouz/05_2FX84jbMj/yEgR5F11nXe/H5Q4RcMk_2FuwO/mHq2BQhJfdTL6FfQ5xauF/u3qTIj03n_2B6nCV/KDSsMyOE_2BTXhg/zxiQKteEk_2BtBzEfx/rnKqQyEpw/YTk34JFznNpQ2vXp7rlN/QFKcIBfT62Iy9KIGk6c/fu_2BuRsq5ahizZjA_2B09/ZtAtAlqztqIMv/z2icag6K/oe3n4nqKEufBvSpu_2BCr9K/xKyx8CbjTI/_2Bhj19DXUF0GS_2B/nXsuBYTFS_0A/_0DLPacLo8b/rzI_2BK0OE9TEL/FflWTWADAHUkyB4qUf8r4/9WN9Wa", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 439, "frame_number": 16436, "display_filter": "frame.number == 16436", "timestamp_epoch": "1575414056.522987000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8412e0f45311fd87908e61d4", "type": "url", "value": "http://h1.wensa.at/api1/Gwbw8tnew726Q/M9Skme3k/6AO19COaR1FoGUdhMsA4GKW/nGqco_2FRl/teGegEqJuVxOOJNjV/oZpTXdjy_2Bp/KEZa3DJBBka/I2gHb_2Bq8hRT4/_2FU7850yaD3XLl9pVrNr/89FBtPrqmkgqnOZV/PXktvK2crzgUudm/BPzuMDS8CVqNScB5ZQ/00ONmphj_/2FdZVyZcJs6fKopUr5Oe/CSefjjsmyKqDX1Ds8p1/KqNJ8ceLBLWrM0Po9Oc5ml/RarNO5_2BgMVz/Ull_0A_0/DZaejK2BA6dxD9vL3jkOsM9/vTC_2F84Pt/COJihOMT_2Fj/raR9XNN", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 431, "frame_number": 16215, "display_filter": "frame.number == 16215", "timestamp_epoch": "1575413469.987340000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d9e6fd934d2160aa50a59adc", "type": "url", "value": "http://h1.wensa.at/api1/hK7XkhVzoQriE0IxUMIa/1O_2BExsgz_2B4Zrthx/W5oi4sXavmJrJ9O9ZQLiPT/S8QFsqJE4sBmf/34lfHb1q/xuA6Q_2FUiM8Xysq1l2iGRB/xgXJph0O3I/GcewoFxd7uN_2BN_2/BH49MRgd_2Ba/fVlVyXE9he8/2q6kX1ls6vfx6p/QX_2FVWJj2W9fBbvgUrOF/bu5C9f_2F3aoPyMf/JYzTSWA0WG2WuW_/2Br4YaeG1faOQcxd0y/ygfOlk3GY/8vuCdPg8IQd_2B6RPUbY/0XEF_0A_0DKpaKUxoL5/qPjhVWhEzP_2FYH6lBq0L8/FoLLMkTwGyXhD/uKVOKORn/3_2Fucd9qVC/XqMxEWSL/V", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 434, "frame_number": 16315, "display_filter": "frame.number == 16315", "timestamp_epoch": "1575413756.495982000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-77522da2425a0d682351abc2", "type": "url", "value": "http://h1.wensa.at/api1/hT5dOTbjmf2_2B4L0/1eaFf9lf3m_2/BEod_2FgUv1/bH2oww4ozdpST4/0acg3vqY7b7zbofHJ41fp/TCAo62pQ7IZa7G0M/iUe40TTaNAP_2BX/JAxRkvtqotcpimE8G2/_2BYg04t6/PW5wbGs_2F6zmB6DwT8h/4VDZ24p2WrGNrXRSmt3/KNVKNdr649JOjV0obrOZBq/g7R1FUFGlzI1u/2d_2BXpZ/0fFT4vAb57Og_2BcIwwM2S8/coL2_2BCyP/KeoRT2yn7nueL4fti/ZhMFL_0A_0DI/A_2FkWnMUpu/XWsMQEDNYGA6pd/N1mzHAcnvEFjdim2rLpxQ/LBIJYMSjpX_2FZT_/2F5V0kBIIM/A", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 487, "frame_number": 21103, "display_filter": "frame.number == 21103", "timestamp_epoch": "1575414657.626613000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5447c5ede5ec521df1d82ccd", "type": "url", "value": "http://h1.wensa.at/api1/IDTB2Kcam0xK2fxd/vTEcLqZOh5c9NYp/NXe6hyoZ9mNQTlY3Y5/bLIdZtExd/d31qAYZtsuTQ9gbIrUSe/PGrhB_2B9yjB9bXOF7t/r1hhLrPtfktOcSFkbu6Ekq/618iNFb5nCo6k/sfFUnlf_/2FoJgVQXG_2FHnDq4o5FjDN/BXT35nGCWe/nyYlM4u5QciWlXTKn/Wm1_2FQtCZd6/aM_2FytaGFR/hYFsI2a6Zr8k4Q/_2BnAwEvBubUGKUloxotM/SLymtM9HHfANmR9n/_0A_0DC9isxkOv5/2K4_2BjxTOT0rBI_2B/_2FLRSSAS/8Qwfk0N2nq8/beBzLG", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 489, "frame_number": 21158, "display_filter": "frame.number == 21158", "timestamp_epoch": "1575414669.952174000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-46f6650556fabe4da8331375", "type": "url", "value": "http://h1.wensa.at/api1/NdyKQBz2bkQyWRjW/DQxAC7LXQQhux0L/JG8Hy_2FKtggSPly52/OI_2Bww0d/GlhCZjLB1qzPFsZmpylg/Ms3wZA3Stl71Q46KRVb/iVLkW9gg4uKEOIATInV3zY/iLuKm_2BHFq5Q/sYBbWlUn/p_2BS4xgcBhCn0_2FVa5JBR/FwZ3dNRALU/50_2FvcGyN_2Bi_2F/gT8JmJY_2Frd/Lwf2Rf9oDBS/vn2noKvqMLt20R/8_2Fy946FBaM8_2F1ADOd/yK0bIHFjspZwtBHx/YHVqsuHv6P_0A_0/Dv9mhzaFuIXiIwIFNV/J7o6OM2pj/ergUZu91KSmAuKhCbtY2/Z7AlSzdNRd_2F_2BrH8/VYH_2BmX/E", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 428, "frame_number": 16166, "display_filter": "frame.number == 16166", "timestamp_epoch": "1575413456.606844000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ac04d387e0bc53a18013ed61", "type": "url", "value": "http://h1.wensa.at/api1/QgPIxa1ctWDK/QU9lAhPb2iw/5sIZr5uccWlTxZ/uU_2FqywknwxovxrWm_2F/ahch3EAUKYeQXCzA/Vynn0p13_2Bpxqw/tiWI5q5zVB6xDKKPsK/jd8RtPdHr/U9wvSAKUxuqoPqHyK80e/Pp9fwSrn2K6_2Fx6Jvq/O_2BxEc_2BAPBPnfun8is9/51Pm2zx2o6hHW/9lHHpa80/bTCwozeMJ4Mrk2q9WhpEAE3/l4oUJWp_2F/I_2FM41FL473zUEnL/2cD_2FdZ8qun/29km6_2F7t_/2BL_0A_0DoEVkm/rcBnMNBSpm5xuE8tfj0dd/xPdfTqFLXz5KI7CFdVm/7Z", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 427, "frame_number": 16153, "display_filter": "frame.number == 16153", "timestamp_epoch": "1575413455.515761000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-501eb7f4cabb2166af674114", "type": "url", "value": "http://h1.wensa.at/api1/rdEreIZkL4/wPcSNXzrRsehTfcyh/tMgQb3qP5lKV/3G4sKnE3XbK/elnGU0srM6zogs/s_2FESzfMOTYDC5_2FR44/j6_2Fv7HHm0FcoBK/_2FRt9xIa946PwM/7hRJM1qbSsws9VeljG/1J6wSRUaT/gmjRcK2wygucnEodYqLC/FbjG139p5ZDb5pyAufv/nJXkZEoWxFZH_2FooxgojE/tFU5IyJR00Riy/bazsDgly/BetpqgAXMYifOBIEdhrITDi/m2GTytY3XJ/JO4r_0A_0DsEyLom2/0DBGVv7B7iWo/qEglwzPAxGf/CnptaQBsxDNM3l/DWphGJyhAADQy1hbrnY_2/Faz2p", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 442, "frame_number": 16493, "display_filter": "frame.number == 16493", "timestamp_epoch": "1575414357.589472000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-311671737e2bf13c637dec65", "type": "url", "value": "http://h1.wensa.at/api1/vkxyxZ87Twi_2Fn1PHKp/03jApGbg_2BRhYkWe9k/esP6O8hbXHW6ZPgXl_2BSj/eoO9reGwFG5Nl/0Bl4MK9Y/Jd_2BNDeICtWFs2iHFgpCDs/67mGV1rAHa/zuH8BB7FghT4J2TNj/R4rOjkgHMzJa/gbTEXT5RJwF/2fmttnND48mMIW/wti0svI2LCBV161F0fEVF/14N3kRMB1SGN44Nm/X7RDPysDrd8saSl/jYZkFcj_2BzrVuVXSM/6kM52Gg2R/Qs_2FpbLz0jSKD_2Bh_0/A_0Decb6GJ_2BMAJGne/vVWWOh9xt4K0tz2TppftCo/JsWCPltqz/XLm", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 430, "frame_number": 16202, "display_filter": "frame.number == 16202", "timestamp_epoch": "1575413468.944358000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-58b80de7d45383f84c18e3ae", "type": "url", "value": "http://h1.wensa.at/api1/WFavOHRQEMt1/znzQ6SK8Cgb/wxvOQ24UVpaQ7R/5E5zFgFb9RQEgPSly9itM/m_2ByKEgt9nvbpq5/rldfZ8lX1njJaA_/2FG7PamZ5_2FEsPiSc/AQx3zcvaB/qWSse9dj40jJCiIERQZn/nJ_2B7CfYvnMHI6bUv5/MZUbbZtoX0enD_2F3KhrS6/cy8A3KCQ9r1hu/Jh0amkRo/081_2FiOyZxp6B7n5bVAptk/IFzCpwyO5t/bkXCXwooW_2Bw550c/aOreQQMfX4Gl/BT7itc_0A_0/DjFoQkz2N1oAiX/qjaaLL_2BSO3VvsqA_2Bp/sT9LOZEV9wlPj7Bt/THj2ittoB/7CHZWVbOOz5/wV", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 488, "frame_number": 21116, "display_filter": "frame.number == 21116", "timestamp_epoch": "1575414658.671978000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fdbf29838037fc3165fd9cda", "type": "url", "value": "http://mail.aol.com/", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 22, "frame_number": 281, "display_filter": "frame.number == 281", "timestamp_epoch": "1575413155.938245000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-86cb554d8a50e0450f16cb08", "type": "url", "value": "http://w8.wensa.at/api1/I01zepn8d/lW8zbbQjFkfEikrpMjIM/BUpAeRTlHQ4bvFyNQ5b/QJQiaBloENVY8vhKyUyE0o/DlBxOkmYhfcXF/f83ZepX0/p4w8NwGSdWiq2d0xSm7dQRx/c9TVoEwwGP/q1ZfqVF4Kk65L3fk5/ZmA_2F4e_2Fz/EA15GMwiWYS/dM6cnd6KMsJ08_/2FGuylglowKzvlAqp_2B7/1F_2FeKeSZFlbTaP/MX93YLJkZgekq1k/2ECfT2iPz4_2FLNdDL/PjdGytsj5/j_2BwGYOG_0A_0DWVnLJ/lblBYSp5hbm4QlU/JSHmUi", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 422, "frame_number": 15581, "display_filter": "frame.number == 15581", "timestamp_epoch": "1575413428.857662000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fb791000b140e99b855709c9", "type": "url", "value": "http://w8.wensa.at/api1/PUbKL64xdNDApQ_2FhOvR/PzVuL7v93RbB1xfc/OEnwN9VtRcH8Ccu/jPgnw0d37uDEzDiVOf/KHgo0k5Uc/k6JCnK_2FBZ4yd9zeeiC/VpJpc2JMgFpc_2BUK2N/MNdoh0fThkbLeh37DCpXrm/guVivsIWc_2FM/aKnRfxy_/2FhTlme15XsXbjEQesbQbAJ/Z9BLtjy3Zi/ZcwiqStUG_2BZapZN/hqA8oHVvfrmy/sqq6RrFWUhE/NiEXX3DV0k2wcp/3ypM4pRUl6ezpp8W_0A_0/Dq6VuunS4q_2BKna/0dWjHSjvGD9y/2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 420, "frame_number": 15288, "display_filter": "frame.number == 15288", "timestamp_epoch": "1575413425.959473000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cfa30db995c58fcfe35e080a", "type": "url", "value": "http://w8.wensa.at/api1/yHuijzBzQc46MJ8Hh_2B3To/h6eUe0SPQ_/2FyC9fDGgAdh4u0V0/Y_2F7w0Pe86d/_2FTkP74EP4/K1gu1U6e0AQB5l/cREXUjyc5L8u6LnRWbbL1/uRyhvKc_2FJntmF6/2AoYMEWtimRTV2a/PtgF_2F7ZN3svdTbI8/iP951uoBL/13G66amAYJslhDbJ9LRx/3TnU8ybVEHD70NlfPgK/H8jUEtFKAt07GB5iuDJECi/UWsRrR1g_2FwB/Fis0q36f/6B9w_2F9mwHOMRaRAywS_0A/_0DXkcCzh7/ICclVahOB309_2F/AEHAZk", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 424, "frame_number": 15956, "display_filter": "frame.number == 15956", "timestamp_epoch": "1575413434.456567000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-24c5326d4d8dd5ded1749a85", "type": "url", "value": "http://www.bing.com/favicon.ico", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 449, "frame_number": 17330, "display_filter": "frame.number == 17330", "timestamp_epoch": "1575414488.801335000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2e6817ab14f517e1640cc6c5", "type": "url", "value": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 256, "frame_number": 10681, "display_filter": "frame.number == 10681", "timestamp_epoch": "1575413267.275134000" }, { "tcp_stream": 257, "frame_number": 10684, "display_filter": "frame.number == 10684", "timestamp_epoch": "1575413267.275288000" }, { "tcp_stream": 256, "frame_number": 10744, "display_filter": "frame.number == 10744", "timestamp_epoch": "1575413267.573647000" }, { "tcp_stream": 257, "frame_number": 10746, "display_filter": "frame.number == 10746", "timestamp_epoch": "1575413267.574570000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null } ], "counts": { "observed": 560 }, "ioc_candidate_count": 0, "summary": "560 typed observations; 0 evidence-backed IOC candidates for review, including 0 with direct malicious provider reports. No automatic confirmation or attribution.", "limitations": [ "No detections, no record, missing credentials and provider errors do not mean benign.", "Current reputation may postdate the capture. Shared hosting, DNS resolution and graph overlap do not transfer maliciousness.", "A recovered file is not proof of execution; hashes identify exported bytes, including partial objects.", "Public-looking enterprise domains may still be sensitive: review selected targets before external disclosure." ], "enrichment_plan": { "policy": "evidence-priority-v2", "items": [ { "observable_id": "observable-10cc055c5fe6c3127ee2d4ff", "type": "domain", "value": "image4.pubmatic.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4c0849e5cddf63ce17fe4848", "type": "domain", "value": "image6.pubmatic.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-285ff452b5cb6e0e74ca6455", "type": "domain", "value": "login.aol.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-76026d979017cfab95acf2f8", "type": "domain", "value": "mail.aol.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-573683686841d23c696138a4", "type": "domain", "value": "match.adsrvr.org", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0fe67f2f5943cc0f3ba6612e", "type": "domain", "value": "match.prod.bidr.io", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-79f3faa6f04f0b4c9af13a93", "type": "domain", "value": "match.rundsp.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-752dacb2399993cae2ce1c27", "type": "domain", "value": "match.taboola.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ed3aa637e2ee6edf262dc3ac", "type": "domain", "value": "match.zorosrv.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f16fcabbbe6413c7cbfc6335", "type": "domain", "value": "o.aolcdn.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b9e21b63c69ea2f706f22dba", "type": "domain", "value": "oao-js-tag.onemobile.yahoo.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-46734ba0502474bae253a387", "type": "domain", "value": "oidc.mail.aol.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-417a628958affe9af4406c2a", "type": "domain", "value": "opus.analytics.yahoo.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b84bdb241c6ec12751704e85", "type": "domain", "value": "p.adsymptotic.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5c411958409e4dac146b7a46", "type": "domain", "value": "p.rfihub.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-989a34518134d51e6101b89b", "type": "domain", "value": "pagead2.googlesyndication.