mirror of
https://github.com/activecm/rita
synced 2026-06-08 13:02:45 +00:00
906f53b3e5
Co-Authored-By: Liza Tsibur <liza@activecountermeasures.com>
21 lines
11 KiB
Plaintext
21 lines
11 KiB
Plaintext
{"ts": 1517336154.078555, "uid": "CsDSTo3cGyb7sbxsj5", "id.orig_h": "10.55.100.109", "id.orig_p": 52068, "id.resp_h": "52.44.164.170", "id.resp_p": 80, "trans_depth": 1, "method": "GET", "host": "www.alexa.com", "uri": "/topsites/category;2/Top/Business/", "version": "1.1", "user_agent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.98", "request_body_len": 0, "response_body_len": 178, "status_code": 301, "status_msg": "Moved Permanently", "resp_fuids": ["FfN3lR2RQPdyjaiHo9"], "resp_mime_types": ["text/html"], "origin": "originzxyw", "_path": "http"}
|
|
{"ts": 1517336162.615244, "uid": "ClmlDRtRxVxeI68pc", "id.orig_h": "10.55.100.109", "id.orig_p": 52135, "id.resp_h": "72.21.91.29", "id.resp_p": 80, "trans_depth": 1, "method": "GET", "host": "ocsp.digicert.com", "uri": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQQX6Z6gAidtSefNc6DC0OInqPHDQQUD4BhHIIxYdUvKOeNRji0LOHG2eICEA0xaNqvbgoWhaatVZDMkfU=", "version": "1.1", "user_agent": "Microsoft-CryptoAPI/10.0", "request_body_len": 0, "response_body_len": 471, "status_code": 200, "status_msg": "OK", "info_code": 101, "info_msg": "infoinfowow", "username": "johnsmith123", "password": "password123", "resp_fuids": ["FXoOb7k8rzRYNzHJ4"], "resp_mime_types": ["application/ocsp-response"], "_path": "http"}
|
|
{"ts": 1517336162.68051, "uid": "ClmlDRtRxVxeI68pc", "id.orig_h": "10.55.100.109", "id.orig_p": 52135, "id.resp_h": "72.21.91.29", "id.resp_p": 80, "trans_depth": 2, "method": "GET", "host": "ocsp.digicert.com", "uri": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQQX6Z6gAidtSefNc6DC0OInqPHDQQUD4BhHIIxYdUvKOeNRji0LOHG2eICEA43oR3iLsJeAJczwVsnQCI=", "version": "1.1", "user_agent": "Microsoft-CryptoAPI/10.0", "request_body_len": 0, "response_body_len": 471, "status_code": 200, "status_msg": "OK", "username": "janedoe987", "password": "password987", "resp_fuids": ["FcUaPr28AJNXHOggG6"], "resp_mime_types": ["application/ocsp-response"], "_path": "http"}
|
|
{"ts": 1517336162.725153, "uid": "CCWo4orreGs2jPNm6", "id.orig_h": "10.55.100.109", "id.orig_p": 52137, "id.resp_h": "72.21.91.29", "id.resp_p": 80, "trans_depth": 1, "method": "GET", "host": "ocsp.digicert.com", "uri": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQQX6Z6gAidtSefNc6DC0OInqPHDQQUD4BhHIIxYdUvKOeNRji0LOHG2eICEA43oR3iLsJeAJczwVsnQCI=", "version": "1.1", "user_agent": "Microsoft-CryptoAPI/10.0", "request_body_len": 0, "response_body_len": 471, "status_code": 200, "status_msg": "OK", "resp_fuids": ["F3LsYm3leQvjXuzTu4"], "resp_mime_types": ["application/ocsp-response"], "_path": "http"}
|
|
{"ts": 1517336162.705568, "uid": "CP4HnL1chY8ajVKasj", "id.orig_h": "10.55.100.109", "id.orig_p": 52136, "id.resp_h": "72.21.91.29", "id.resp_p": 80, "trans_depth": 1, "method": "GET", "host": "ocsp.digicert.com", "uri": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQQX6Z6gAidtSefNc6DC0OInqPHDQQUD4BhHIIxYdUvKOeNRji0LOHG2eICEA2PRHwc6RWDvxkHoMg08os=", "version": "1.1", "user_agent": "Microsoft-CryptoAPI/10.0", "request_body_len": 0, "response_body_len": 471, "status_code": 200, "status_msg": "OK", "resp_fuids": ["Ff3vY03uNgIMavws4h"], "resp_mime_types": ["application/ocsp-response"], "_path": "http"}
|
|
{"ts": 1517336166.454364, "uid": "CDoGYf1dVa4HCX9a7d", "id.orig_h": "10.55.182.100", "id.orig_p": 14307, "id.resp_h": "23.52.162.184", "id.resp_p": 80, "trans_depth": 1, "method": "GET", "host": "cdn.content.prod.cms.msn.com", "uri": "/singletile/summary/alias/experiencebyname/today?market=en-US&source=appxmanifest&tenant=amp&vertical=news", "version": "1.1", "user_agent": "Microsoft-WNS/10.0", "request_body_len": 0, "response_body_len": 1104, "status_code": 200, "status_msg": "OK", "resp_fuids": ["FbIccf3JRcPTZ0Mhl2"], "resp_mime_types": ["application/xml"], "_path": "http"}