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-53f279a9261a60feb6b94e65", "type": "domain", "value": "pixel-sync.sitescout.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-56e3b40bc13b8222ed259e63", "type": "domain", "value": "pixel.advertising.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-800980b5d5df4f3e741d3a56", "type": "domain", "value": "pixel.quantserve.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3b094461d1602835f7d1843e", "type": "domain", "value": "pixel.tapad.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8b91c5b8304afcdb836bdf05", "type": "domain", "value": "pm.w55c.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d5c4addb65d3ccd4113ac6f4", "type": "domain", "value": "pmp.mxptint.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5fa076919fc50b1a0c413556", "type": "domain", "value": "pr-bh.ybp.yahoo.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b54b867b83bde222cbb0d403", "type": "domain", "value": "prod-m-node-1111.ssp.advertising.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f31208813a865270d769da72", "type": "domain", "value": "pubmatic-match.dotomi.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4e65b7432b29bd6dacb1e0b5", "type": "domain", "value": "pubmatic2waycm-atl.netmng.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c9cc81d4e17d62d082b5622e", "type": "domain", "value": "px.adhigh.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a6b21fa380975bf85bd65968", "type": "domain", "value": "px.moatads.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-72994fdda319d5f7ccf7cab7", "type": "domain", "value": "px.owneriq.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5bedfe444935b59c24799f14", "type": "domain", "value": "r20swj13mr.microsoft.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-bb8fe26944a95d3d50d88e0d", "type": "domain", "value": "rail.bankofamerica.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-682b974103ec352440ad2b2c", "type": "domain", "value": "rtb.adentifi.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-283ed453e356b509ee285331", "type": "domain", "value": "rtb.mfadsrvr.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6d5c07c3653035dd514656cb", "type": "domain", "value": "s.aolcdn.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6e986dbdfe1abe164c01493d", "type": "domain", "value": "s.blogsmithmedia.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ddbc888d826c1476d369afd9", "type": "domain", "value": "s.yimg.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-632e18cb886b8e3be3bc8bcf", "type": "domain", "value": "s0.2mdn.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-334490b561f380e92dcf7d71", "type": "domain", "value": "sb.scorecardresearch.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1ddd49cf2a1babebfd180982", "type": "domain", "value": "secure.adnxs.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1255b9de94ef10e30b30f08d", "type": "domain", "value": "secure.bankofamerica.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1498e5a94ff2c760c483ada3", "type": "domain", "value": "service.idsync.analytics.yahoo.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3cc26248f8bdc8df886e1f62", "type": "domain", "value": "simage2.pubmatic.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f682e34ea79181f09aa6d5cb", "type": "domain", "value": "simage4.pubmatic.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-dea853c8c094bf7b849dda99", "type": "domain", "value": "sofa.bankofamerica.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ba06596a16003e6588584551", "type": "domain", "value": "ssum-sec.casalemedia.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-eb2e495b91f621b99538d99b", "type": "domain", "value": "sync-tm.everesttech.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d8c6efa893ddc5a548ed5994", "type": "domain", "value": "sync.1rx.io", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-49abd37753c4bd1fde9667be", "type": "domain", "value": "sync.ipredictive.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e780d2eb559368217c4935b4", "type": "domain", "value": "sync.mathtag.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-92632e260d68d24bc0ad84d0", "type": "domain", "value": "sync.srv.stackadapt.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b4fab1a373a658a89498600a", "type": "domain", "value": "t.myvisualiq.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-38a2e63ff09d8ac03fef0a08", "type": "domain", "value": "tag.idsync.analytics.yahoo.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-29ee337d456e8a9bdce327b3", "type": "domain", "value": "tag.sp.advertising.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2e671db1746fe7483b24456a", "type": "domain", "value": "tags.bkrtx.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-57adbb2de2b690c5cb8dc7cf", "type": "domain", "value": "tags.bluekai.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a84960ca6b5cc5fede9eb6ca", "type": "domain", "value": "tpc.googlesyndication.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8ef21ddbdde08a4dae6d5fe5", "type": "domain", "value": "track.adform.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2e87e4be4fb5eeaa5ded4ebd", "type": "domain", "value": "trc.taboola.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ec835da501b440a7893751df", "type": "domain", "value": "uca20a5adbe8d64fd0c7a816e1ec.dl.dropboxusercontent.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-249161752c98b681ba61fff5", "type": "domain", "value": "udc.yahoo.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-33d496bb4fcc17b08e2b8857", "type": "domain", "value": "uipus.semasio.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1a5e02e7cada0f4978dcc449", "type": "domain", "value": "um.simpli.fi", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-dc0b04c8d6a2001f2dd19f7a", "type": "domain", "value": "ups.analytics.yahoo.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-67f0b87758e1e22aacf02a0b", "type": "domain", "value": "us-east-1.onemobile.yahoo.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-64816507c90535f8f2dc4861", "type": "domain", "value": "us.y.atwola.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b3a7449f7eb29dd256815c62", "type": "domain", "value": "www.aol.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-49c3a49e67450740ad70a995", "type": "domain", "value": "www.bankofamerica.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-997e0546c817cbb378c61b65", "type": "domain", "value": "www.bing.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b156e1af2781b5fd861b3b04", "type": "domain", "value": "www.download.windowsupdate.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c49c5c1ffd8c15bc4d3ab37d", "type": "domain", "value": "www.dropbox.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4d779cc905bd60ec4ef799bd", "type": "domain", "value": "www.googletagservices.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a39a17d5bad1845605c59bca", "type": "domain", "value": "x.bidswitch.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-18bf3edf5097d06c55687782", "type": "domain", "value": "z.moatads.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b58a2df6f2b7daa30049a8ff", "type": "ipv4", "value": "104.17.119.107", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7c48f815ef43b61f855afb4e", "type": "ipv4", "value": "104.193.80.60", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4852f1425157e3ac4c2381c6", "type": "ipv4", "value": "104.254.148.196", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f56ed31669039b387efa21e1", "type": "ipv4", "value": "104.254.149.101", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cebc1da97b8c4e766d15bdd9", "type": "ipv4", "value": "104.36.113.17", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2d53ca4541325d978de539f3", "type": "ipv4", "value": "104.36.113.23", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e46cafa851fdbebecbca94bc", "type": "ipv4", "value": "104.36.113.24", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4626bfafbad8683a0e5dae17", "type": "ipv4", "value": "104.69.23.209", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4ceaeeecaef2130a058af2d2", "type": "ipv4", "value": "107.178.246.49", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e84b57f76ea13b0ef5fae632", "type": "ipv4", "value": "107.23.73.96", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-83b3fc5871fc74b10b2d759e", "type": "ipv4", "value": "129.33.138.31", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-514300caa1e6feec3bd00c0c", "type": "ipv4", "value": "13.249.22.83", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8dc2b8aa2d347bb415f91cc8", "type": "ipv4", "value": "134.209.129.254", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b52f047ac24984f0adc15af4", "type": "ipv4", "value": "151.101.0.166", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3780aaaeafee23ffabe8c9f0", "type": "ipv4", "value": "151.101.2.2", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2dacfd2063f084a073586c6d", "type": "ipv4", "value": "151.101.2.49", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7c79a5ea695879350448e5da", "type": "ipv4", "value": "151.101.66.49", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b345365ded2c8f9b851755bf", "type": "ipv4", "value": "152.195.14.41", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1f53c052aec38f4bac302b18", "type": "ipv4", "value": "152.195.32.163", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7ae363b7060bc984ac75344f", "type": "ipv4", "value": "152.195.55.192", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-edbd045df04e0ba0a1c10e1d", "type": "ipv4", "value": "152.199.24.48", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ec543c049dedd0606b4cc346", "type": "ipv4", "value": "152.199.6.11", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7265c12fe24ef62c7910de21", "type": "ipv4", "value": "152.199.6.14", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cd1486b21b81e91390b9d8d7", "type": "ipv4", "value": "152.199.6.24", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-40e90a0eb9c1ca963aac1043", "type": "ipv4", "value": "156.154.202.36", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e521cc1e5c5ffc7900caee8c", "type": "ipv4", "value": "162.125.8.1", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-dbb7647a68b9557e4ce3aea8", "type": "ipv4", "value": "162.125.8.6", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-56e9638f5ae4fa161c868a5b", "type": "ipv4", "value": "169.62.192.207", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d9a0ceb19a8a0a575d607ace", "type": "ipv4", "value": "171.161.198.200", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6a4ce0958aa0de1b0433a911", "type": "ipv4", "value": "171.161.202.100", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-550aa9326df0c8efce222f13", "type": "ipv4", "value": "172.217.1.130", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cc3c93d60f7ea73c07ad7d20", "type": "ipv4", "value": "172.217.12.38", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-573007f493d45b464f5bdb1e", "type": "ipv4", "value": "172.217.12.65", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-269d6bfdf7f801ab5d5b96fc", "type": "ipv4", "value": "172.217.12.67", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6c6d7cc79d29283d5ceda043", "type": "ipv4", "value": "172.217.14.166", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5caf8dc4f2de755244e1d53c", "type": "ipv4", "value": "173.231.184.20", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-dd9581387a14bb8410678c7c", "type": "ipv4", "value": "18.210.147.153", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c8d40ffb1f0996dfb1ff5450", "type": "ipv4", "value": "18.214.122.84", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-67bdef73c947d1c9995eeaff", "type": "ipv4", "value": "184.86.155.127", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-bba1d7785044d632c3212dc4", "type": "ipv4", "value": "185.167.164.42", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0cafb19380d920cd90022381", "type": "ipv4", "value": "192.184.69.225", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ab5b144237527f61d800146c", "type": "ipv4", "value": "192.229.210.141", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5a9a5ecbf9b0051bb88859e2", "type": "ipv4", "value": "192.229.211.36", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ba7483382bc3edd59f2f7b3a", "type": "ipv4", "value": "198.70.69.154", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fad8af9fc558dee4cc3c425f", "type": "ipv4", "value": "198.8.70.128", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-157882c01902966bc15b9402", "type": "ipv4", "value": "199.255.32.89", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a70a0e2a4468089d022b60c8", "type": "ipv4", "value": "204.74.252.20", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-04e2557fec513ca02ec4c652", "type": "ipv4", "value": "204.79.197.200", "priority": 45, "reasons": [ "http_request-peer", "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8918a982f46c7d6289576bb5", "type": "ipv4", "value": "205.180.86.172", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6276f5efb51efa07442bea52", "type": "ipv4", "value": "209.15.36.35", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a7199643c60390b3b4771e2e", "type": "ipv4", "value": "216.200.232.221", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-09295d5e01b2eb4cf020d04b", "type": "ipv4", "value": "216.58.193.130", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7f9f6575f2a0ea01ee52a552", "type": "ipv4", "value": "216.58.194.106", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-10e6b7b280ccc73ee40f0b33", "type": "ipv4", "value": "23.11.217.11", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4f6925b684b68889408ecbcb", "type": "ipv4", "value": "23.11.217.71", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d9c3b73862ec72f1aef5ee1f", "type": "ipv4", "value": "23.11.218.15", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cdffad18321c16dfc0d95b4e", "type": "ipv4", "value": "23.67.118.68", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8729e07b290f08394fcdb12d", "type": "ipv4", "value": "23.67.120.135", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d4183688314d4160d7893aa1", "type": "ipv4", "value": "23.7.93.115", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f904f658e186e1247f183a21", "type": "ipv4", "value": "3.136.40.187", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-dd0110cdbfa1a521cd565eab", "type": "ipv4", "value": "3.218.16.73", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3e4244f35fc1b0cef3b0f8ff", "type": "ipv4", "value": "3.220.227.225", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7fd9626ab2eaca439b748d59", "type": "ipv4", "value": "3.83.197.207", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7a407b4c4e726429adae9b13", "type": "ipv4", "value": "34.193.46.35", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5c244ab5be8b670656954256", "type": "ipv4", "value": "34.204.232.247", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3a8fe68b8d94e7e662dd1023", "type": "ipv4", "value": "34.204.4.212", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ed97a160dd745ca9c6cfa22e", "type": "ipv4", "value": "34.231.235.125", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-762b37d8975c5a28b351cf61", "type": "ipv4", "value": "34.232.64.168", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-caf874f62f1debebf188d945", "type": "ipv4", "value": "34.235.45.38", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-242368323c2072b7f79dd7bd", "type": "ipv4", "value": "35.169.207.73", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b4bb6055ddea709a20999aac", "type": "ipv4", "value": "35.171.168.180", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-28947f5eb77231777e426a82", "type": "ipv4", "value": "35.186.239.238", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8bee1cd4d6799d36b3ef0518", "type": "ipv4", "value": "35.190.36.172", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4d6b6853f811ef495278b091", "type": "ipv4", "value": "35.190.72.161", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c988b0ee39060f6ecc837bca", "type": "ipv4", "value": "35.207.24.140", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b4b01a9efc3cbb5327052afc", "type": "ipv4", "value": "35.211.144.153", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7e3e13c33a393840fffec975", "type": "ipv4", "value": "37.157.6.246", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-37c0e20dc55862c5af86bd92", "type": "ipv4", "value": "38.67.14.233", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6b09dfc3af6d4c4f950625ef", "type": "ipv4", "value": "50.116.194.21", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0af7e410a1ec1c905466b7ac", "type": "ipv4", "value": "50.57.31.206", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-92552260408c29a8b96c584a", "type": "ipv4", "value": "52.202.55.102", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3fe59f137eb29797c231fd27", "type": "ipv4", "value": "52.54.122.125", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cfae031c2a937a636534e1ac", "type": "ipv4", "value": "52.7.147.140", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9271a1b92de8c4e4f38c9e04", "type": "ipv4", "value": "52.71.154.85", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fcbed6d57bc9e4a77324e3fe", "type": "ipv4", "value": "52.72.249.172", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e11c22f4dc51d9520f82efc0", "type": "ipv4", "value": "54.158.57.141", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-193165302e963e19625fc9f4", "type": "ipv4", "value": "54.175.7.235", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d4813034575ffa8ffd6a0041", "type": "ipv4", "value": "54.175.88.188", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c7890c1a63b6e098de1387e4", "type": "ipv4", "value": "54.186.165.46", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a3c6be663c6a01d973e6ce16", "type": "ipv4", "value": "54.236.178.170", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-03adb873196351ec145021d5", "type": "ipv4", "value": "54.82.194.252", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3b7bf8396306dac6f3a6db16", "type": "ipv4", "value": "54.84.47.220", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-030d0ddc3a76821c297b8a1c", "type": "ipv4", "value": "54.85.102.186", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-21ac632502395d7df3a57b3b", "type": "ipv4", "value": "66.218.84.42", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b1d57a74c4cec4677f233738", "type": "ipv4", "value": "66.218.87.13", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-47f5b4fd5f492ef23ea729f2", "type": "ipv4", "value": "66.235.147.244", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-64a0cd61dbc091a34bb113e0", "type": "ipv4", "value": "67.195.204.151", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b3169ba94cd2601fd69e02e5", "type": "ipv4", "value": "69.147.64.34", "priority": 45, "reasons": [ "http_request-peer", "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f19eab796c60a950a6883b1b", "type": "ipv4", "value": "70.42.32.63", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-31028ffaaf8d3e7fc2a3cdd5", "type": "ipv4", "value": "72.21.81.200", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e64b93d6e7b7effd94ae24c6", "type": "ipv4", "value": "74.119.118.138", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-afe7fe4558316a8b1f183cb5", "type": "ipv4", "value": "74.6.138.72", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8f8c519f97fbc2509f57ec48", "type": "ipv4", "value": "74.6.138.75", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f94d3aa9e3221707e70204a7", "type": "ipv4", "value": "76.13.32.137", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d4fab433c0d07dc62447758e", "type": "ipv4", "value": "8.41.222.150", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d3e99ed55e4db86c249e448a", "type": "ipv4", "value": "91.199.212.52", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5d5be013f088d3596c344284", "type": "ipv4", "value": "96.6.83.178", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9ffe4088db736fbafc8d9dc6", "type": "ipv4", "value": "98.136.96.149", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0e20feb79454b70c5514fa7c", "type": "ipv4", "value": "98.137.155.9", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-61f87aba05dc914eddffdf1b", "type": "ipv4", "value": "98.137.156.136", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e2ef891c0828192beb5346cc", "type": "ipv4", "value": "98.137.156.137", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-74dc1ee542b4613c2c7b6f39", "type": "ipv4", "value": "99.86.77.108", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f2b177fc91e9f6435596fac8", "type": "sha256", "value": "0b504e7f3cec848c7a1c25720cc40e7fd6919e217b4f56e50f645bda49259a39", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a532952f1ddea355cc7dd963", "type": "sha256", "value": "1a5174980a294a528a110726d5855650266c48d9883bea692b67b6d726da98c5", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b142bca25c30d58367f14dd9", "type": "sha256", "value": "1f0bad278e2bf2f41979f2144a94cb85ac19d93abd041230b236463a992d9190", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c97fe5cd53607b4c4a201952", "type": "sha256", "value": "52307c67a1d0d310baf70fb8c346eb51856b73c08f9cf67535720b900023ee5e", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f1f32b32dbfc3116cc209b30", "type": "sha256", "value": "5b80b1566219a6c3321b14127ebae23f73a18fd50a0751d2179e42d461e9ad39", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-14a742869b29e21ef4bfd6ce", "type": "sha256", "value": "6c0c18274fed35e973d1c060f2f4137bb91444a78fbafd3be6c5f6d2f3cc63b8", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2ef5f60ecfc8e16eb9b0a94a", "type": "sha256", "value": "6d8a01dc7647bc218d003b58fe04049e24a9359900b7e0cebae76edf85b8b914", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d6277528832b17ff12667299", "type": "sha256", "value": "78f53c3a83a6e9d23f3903efc3a5635ea95fd21264ada13ebb8af23eb761fa40", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-de4352773e8ad91a0ccb43a7", "type": "sha256", "value": "7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ecedf3a97463338f5ebb2dee", "type": "sha256", "value": "839488ebc08446a096a893996ed23eac321ac166724cd8c5d9092057834d2d79", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3855ab944bd33c5847b5abc5", "type": "sha256", "value": "8bbbecf9c7b14eab33a19f0ab1529dd595dbd2ba51ef0dab65201aef80ce18b6", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-aa623d8c42fb2c1c20dab455", "type": "sha256", "value": "a08902c478721cb65ddbb075d5dea373db29f80c15d67cdb23f25ebfb6284fc7", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c2e3b0f5ba40eb47063610ca", "type": "sha256", "value": "a2f75fb154555d2877b0648f52b549a947b9c82bcff786d7c81ba712e9c3f3f8", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fa739bbed164870fcb39de40", "type": "sha256", "value": "afb96043d1f8390179fe445d5063c434d4df10fa0194e7879ecadf4c9e8f9b78", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3c29ab9db064545ed00a8246", "type": "sha256", "value": "c65cb1829bda38e033f2c42d891e2f0cf9cb5bf2352a74a05ffc27049a98cb56", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8769b7b3d3d02eee500a81df", "type": "sha256", "value": "cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-57fe67d7de3860096889ee0e", "type": "sha256", "value": "cf63a226cdfefcc50f0ebd036df2729d1a6493cac1a5b814eec81ce4eed0f948", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d7fdc4de0d69c2abfe4071a1", "type": "sha256", "value": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-bb0aa819f5c331d34de6ff37", "type": "domain", "value": "api.bing.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8f86f35245a1eb8fbe68a586", "type": "domain", "value": "b.aol.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-83e41d6fecaa1c13e303a5cb", "type": "domain", "value": "dns.msftncsi.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8b967e85f04e1de2bcfeed75", "type": "domain", "value": "myip.opendns.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c201ea6cfeef25850f3162e6", "type": "domain", "value": "myip.opendns.com.icemaiden.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-12a7feee0433050805a2ee47", "type": "domain", "value": "resolver1.opendns.