|
|
{"ts": 1517336166.536286, "uid": "CIzSVB3v25UJ57J6i", "id.orig_h": "10.55.182.100", "id.orig_p": 14308, "id.resp_h": "23.52.161.212", "id.resp_p": 80, "trans_depth": 1, "method": "GET", "host": "tile-service.weather.microsoft.com", "uri": "/en-US/livetile/preinstall?region=US&appid=C98EA5B0842DBB9405BBF071E1DA76512D21FE36&FORM=Threshold", "version": "1.1", "user_agent": "Microsoft-WNS/10.0", "request_body_len": 0, "response_body_len": 4291, "status_code": 200, "status_msg": "OK", "resp_fuids": ["FlBgnw2U3zpKDVBklf"], "resp_mime_types": ["application/xml"], "_path": "http"}
|
|
{"ts": 1517336221.469213, "uid": "CAOYWg3ubRCQ2d1Df", "id.orig_h": "10.55.100.106", "id.orig_p": 50351, "id.resp_h": "52.44.164.170", "id.resp_p": 80, "trans_depth": 1, "method": "GET", "host": "www.alexa.com", "uri": "/topsites/category;3/Top/Business/", "version": "1.1", "user_agent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.98", "request_body_len": 0, "response_body_len": 178, "status_code": 301, "status_msg": "Moved Permanently", "resp_fuids": ["FeN47s20eXPA8jFphf"], "resp_mime_types": ["text/html"], "_path": "http"}
|
|
{"ts": 1517336221.471323, "uid": "CLqFqD1rPXvGRgcJBl", "id.orig_h": "10.55.100.110", "id.orig_p": 55283, "id.resp_h": "52.44.164.170", "id.resp_p": 80, "trans_depth": 1, "method": "GET", "host": "www.alexa.com", "uri": "/topsites/category;4/Top/Business/", "version": "1.1", "user_agent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.98", "request_body_len": 0, "response_body_len": 178, "status_code": 301, "status_msg": "Moved Permanently", "resp_fuids": ["F2wLxg2gR8fBUFkri8"], "resp_mime_types": ["text/html"], "_path": "http"}
|
|
{"ts": 1517336221.47517, "uid": "C20GGk4wslMWs3qNd3", "id.orig_h": "10.55.100.107", "id.orig_p": 58461, "id.resp_h": "52.44.164.170", "id.resp_p": 80, "trans_depth": 1, "method": "GET", "host": "www.alexa.com", "uri": "/topsites/category;3/Top/Business/", "version": "1.1", "user_agent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.98", "request_body_len": 0, "response_body_len": 178, "status_code": 301, "status_msg": "Moved Permanently", "resp_fuids": ["FfuHHp1KvATyPnPV0e"], "resp_mime_types": ["text/html"], "_path": "http"}
|
|
{"ts": 1517336221.756997, "uid": "Cen4LS1FNlGZloD6Th", "id.orig_h": "10.55.100.111", "id.orig_p": 49568, "id.resp_h": "52.55.1.124", "id.resp_p": 80, "trans_depth": 1, "method": "GET", "host": "www.alexa.com", "uri": "/topsites/category;3/Top/Business/", "version": "1.1", "user_agent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.98", "request_body_len": 0, "response_body_len": 178, "status_code": 301, "status_msg": "Moved Permanently", "resp_fuids": ["FxPh9T2JOYuqJEo8bb"], "resp_mime_types": ["text/html"], "_path": "http"}
|
|
{"ts": 1517336222.044612, "uid": "CV6FHE4E0vnxtx3ST3", "id.orig_h": "10.55.100.100", "id.orig_p": 50259, "id.resp_h": "52.55.1.124", "id.resp_p": 80, "trans_depth": 1, "method": "GET", "host": "www.alexa.com", "uri": "/topsites/category;3/Top/Business/", "version": "1.1", "user_agent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.98", "request_body_len": 0, "response_body_len": 178, "status_code": 301, "status_msg": "Moved Permanently", "resp_fuids": ["FGxHCF3N5IG7i1ccAl"], "resp_mime_types": ["text/html"], "_path": "http"}
|
|
{"ts": 1517336222.042848, "uid": "CKcU1qed3rZ6Ad9Q5", "id.orig_h": "10.55.100.104", "id.orig_p": 60433, "id.resp_h": "52.44.164.170", "id.resp_p": 80, "trans_depth": 1, "method": "GET", "host": "www.alexa.com", "uri": "/topsites/category;0/Top/Business/", "version": "1.1", "user_agent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.98", "request_body_len": 0, "response_body_len": 178, "status_code": 301, "status_msg": "Moved Permanently", "resp_fuids": ["FYdgTB3I4LyaNkRBMf"], "resp_mime_types": ["text/html"], "_path": "http"}