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b4736cbf9fedab0bb3a8d531", "type": "domain", "value": "rp.gwallet.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-31034cb0bf2481f4c9756fb1", "type": "domain", "value": "wpad.icemaiden.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-401235d4cc9b6da23fe80a2e", "type": "domain", "value": "wpad.localdomain", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7a77b900cf6e944c01be95b8", "type": "domain", "value": "ad.turn.com.akadns.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-80abe780a41d5f15cba0680f", "type": "domain", "value": "adserver-vpc-alb-0-2072243822.us-east-1.elb.amazonaws.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d4ec6f0c3d118ddc963d99e3", "type": "domain", "value": "beap1.cb.g01.yahoodns.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-818b6c2a14fc32e6d1470743", "type": "domain", "value": "cookie.brealtime.com.cdn.cloudflare.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b393cabf8c39bb0b7ae01658", "type": "domain", "value": "cs550162656.adn.psicdn.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3421a4258340df2b859d932d", "type": "domain", "value": "cs629.wpc.lambdacdn.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6eb5e7cab184e062405555c2", "type": "domain", "value": "cs737157920.wpc.omicroncdn.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e62e9cb95d32767f234e4f76", "type": "domain", "value": "cs747173190.wac.omegacdn.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-dcb174a46072ed1d25a4c118", "type": "domain", "value": "d2u28gf9o4d1cv.cloudfront.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3184e9db19c8f57710aaeac3", "type": "domain", "value": "dart.l.doubleclick.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b3153640c0257552655d2e35", "type": "domain", "value": "ds-ats.member.g02.yahoodns.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9c9e3d5802dc8e59bcdf0cad", "type": "domain", "value": "ds-geoycpi-uno-lite.gycpi.b.yahoodns.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7b4183146e956ccd740a213e", "type": "domain", "value": "ds-pr-bh.ybp.gysm.yahoodns.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d4113795a6a2a978fbcd7b50", "type": "domain", "value": "dxedge-prod-lb-946522505.us-east-1.elb.amazonaws.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b2b225d7a6b7b93ef4a92429", "type": "domain", "value": "edge.gycpi.b.yahoodns.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-87d9ff28dbda0d49f0d80215", "type": "domain", "value": "f2.taboola.map.fastly.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-bbd402ee2a64ad4dbe35ff11", "type": "domain", "value": "fam-geo-atsv2.prod.media.g03.yahoodns.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9bb57fe7b0daff63be7c20b0", "type": "domain", "value": "fo-fd-world-new.yax.gysm.yahoodns.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-bef060f14df6552cf2a8ef88", "type": "domain", "value": "geoycpi-uno.gycpi.b.yahoodns.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d75c164547da339fe492938b", "type": "domain", "value": "gstaticadssl.l.google.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-36d7c19b3b18dcf78504ea04", "type": "domain", "value": "m-node-alb-us-east-1-prod-530825477.us-east-1.elb.amazonaws.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2a4313ed252b9e5877876f0b", "type": "domain", "value": "match-975362022.us-east-1.elb.amazonaws.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ef5eaacb44eb88b3f43b8270", "type": "domain", "value": "matchuseast-1393638539.us-east-1.elb.amazonaws.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-224eb79bcc4d299028f69e40", "type": "domain", "value": "media-router-flurry1.prod.media.wg1.b.yahoo.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-031fabd00ce17948d744c88f", "type": "domain", "value": "pagead-googlehosted.l.google.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7d206dcea8f25727df66bb52", "type": "domain", "value": "pagead.l.doubleclick.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-77f71ee548a7d91604668eaf", "type": "domain", "value": "pagead46.l.doubleclick.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5dab12271fd8ecea3a06d68a", "type": "domain", "value": "pixel-a.sitescout.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-17aace6bd86e7b2781ae5609", "type": "domain", "value": "pixel-origin.mathtag.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5b7302d8816de737b27a04de", "type": "domain", "value": "prod-lb-10-490190718.us-east-1.elb.amazonaws.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1ef520f2bf32d0b1064d1b42", "type": "domain", "value": "prod-lb-13-1730166618.us-east-1.elb.amazonaws.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-25976c10c301eb50ffd9077e", "type": "domain", "value": "prod-lb-8-1772099769.us-east-1.elb.amazonaws.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0c357a35f9c7c5bdec9481e3", "type": "domain", "value": "prod-lb-9-1476932994.us-east-1.elb.amazonaws.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9b2ffba1f40b340a7e40b780", "type": "domain", "value": "prod.contextweb.map.fastlylb.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-481ec601c3a2027f9d6f6c85", "type": "domain", "value": "prod.gxp.pse.public.aol.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b7fdf827e1feba830b1e43a9", "type": "domain", "value": "prod.ups-yahoo.aolp-ds-prd.aws.oath.cloud", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c2106cc7816dc4bd75092498", "type": "domain", "value": "s0-2mdn-net.l.google.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d3dfff5021eca73472170600", "type": "domain", "value": "sdarlasplitroute.gapx.yahoodns.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4c72d28717c3ed3f1c3d99a7", "type": "domain", "value": "secure.ecglb.bac.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1eb7b7fa39e8bbe6da83fb0e", "type": "domain", "value": "service.sp.aolp-ds-prd.aws.oath.cloud", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2f8ad240a36ba423c8a32725", "type": "domain", "value": "spcms-global.pbp.gysm.yahoodns.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6dfd88579bb5f50bfa25b5fc", "type": "domain", "value": "track-eu.adformnet.akadns.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a3f18b195b20258f249b38b4", "type": "domain", "value": "trc.taboola.map.fastly.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-da4c633bb5911121aa3e0378", "type": "domain", "value": "www.dropbox-dns.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4ce79b1c2dc53deecfffa286", "type": "domain", "value": "wwwui.ecglb.bac.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-abf73086dfc3da1242c2d051", "type": "ipv4", "value": "100.24.88.255", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1626197846f93bd04777382f", "type": "ipv4", "value": "101.226.79.205", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3a6d731eaa5b21ac0937494c", "type": "ipv4", "value": "104.17.120.107", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e2123fe179d9a2574663aca9", "type": "ipv4", "value": "104.254.148.133", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4d342cb1c4055ab826d4ef2e", "type": "ipv4", "value": "104.254.148.165", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ecfce700c068823a4315cfed", "type": "ipv4", "value": "104.254.148.198", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-441def818ba878faa869f0a1", "type": "ipv4", "value": "104.254.149.100", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-911d93e6eadbdf909f7eb5b9", "type": "ipv4", "value": "104.254.149.68", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2212c28fc2dff9f7e55dce5d", "type": "ipv4", "value": "104.254.149.69", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3b4157b52c5b538a2715f5c1", "type": "ipv4", "value": "107.23.111.253", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3bf55c691ba6a14f147f37db", "type": "ipv4", "value": "107.23.112.106", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-295a8bfb49942cf0b0951cd1", "type": "ipv4", "value": "107.23.26.245", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-38c6ad687751a49e7297ec5c", "type": "ipv4", "value": "107.23.4.236", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0fbd669116dceddddeacc579", "type": "ipv4", "value": "119.28.48.231", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5777453edd2690d75fad9b05", "type": "ipv4", "value": "13.107.21.200", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-444fae800ecdaeb798557f74", "type": "ipv4", "value": "13.107.5.80", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-019e7520dd77dc655c14b706", "type": "ipv4", "value": "13.249.22.105", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8d95d7e6db80bd76409691f9", "type": "ipv4", "value": "13.249.22.84", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-697c4a7feb91fdfd1b25450a", "type": "ipv4", "value": "13.249.22.87", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2bce9bb7a1bcdd51ffbdfcb2", "type": "ipv4", "value": "130.248.144.16", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8bf3732fa5d71b4098955de5", "type": "ipv4", "value": "130.248.144.17", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ded2b8249a70d699f9fe94dc", "type": "ipv4", "value": "130.248.144.18", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c3102a39d68eee7a8e413128", "type": "ipv4", "value": "130.248.144.19", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4ecf0a0b046b5bb5c46d7481", "type": "ipv4", "value": "130.248.144.23", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cd312c13da125f8c4c1f02c8", "type": "ipv4", "value": "131.107.255.255", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f6ee905a2676b897eb906ba0", "type": "ipv4", "value": "151.101.128.166", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9d55340d034c37eaf0e2803b", "type": "ipv4", "value": "151.101.130.2", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ef52dadc716702ec36a69e7e", "type": "ipv4", "value": "151.101.130.49", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8db610826d35e418eb0434b2", "type": "ipv4", "value": "151.101.192.166", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8281da5f1499ae8725bd39d6", "type": "ipv4", "value": "151.101.194.2", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-12f75831784690ec4c0544ea", "type": "ipv4", "value": "151.101.194.49", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-bd3bc059462cd6c537490550", "type": "ipv4", "value": "151.101.64.166", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d2b494563fd89c0b32284de2", "type": "ipv4", "value": "151.101.66.2", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6d6679e5a03ae654a7dd134f", "type": "ipv4", "value": "156.154.136.36", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-78cdea9642dc3164d8528b0c", "type": "ipv4", "value": "174.129.98.238", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f7cacf564d4c0a88d8a2784e", "type": "ipv4", "value": "18.190.121.125", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-afb03954389d024b342587c7", "type": "ipv4", "value": "18.207.32.160", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-24ce2f21c1e572e120cbe3ca", "type": "ipv4", "value": "18.208.41.141", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-89256dea8f119075b7a778ee", "type": "ipv4", "value": "18.209.186.85", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4cfc9267cf64704e5af6829f", "type": "ipv4", "value": "18.211.132.79", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a6bba22da108d9081179911c", "type": "ipv4", "value": "18.215.90.62", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-824c188a20227041c456f31f", "type": "ipv4", "value": "18.232.193.181", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-48de171fac5d1f0325515e48", "type": "ipv4", "value": "18.233.175.78", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-951e65f6e507a2c584b23275", "type": "ipv4", "value": "18.233.219.152", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f64ea3ee382d988de68251db", "type": "ipv4", "value": "18.235.19.208", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4b9ef054aab81ab8a6fb6b9c", "type": "ipv4", "value": "18.235.25.252", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cb5862ade133b232d2ffa802", "type": "ipv4", "value": "180.163.8.114", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3bb361ff3506a9e1771f8d91", "type": "ipv4", "value": "184.172.48.71", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c9fb67f0dae058f4624cb71e", "type": "ipv4", "value": "184.203.37.188", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-51dac8e51a0d5350ce4cfaa6", "type": "ipv4", "value": "185.167.164.43", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6d1006ebcd51ca7f504849c0", "type": "ipv4", "value": "185.167.164.49", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b8ea62a680c21db4d49943a7", "type": "ipv4", "value": "185.167.164.51", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6ab63c6c4a700e1d46163e67", "type": "ipv4", "value": "192.184.69.155", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fc204f7e0082b0be14f6af0a", "type": "ipv4", "value": "192.184.69.156", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6bd85929f84b67ef2a4a7bae", "type": "ipv4", "value": "192.184.69.183", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b9db4f1c1937872982f91cd1", "type": "ipv4", "value": "192.184.69.197", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4b99db10171e4428e06c07a4", "type": "ipv4", "value": "192.184.69.204", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6f15b5822ed3d9ee61dcc305", "type": "ipv4", "value": "192.184.69.243", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5a76df3445c61f8d08ee6c23", "type": "ipv4", "value": "192.184.69.244", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-86985aa49b1a045aa11fd98c", "type": "ipv4", "value": "193.183.98.66", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ef01ebc7bef18dec2ec44f43", "type": "ipv4", "value": "198.70.69.161", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5fe6de0b69ec58f1575ac0bc", "type": "ipv4", "value": "204.74.252.28", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c90673b3b9499536abac2604", "type": "ipv4", "value": "208.67.222.222", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9a29e85c628ac3181db74d76", "type": "ipv4", "value": "216.200.232.201", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ded7f05c1af8b2cb1cdf8b90", "type": "ipv4", "value": "3.13.100.77", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8da81b0fa6a3f4365386b297", "type": "ipv4", "value": "3.135.8.221", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-192652a35367578be005b5ac", "type": "ipv4", "value": "3.136.2.145", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9aa105d2bd26e51b3f7ebe5d", "type": "ipv4", "value": "3.136.4.126", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-69d9da9f83d1c34812bfe04a", "type": "ipv4", "value": "3.18.142.126", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-aac52f7d6086501ac050cdd8", "type": "ipv4", "value": "3.19.254.171", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-64b84e4d1f087491d6e946f5", "type": "ipv4", "value": "3.213.234.38", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2183f1c9baa6f81b76680f2a", "type": "ipv4", "value": "3.213.8.28", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d03cd857bfaf77e48a44d60a", "type": "ipv4", "value": "3.215.246.105", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-74db95b279ca3f5d493acf22", "type": "ipv4", "value": "3.216.103.132", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-dc8b6c49110ac26100310901", "type": "ipv4", "value": "3.221.250.206", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-18840df1b8deb0796581255d", "type": "ipv4", "value": "3.223.16.87", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f02543800ff642450668612a", "type": "ipv4", "value": "3.225.187.149", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2e7c5447282fa8b33d185a2d", "type": "ipv4", "value": "3.226.23.55", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-47de3f25a2ddb3bd5afb9ab6", "type": "ipv4", "value": "3.232.65.116", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4561f8f4a23dca047d0cdebe", "type": "ipv4", "value": "34.194.106.87", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4c596c56ca45be56de843fe4", "type": "ipv4", "value": "34.196.158.70", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4738f80700305ad4f18f476a", "type": "ipv4", "value": "34.197.7.23", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a17726e1629ed9d42802f8b8", "type": "ipv4", "value": "34.199.169.142", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e568cace9dd4d659e37f2c10", "type": "ipv4", "value": "34.200.67.128", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e8179306bab887a89dd62e32", "type": "ipv4", "value": "34.201.90.208", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-16d51c4c455b18a1cf566957", "type": "ipv4", "value": "34.204.123.32", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cdacb4f9e120baac8e1faf98", "type": "ipv4", "value": "34.224.172.188", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-46865c1bff4f250db2ebc543", "type": "ipv4", "value": "34.225.20.218", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-248bb3ba8c3170487aa3128c", "type": "ipv4", "value": "34.226.173.88", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-82e5d34d6fbf46d48bc84a23", "type": "ipv4", "value": "34.228.100.37", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cfc7a909fecb4943454d7df4", "type": "ipv4", "value": "34.232.21.42", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0a8d5aad0aac5f6519e808b1", "type": "ipv4", "value": "34.233.8.16", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c6b83ead36aa14ab20a92fe9", "type": "ipv4", "value": "34.235.254.111", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f19c6e4bf437ca585475550e", "type": "ipv4", "value": "34.236.118.184", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1979d5f40f68ae20ab92cffb", "type": "ipv4", "value": "34.236.135.105", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cd34721d9896b91c1c39e734", "type": "ipv4", "value": "34.236.202.21", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-950d101c75f49a4add508aee", "type": "ipv4", "value": "34.237.248.89", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-87b928c885a26d9a8322cdb7", "type": "ipv4", "value": "34.238.112.88", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4cae5e558c99338b67eae5fd", "type": "ipv4", "value": "34.239.215.228", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-315408110d5353a97523afb7", "type": "ipv4", "value": "35.153.187.227", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-36780b13b2284b1ad59d4795", "type": "ipv4", "value": "35.153.21.25", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-45c1ae8921fcb2172f7f780f", "type": "ipv4", "value": "35.153.252.120", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-28b874b6e587e64fce09a17f", "type": "ipv4", "value": "35.161.118.229", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fd06130632e2745eeda62977", "type": "ipv4", "value": "35.165.180.187", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-75f98d3101f878714e039888", "type": "ipv4", "value": "35.170.121.134", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f05cacd6b22638bbd2a39cab", "type": "ipv4", "value": "35.170.22.17", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-809481340acce0a59f9e1ca1", "type": "ipv4", "value": "35.171.202.176", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-daab9e34ed86e707701a1a4c", "type": "ipv4", "value": "35.171.48.153", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-53615dde138f7030908c71a7", "type": "ipv4", "value": "35.172.104.215", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e38f87318de2b864cde08779", "type": "ipv4", "value": "35.173.158.96", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ea8df95b2fc7e0d856824d13", "type": "ipv4", "value": "35.174.30.193", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-238b09044bda7270b18214ef", "type": "ipv4", "value": "35.211.183.51", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8d2460214d0f5858bff1af8c", "type": "ipv4", "value": "37.157.2.236", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-001ad0d95198b9995b771891", "type": "ipv4", "value": "37.157.2.237", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1f412396f15767a60ff5b904", "type": "ipv4", "value": "37.157.4.23", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-40f567398583c66b9639b319", "type": "ipv4", "value": "37.157.4.41", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-642eab2df5782850069c4e57", "type": "ipv4", "value": "37.157.6.252", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b041c61a5ebe3c8d9bd70c12", "type": "ipv4", "value": "50.16.169.17", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-76e13ded5fc4f6cc9a79a945", "type": "ipv4", "value": "50.97.145.208", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-806f22b109941f95825f8d52", "type": "ipv4", "value": "52.0.90.21", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7b316242fd42bbde5fd8c1ec", "type": "ipv4", "value": "52.2.220.123", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9502dcc94e310e0b2481ac21", "type": "ipv4", "value": "52.20.183.229", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6fc38197bac4a7ca56990701", "type": "ipv4", "value": "52.20.71.5", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e5675b59d0bb35fe58ee3e1c", "type": "ipv4", "value": "52.200.145.54", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a6420c710a2733de311273b9", "type": "ipv4", "value": "52.201.28.115", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-36682e6e53f38429c914ff66", "type": "ipv4", "value": "52.202.0.127", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1a9b513f087dc7571b74a3e3", "type": "ipv4", "value": "52.202.126.226", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d926a3cb24f527f527c9cad9", "type": "ipv4", "value": "52.202.174.197", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c3ac2ae319d632bd7d4d25d5", "type": "ipv4", "value": "52.203.83.158", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c2d0ded54053e14b5689b206", "type": "ipv4", "value": "52.204.252.186", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3c2cf0f3061325b16c985f2f", "type": "ipv4", "value": "52.204.50.104", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f4c0989970215b1d2c1ab39c", "type": "ipv4", "value": "52.206.226.12", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-62a0980790bbd1ec8cdfb433", "type": "ipv4", "value": "52.21.200.160", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-197fbe00ff85c9b368d36083", "type": "ipv4", "value": "52.21.98.231", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-73c995b781a776a095920269", "type": "ipv4", "value": "52.22.131.123", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-db7ea7e6365c32306ca8fea8", "type": "ipv4", "value": "52.22.146.21", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-64c8be63300d2af82d71fa91", "type": "ipv4", "value": "52.22.184.73", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-33e51978c7e143a7c4601519", "type": "ipv4", "value": "52.3.11.61", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-110d312d6d125b165cd3177e", "type": "ipv4", "value": "52.3.158.69", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2b18a92f0c602bb095368c26", "type": "ipv4", "value": "52.36.218.9", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-830578ecf0f4222216a861d1", "type": "ipv4", "value": "52.38.185.101", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-63d93f89ad12204d9e250933", "type": "ipv4", "value": "52.39.132.98", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6771e47b31602c59c6d24136", "type": "ipv4", "value": "52.42.99.244", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-08da2d5a005b1ed529227673", "type": "ipv4", "value": "52.43.190.106", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8c12dfd7e353433ef04b56d6", "type": "ipv4", "value": "52.44.42.164", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c268ed23d0b0fc7a446bd63a", "type": "ipv4", "value": "52.45.100.81", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-62bdc6bd90a5d69b513fbfa8", "type": "ipv4", "value": "52.45.29.95", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-365c91bf7ea9f2fdc0ed28f6", "type": "ipv4", "value": "52.45.82.224", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-14e3680253a802ab470510ac", "type": "ipv4", "value": "52.5.227.122", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-35579aa27eb812a31bec6163", "type": "ipv4", "value": "52.55.150.239", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-dbef03c98bbef299d39d376e", "type": "ipv4", "value": "52.6.242.143", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b5c70369668dcae048453fd4", "type": "ipv4", "value": "52.6.39.34", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-34e4f3332dea8a6a7fc09d23", "type": "ipv4", "value": "52.70.198.170", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-27d065fcc85a5d5a22538d16", "type": "ipv4", "value": "52.70.56.26", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d8217fe7424fec51bfd067d0", "type": "ipv4", "value": "52.71.118.158", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d0b09d8697e2c3c053b33d2c", "type": "ipv4", "value": "52.71.168.120", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-077e247b22616982724ba6d8", "type": "ipv4", "value": "52.73.155.113", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-939fe9c2aa3702c3a44b56c7", "type": "ipv4", "value": "52.73.52.157", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0019f4273661de717d4b8ba7", "type": "ipv4", "value": "52.73.69.206", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1b03595d45972a94ccecea02", "type": "ipv4", "value": "52.73.9.0", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-08ffc226e23aba55a051132c", "type": "ipv4", "value": "52.86.28.222", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c8a18c604cdcba44f410f901", "type": "ipv4", "value": "52.86.75.171", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-05a7229153c0974cb0e07a2b", "type": "ipv4", "value": "52.87.22.170", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-576badc482c95005c7f02ea6", "type": "ipv4", "value": "52.87.90.62", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a983d6441ddc1c7c18b9cec5", "type": "ipv4", "value": "54.145.171.0", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5818a970463bc714a55a51b0", "type": "ipv4", "value": "54.152.229.194", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9404daf673e6454fd214d1d1", "type": "ipv4", "value": "54.152.30.174", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1921371a35d995affe330354", "type": "ipv4", "value": "54.156.168.222", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-262a2a8fcf3d0929f63110d1", "type": "ipv4", "value": "54.164.248.61", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7949cbb80a1756c674323b8b", "type": "ipv4", "value": "54.165.26.158", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a7173b7f45ce592c4eab36ac", "type": "ipv4", "value": "54.208.163.85", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-469792b65c3b9c1706950d06", "type": "ipv4", "value": "54.209.191.239", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-97e6a694369dc4997fb15797", "type": "ipv4", "value": "54.209.242.98", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-222137882f5c5ca3c4b700ee", "type": "ipv4", "value": "54.209.58.223", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-adcf1cee3efd84665fd95059", "type": "ipv4", "value": "54.209.91.178", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-647670111627ef36fd4ab2cb", "type": "ipv4", "value": "54.209.98.151", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d31ea48d9b8d342056fd1a16", "type": "ipv4", "value": "54.226.243.22", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0d773138152baf4f3fa669e9", "type": "ipv4", "value": "54.236.214.197", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5a2d9223add3879847ccd18f", "type": "ipv4", "value": "54.88.83.158", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d4bf676f3e996f4b005521ff", "type": "ipv4", "value": "54.88.96.255", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e460ffa09217c7a9f7ecd346", "type": "ipv4", "value": "54.89.56.97", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-950a640a3dc0ee10275e8a3d", "type": "ipv4", "value": "58.251.121.110", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-71aa80c53555f571891b3a0b", "type": "ipv4", "value": "64.58.116.196", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3c09ec8a15d2190c19ab13ec", "type": "ipv4", "value": "64.58.116.236", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3fbb69d56f81029991a93f1d", "type": "ipv4", "value": "64.58.119.36", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-20b9386a80dce79e5194ef15", "type": "ipv4", "value": "66.218.84.43", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a9880152b69cba0953a442c8", "type": "ipv4", "value": "66.218.87.15", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-44bbe19a6301086368948297", "type": "ipv4", "value": "66.235.147.232", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-905b1736023538321501e5d4", "type": "ipv4", "value": "66.235.147.233", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-41145260387bd79d756d84d5", "type": "ipv4", "value": "66.235.147.234", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-53f68e869e22eea3b384710a", "type": "ipv4", "value": "66.235.147.235", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-65e7710e0aaae1409d18e694", "type": "ipv4", "value": "66.235.147.236", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-83cfa1ffc9204eac8e6f83f9", "type": "ipv4", "value": "66.235.147.237", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e4d688045a38af5ea8346e8a", "type": "ipv4", "value": "66.235.147.238", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-33d662dfaec9bff26b81f9f1", "type": "ipv4", "value": "66.235.147.239", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-36a8409e278a5e9e557d483a", "type": "ipv4", "value": "66.235.147.240", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1394e46215b0972ccc8709ae", "type": "ipv4", "value": "66.235.147.246", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7a61a58a9a2c0af8550ab7e6", "type": "ipv4", "value": "69.147.64.33", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-30373f8458d92ffb739136b2", "type": "ipv4", "value": "72.5.64.63", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-033c632538dfc86eba6a21d9", "type": "ipv4", "value": "74.121.138.36", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-02558c400da39ed25650183f", "type": "ipv4", "value": "74.121.138.90", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9dc01ef46aa3efb7c24b949d", "type": "ipv4", "value": "74.6.138.64", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-205e824adb5f7118fb361a4c", "type": "ipv4", "value": "74.6.143.14", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-30eb8700f26d07ed050d1edc", "type": "ipv4", "value": "74.6.228.136", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-201365a25ed86d190a811b84", "type": "ipv4", "value": "74.6.228.137", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6c0b824554011425125b7986", "type": "ipv4", "value": "74.6.231.10", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f46f09251e7d7e078dc975d5", "type": "ipv4", "value": "98.138.71.148", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0bf5b98d6c5d64d0dd9d4da1", "type": "ipv4", "value": "98.138.71.149", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1d114d99b74a135daee72bce", "type": "ipv4", "value": "99.86.77.3", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9aa081356111d70b5853d808", "type": "ipv4", "value": "99.86.77.5", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3cac7f333836d16cadebd094", "type": "ipv4", "value": "99.86.77.59", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-31893647f5c0c7cc982f3a76", "type": "domain", "value": "h1.wensa.at", "priority": 61, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e397fc7e778496bac3dac380", "type": "domain", "value": "api2.casus.at", "priority": 60, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-92302ffc29d33e2ec022cabc", "type": "domain", "value": "w8.wensa.at", "priority": 60, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-17d14a27c223b2f53d17b43a", "type": "ipv4", "value": "8.208.24.139", "priority": 60, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5d457c947380fa15fc9bb743", "type": "domain", "value": "a.tribalfusion.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-094d4fac48fb64fd59c46c1f", "type": "domain", "value": "aa.agkn.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-acb5dbd36b8670eb6e65598e", "type": "domain", "value": "ad.doubleclick.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c84950f3b1fce8b4e4c51c92", "type": "domain", "value": "ad.turn.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-102021d5d0e7bf80cdfb1751", "type": "domain", "value": "ads.pubmatic.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-31dc241354ff0bff8e876c61", "type": "domain", "value": "ads.yahoo.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-527ab6475e33966fa862b7d3", "type": "domain", "value": "ads.yap.yahoo.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9cdd32d434f1ee3a44a43e59", "type": "domain", "value": "adserver.adtech.advertising.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-32ef5d448f2bd5cc0a30ad9e", "type": "domain", "value": "aero.bankofamerica.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7e43d55a5fe2bd53bb6180e8", "type": "domain", "value": "aka-cdn.adtechus.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-92962bb482ea1243cfc95546", "type": "domain", "value": "api.login.aol.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b175953c3556bacea93d2923", "type": "domain", "value": "apx.moatads.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-eee2f162b77a33664598f447", "type": "domain", "value": "at.atwola.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-69163faa4644efe6f6c92969", "type": "domain", "value": "audex.userreport.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0eb5dad8d2bbf156e4e6e460", "type": "domain", "value": "awuseb.advanced-web-analytics.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c1ca62d275d487faa211ad9b", "type": "domain", "value": "b1sync.zemanta.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-038baef259648cbfbe4de5ea", "type": "domain", "value": "bankofamerica.tt.omtrdc.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b976ceb017e63e01812eb3de", "type": "domain", "value": "beap.gemini.yahoo.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cef84fa09435bfa8c9436fd8", "type": "domain", "value": "bh.contextweb.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8759cea9cfa68bf20e28efee", "type": "domain", "value": "bm.adentifi.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1b36a6859ec3d67f91e32b2b", "type": "domain", "value": "boss.bankofamerica.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cb61d9b74c3ca69303f3895a", "type": "domain", "value": "c.fqtag.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-bf331719c013b37bb9accce6", "type": "domain", "value": "c1.adform.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a69bed8a9cf47e16d0b4c3be", "type": "domain", "value": "casale-match.dotomi.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-23f25314663154b353843685", "type": "domain", "value": "cdn.fqtag.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-50321f90b882642588797dae", "type": "domain", "value": "cm.adgrx.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f1030a7ae8cc443f76affadf", "type": "domain", "value": "cm.eyereturn.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-46011bfd52503a3760f74fcb", "type": "domain", "value": "cm.g.doubleclick.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c7bf9faa2bd18f146295e7f0", "type": "domain", "value": "cms.analytics.yahoo.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8103ffcc03f19ff3a50a4176", "type": "domain", "value": "consent.cmp.oath.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4a61cad65fdd3e0ae078fef3", "type": "domain", "value": "cookie.brealtime.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0fe3eeefc5b698a1867ce9ac", "type": "domain", "value": "crt.usertrust.