|
|
{"ts": 1517336222.142139, "uid": "CScNtt2ZPUfsvQow4d", "id.orig_h": "10.55.100.108", "id.orig_p": 53886, "id.resp_h": "52.44.164.170", "id.resp_p": 80, "trans_depth": 1, "method": "GET", "host": "www.alexa.com", "uri": "/topsites/category;4/Top/Business/", "version": "1.1", "user_agent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.98", "request_body_len": 0, "response_body_len": 178, "status_code": 301, "status_msg": "Moved Permanently", "resp_fuids": ["Fzi0YEThSYKoFpR36"], "resp_mime_types": ["text/html"], "_path": "http"}
|
|
{"ts": 1517336222.219879, "uid": "CDps563r2YR5MB3TRd", "id.orig_h": "10.55.100.103", "id.orig_p": 51099, "id.resp_h": "52.55.1.124", "id.resp_p": 80, "trans_depth": 1, "method": "GET", "host": "www.alexa.com", "uri": "/topsites/category;0/Top/Business/", "version": "1.1", "user_agent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.98", "request_body_len": 0, "response_body_len": 178, "status_code": 301, "status_msg": "Moved Permanently", "resp_fuids": ["FhKu2m4icJt6oQxJSa"], "resp_mime_types": ["text/html"], "_path": "http"}
|
|
{"ts": 1517336222.459335, "uid": "CKgZnCz1yU1k2arch", "id.orig_h": "10.55.100.105", "id.orig_p": 57899, "id.resp_h": "52.44.164.170", "id.resp_p": 80, "trans_depth": 1, "method": "GET", "host": "www.alexa.com", "uri": "/topsites/category;0/Top/Business/", "version": "1.1", "user_agent": "Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.98", "request_body_len": 0, "response_body_len": 178, "status_code": 301, "status_msg": "Moved Permanently", "resp_fuids": ["FeRCcD3TICWhVOEA88"], "resp_mime_types": ["text/html"], "_path": "http"}
|
|
{"ts": 1517336223.706379, "uid": "Csvkb240tPgpudGbvd", "id.orig_h": "10.55.100.110", "id.orig_p": 55285, "id.resp_h": "166.78.203.168", "id.resp_p": 80, "trans_depth": 1, "method": "GET", "host": "www.indeed.com", "uri": "/", "version": "1.1", "user_agent": "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko", "request_body_len": 0, "response_body_len": 0, "status_code": 307, "status_msg": "Temporary Redirect", "_path": "http"}
|
|
{"ts": 1517336223.74854, "uid": "C5kISW3XzUCPjRgD31", "id.orig_h": "10.55.100.107", "id.orig_p": 58465, "id.resp_h": "72.21.91.29", "id.resp_p": 80, "trans_depth": 1, "method": "GET", "host": "ocsp.digicert.com", "uri": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX+JrHYM=", "version": "1.1", "user_agent": "Microsoft-CryptoAPI/10.0", "request_body_len": 0, "response_body_len": 471, "status_code": 200, "status_msg": "OK", "resp_fuids": ["Fi2Ce32DTbOP7oyq6b"], "resp_mime_types": ["application/ocsp-response"], "_path": "http"}
|
|
{"ts": 1517336223.875768, "uid": "CUfZiQ2c73X6kBXPP8", "id.orig_h": "10.55.100.100", "id.orig_p": 50274, "id.resp_h": "52.25.7.108", "id.resp_p": 80, "trans_depth": 1, "method": "GET", "host": "www.espn.com", "uri": "/", "version": "1.1", "user_agent": "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko", "request_body_len": 0, "response_body_len": 317398, "status_code": 200, "status_msg": "OK", "resp_fuids": ["FKMs4V1KAuQcWka8A4"], "resp_mime_types": ["text/html"], "_path": "http"}
|
|
{"ts": 1517336224.10257, "uid": "CTzf6V3PLeI6B9Fjt9", "id.orig_h": "10.55.100.100", "id.orig_p": 50268, "id.resp_h": "23.52.161.186", "id.resp_p": 80, "trans_depth": 1, "method": "GET", "host": "cdn.optimizely.com", "uri": "/js/310987714.js", "referrer": "http://www.espn.com/", "version": "1.1", "user_agent": "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko", "request_body_len": 0, "response_body_len": 0, "status_code": 304, "status_msg": "Not Modified", "_path": "http"}
|