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-417bd4be1e243993c77e60aa", "type": "domain", "value": "csm2waycm-atl.netmng.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-52ce2be832fd6d42a90b521b", "type": "domain", "value": "d.adroll.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-350d9ade5f63dd6a90cfba17", "type": "domain", "value": "d.agkn.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f7bd17f3a585e0914a85f683", "type": "domain", "value": "data.coremetrics.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-56be77e2df29fdc0d8032c2e", "type": "domain", "value": "dis.criteo.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-bf737cad0145f495bcd81fc1", "type": "domain", "value": "dpm.demdex.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8b05266a91b50044a75389a9", "type": "domain", "value": "dsum-sec.casalemedia.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-bd067b2162665756a56b4dd6", "type": "domain", "value": "dsum.casalemedia.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c7ebc047f69e57cd24c7da2c", "type": "domain", "value": "dull.bankofamerica.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1229bafb89b93202ef52171f", "type": "domain", "value": "e.serverbid.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0e0896daeedefb950896f7fd", "type": "domain", "value": "fc.yahoo.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1ecd2bb276a8fe143e19fe49", "type": "domain", "value": "fonts.googleapis.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a101666ba0044e36e8f06d55", "type": "domain", "value": "fonts.gstatic.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-21b25939081833ab55750753", "type": "domain", "value": "geo.moatads.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-433a641dc351a0c326074469", "type": "domain", "value": "geo.yahoo.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d644a63266e91fd324da5b44", "type": "domain", "value": "go.microsoft.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b435ca743935f6703dad9358", "type": "domain", "value": "googleads.g.doubleclick.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f2151bfd24e041600180e837", "type": "domain", "value": "googleads4.g.doubleclick.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a0f4a132ff9c49af306eca47", "type": "domain", "value": "guce.advertising.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4f087341ffe14e5fdcf290ad", "type": "domain", "value": "guce.aol.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-23fcbd1b6899af2fa0be7f69", "type": "domain", "value": "gxp2.mail.aol.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-43d502761133c22bac0209b2", "type": "domain", "value": "ib.adnxs.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a04182d0a119c4e17be36885", "type": "domain", "value": "iecvlist.microsoft.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-05ef48696bde9d3fec6089a7", "type": "domain", "value": "image2.pubmatic.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false } ], "eligible_count": 528, "next_batch": [ "observable-10cc055c5fe6c3127ee2d4ff", "observable-4c0849e5cddf63ce17fe4848", "observable-285ff452b5cb6e0e74ca6455", "observable-76026d979017cfab95acf2f8", "observable-573683686841d23c696138a4", "observable-0fe67f2f5943cc0f3ba6612e", "observable-79f3faa6f04f0b4c9af13a93", "observable-752dacb2399993cae2ce1c27", "observable-ed3aa637e2ee6edf262dc3ac", "observable-f16fcabbbe6413c7cbfc6335" ], "scope": "Query recommendations, not IOC verdicts. Partial provider coverage stays pending; cooldowns/credential failures are not completed checks. Checked means completed attempted direct providers, not all available providers. Review before external disclosure." }, "assessment_sha256": "796d489af3c826d2dcfae9e2bfdc42952edf1951c7f82f15a95b2ff955bfd831" }, "enrichment": { "items": [ { "type": "domain", "value": "image2.pubmatic.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:00.767630+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:00.765133+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:46:00.761909+00:00", "observable_id": "observable-05ef48696bde9d3fec6089a7" }, { "type": "domain", "value": "iecvlist.microsoft.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:00.584505+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:00.581826+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:46:00.579099+00:00", "observable_id": "observable-a04182d0a119c4e17be36885" }, { "type": "domain", "value": "ib.adnxs.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:00.414704+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:00.412045+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:46:00.409307+00:00", "observable_id": "observable-43d502761133c22bac0209b2" }, { "type": "domain", "value": "gxp2.mail.aol.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:00.208923+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:00.206473+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:46:00.203906+00:00", "observable_id": "observable-23fcbd1b6899af2fa0be7f69" }, { "type": "domain", "value": "guce.aol.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:00.015656+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:00.013862+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:46:00.011745+00:00", "observable_id": "observable-4f087341ffe14e5fdcf290ad" }, { "type": "domain", "value": "guce.advertising.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:59.846102+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:59.841828+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:59.836123+00:00", "observable_id": "observable-a0f4a132ff9c49af306eca47" }, { "type": "domain", "value": "googleads4.g.doubleclick.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:59.656743+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:59.651936+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:59.645200+00:00", "observable_id": "observable-f2151bfd24e041600180e837" }, { "type": "domain", "value": "googleads.g.doubleclick.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:42.522371+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:59.638624+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:59.634081+00:00", "observable_id": "observable-b435ca743935f6703dad9358" }, { "type": "domain", "value": "go.microsoft.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:22.062012+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:59.628056+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:59.621308+00:00", "observable_id": "observable-d644a63266e91fd324da5b44" }, { "type": "domain", "value": "geo.yahoo.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:59.453383+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:59.450643+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:59.447511+00:00", "observable_id": "observable-433a641dc351a0c326074469" }, { "type": "domain", "value": "geo.moatads.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:58.866862+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:58.865329+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:58.863620+00:00", "observable_id": "observable-21b25939081833ab55750753" }, { "type": "domain", "value": "fonts.gstatic.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:19.985832+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:58.861777+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:58.860097+00:00", "observable_id": "observable-a101666ba0044e36e8f06d55" }, { "type": "domain", "value": "fonts.googleapis.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:19.818148+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:58.858280+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:58.856222+00:00", "observable_id": "observable-1ecd2bb276a8fe143e19fe49" }, { "type": "domain", "value": "fc.yahoo.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:58.680101+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:58.673713+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:58.669117+00:00", "observable_id": "observable-0e0896daeedefb950896f7fd" }, { "type": "domain", "value": "e.serverbid.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:58.484067+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:58.477158+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:58.471022+00:00", "observable_id": "observable-1229bafb89b93202ef52171f" }, { "type": "domain", "value": "dull.bankofamerica.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:58.301738+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:58.297342+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:58.292227+00:00", "observable_id": "observable-c7ebc047f69e57cd24c7da2c" }, { "type": "domain", "value": "dsum.casalemedia.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:58.133919+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:58.132275+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:58.130513+00:00", "observable_id": "observable-bd067b2162665756a56b4dd6" }, { "type": "domain", "value": "dsum-sec.casalemedia.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:17.077543+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:58.128722+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:58.126748+00:00", "observable_id": "observable-8b05266a91b50044a75389a9" }, { "type": "domain", "value": "dpm.demdex.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:16.880908+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:58.124800+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:58.122213+00:00", "observable_id": "observable-bf737cad0145f495bcd81fc1" }, { "type": "domain", "value": "dis.criteo.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:57.955315+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:57.952644+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:57.949275+00:00", "observable_id": "observable-56be77e2df29fdc0d8032c2e" }, { "type": "domain", "value": "data.coremetrics.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:57.629821+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:57.627662+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:57.625235+00:00", "observable_id": "observable-f7bd17f3a585e0914a85f683" }, { "type": "domain", "value": "d.agkn.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:57.450959+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:57.446437+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:57.441511+00:00", "observable_id": "observable-350d9ade5f63dd6a90cfba17" }, { "type": "domain", "value": "d.adroll.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:57.254705+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:57.249857+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:57.245227+00:00", "observable_id": "observable-52ce2be832fd6d42a90b521b" }, { "type": "domain", "value": "csm2waycm-atl.netmng.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:57.041095+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:57.034868+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:57.027899+00:00", "observable_id": "observable-417bd4be1e243993c77e60aa" }, { "type": "domain", "value": "crt.usertrust.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:56.840518+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:56.836089+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:56.830067+00:00", "observable_id": "observable-0fe3eeefc5b698a1867ce9ac" }, { "type": "domain", "value": "cookie.brealtime.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:56.659170+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:56.656821+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:56.654562+00:00", "observable_id": "observable-4a61cad65fdd3e0ae078fef3" }, { "type": "domain", "value": "consent.cmp.oath.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:56.496007+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:56.494327+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:56.492236+00:00", "observable_id": "observable-8103ffcc03f19ff3a50a4176" }, { "type": "domain", "value": "cms.analytics.yahoo.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:56.335590+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:56.332740+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:56.329945+00:00", "observable_id": "observable-c7bf9faa2bd18f146295e7f0" }, { "type": "domain", "value": "cm.g.doubleclick.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:13.189219+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:56.325893+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:56.322809+00:00", "observable_id": "observable-46011bfd52503a3760f74fcb" }, { "type": "domain", "value": "cm.eyereturn.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:56.146510+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:56.141153+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:56.135071+00:00", "observable_id": "observable-f1030a7ae8cc443f76affadf" }, { "type": "domain", "value": "cm.adgrx.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:55.750716+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:55.746774+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:55.742017+00:00", "observable_id": "observable-50321f90b882642588797dae" }, { "type": "domain", "value": "cdn.fqtag.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:55.568360+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:55.563271+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:55.556993+00:00", "observable_id": "observable-23f25314663154b353843685" }, { "type": "domain", "value": "casale-match.dotomi.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:55.386346+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:55.381409+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:55.376941+00:00", "observable_id": "observable-a69bed8a9cf47e16d0b4c3be" }, { "type": "domain", "value": "c1.adform.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:44:58.799281+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:55.372513+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:55.367322+00:00", "observable_id": "observable-bf331719c013b37bb9accce6" }, { "type": "domain", "value": "c.fqtag.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:55.210934+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:55.208790+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:55.206698+00:00", "observable_id": "observable-cb61d9b74c3ca69303f3895a" }, { "type": "domain", "value": "boss.bankofamerica.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:55.052847+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:55.048608+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:55.043373+00:00", "observable_id": "observable-1b36a6859ec3d67f91e32b2b" }, { "type": "domain", "value": "bm.adentifi.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:54.869581+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:54.865193+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:54.860300+00:00", "observable_id": "observable-8759cea9cfa68bf20e28efee" }, { "type": "domain", "value": "bh.contextweb.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:44:56.288623+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:54.855927+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:54.853543+00:00", "observable_id": "observable-cef84fa09435bfa8c9436fd8" }, { "type": "domain", "value": "beap.gemini.yahoo.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:54.699062+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:54.697350+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:54.695268+00:00", "observable_id": "observable-b976ceb017e63e01812eb3de" }, { "type": "domain", "value": "bankofamerica.tt.omtrdc.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:54.526358+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:54.522517+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:54.517318+00:00", "observable_id": "observable-038baef259648cbfbe4de5ea" }, { "type": "domain", "value": "b1sync.zemanta.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:44:54.921986+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:54.315186+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:54.308522+00:00", "observable_id": "observable-c1ca62d275d487faa211ad9b" }, { "type": "domain", "value": "awuseb.advanced-web-analytics.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:54.137894+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:54.133095+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:54.128669+00:00", "observable_id": "observable-0eb5dad8d2bbf156e4e6e460" }, { "type": "domain", "value": "audex.userreport.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:53.954270+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:53.952182+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:53.949176+00:00", "observable_id": "observable-69163faa4644efe6f6c92969" }, { "type": "domain", "value": "at.atwola.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:53.797240+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:53.795360+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:53.793297+00:00", "observable_id": "observable-eee2f162b77a33664598f447" }, { "type": "domain", "value": "apx.moatads.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:53.621946+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:53.617306+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:53.612219+00:00", "observable_id": "observable-b175953c3556bacea93d2923" }, { "type": "domain", "value": "api.login.aol.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:53.438871+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:53.434055+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:53.429179+00:00", "observable_id": "observable-92962bb482ea1243cfc95546" }, { "type": "domain", "value": "aka-cdn.adtechus.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:53.240271+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:53.236406+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:53.232273+00:00", "observable_id": "observable-7e43d55a5fe2bd53bb6180e8" }, { "type": "domain", "value": "aero.bankofamerica.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:53.052749+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:53.047450+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:53.042502+00:00", "observable_id": "observable-32ef5d448f2bd5cc0a30ad9e" }, { "type": "domain", "value": "adserver.adtech.advertising.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:52.871850+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:52.866834+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:52.862167+00:00", "observable_id": "observable-9cdd32d434f1ee3a44a43e59" }, { "type": "domain", "value": "ads.yap.yahoo.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:52.699627+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:52.697517+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:52.694317+00:00", "observable_id": "observable-527ab6475e33966fa862b7d3" }, { "type": "domain", "value": "ads.yahoo.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:44:48.848605+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:52.476123+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:52.469586+00:00", "observable_id": "observable-31dc241354ff0bff8e876c61" }, { "type": "domain", "value": "ads.pubmatic.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:44:48.666824+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:52.461803+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:52.456084+00:00", "observable_id": "observable-102021d5d0e7bf80cdfb1751" }, { "type": "domain", "value": "ad.turn.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:44:48.311339+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:52.450045+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:52.445360+00:00", "observable_id": "observable-c84950f3b1fce8b4e4c51c92" }, { "type": "domain", "value": "ad.doubleclick.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:44:47.999984+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:52.440318+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:52.435686+00:00", "observable_id": "observable-acb5dbd36b8670eb6e65598e" }, { "type": "domain", "value": "aa.agkn.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:44:46.562458+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:52.431021+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:52.426149+00:00", "observable_id": "observable-094d4fac48fb64fd59c46c1f" }, { "type": "domain", "value": "a.tribalfusion.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:44:46.368151+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:52.421575+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:52.415855+00:00", "observable_id": "observable-5d457c947380fa15fc9bb743" }, { "type": "ipv4", "value": "8.208.24.139", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:52.211664+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:52.207217+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:52.202334+00:00", "observable_id": "observable-17d14a27c223b2f53d17b43a" }, { "type": "domain", "value": "w8.wensa.at", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:52.017176+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:52.011531+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:52.006333+00:00", "observable_id": "observable-92302ffc29d33e2ec022cabc" }, { "type": "domain", "value": "api2.casus.at", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:51.827532+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:51.821850+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:51.814527+00:00", "observable_id": "observable-e397fc7e778496bac3dac380" }, { "type": "domain", "value": "h1.wensa.at", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:51.651368+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:51.649457+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:51.646294+00:00", "observable_id": "observable-31893647f5c0c7cc982f3a76" } ], "coverage": { "cache_hits": 2, "active_scans": 0, "batch_results": [ { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-433a641dc351a0c326074469" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-433a641dc351a0c326074469" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-d644a63266e91fd324da5b44" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-d644a63266e91fd324da5b44" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-b435ca743935f6703dad9358" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-b435ca743935f6703dad9358" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-f2151bfd24e041600180e837" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-f2151bfd24e041600180e837" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-a0f4a132ff9c49af306eca47" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-a0f4a132ff9c49af306eca47" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-4f087341ffe14e5fdcf290ad" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-4f087341ffe14e5fdcf290ad" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-23fcbd1b6899af2fa0be7f69" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-23fcbd1b6899af2fa0be7f69" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-43d502761133c22bac0209b2" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-43d502761133c22bac0209b2" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-a04182d0a119c4e17be36885" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-a04182d0a119c4e17be36885" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-05ef48696bde9d3fec6089a7" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-05ef48696bde9d3fec6089a7" } ], "batch_targets": 10, "payload_uploads": 0, "targets_omitted": 0, "retained_targets": 60, "full_urls_disclosed": 0, "provider_lookups_started": 8 }, "updated_at": "2026-09-22T17:46:00.926829+00:00", "schema_version": "pcap-reputation-v1", "snapshot_sha256": "65fc4a2052f0acba4c4954ace6998a51aae0838f08da7340788d1adc91fa7132", "source_semantic_sha256": "2ce5685240d4e8d4a57342c7b2fcec99b8925adbdbc1f79c94697f24e9fa6993", "previous_snapshot_sha256": "a28cfc24551298a8df92d3973f6f7bd71df9995602016eee03417e258fe14c24" }, "artifact_download_available": true, "source_tlp": "TLP:CLEAR", "techniques": [], "apt_matches": [], "public_note": "Public derivative: full packet extraction retained; provider evidence bounded; other-session details omitted. Original snapshot hashes do not hash this serialized derivative." }