Hi
I was hoping someone
could kinda help me.. I have some reporting from our firewall that produces the
following output. I have to analyze this traffic but i have to confess that i
can not make out if this traffic is malicious or not or what it is except for
the obvious port 80 en port 443.
I hope someone could
give me some hints about the traffic
regards Peter
----------------------
From source address: [145.x.x.x] (339970 hits to 751 Destinations)
- Destination: [66.235.181.59] (10066 hits to 11 ports)
- 30816 (1020)
- 32800 (1020)
- 34840 (695)
- 36896 (647)
- 443 (1480)
- 46992 (1033)
- 47488 (702)
- 51040 (696)
- 51536 (1286)
- 80 (1480)
- Destination: [80.160.91.12] (4721 hits to 6 ports)
- 11656 (1708)
- 15768 (1345)
- 17824 (689)
- 443 (486)
- 80 (486)
- Destination: herning.hostero.pil.dk [195.41.47.100] (3936
hits to 6 ports)
- 23400 (689)
- 32488 (689)
- 443 (429)
- 58672 (1376)
- 80 (429)
- 9736 (324)
- Destination: host-103-142-230-24.midco.net [24.230.142.103]
(1937 hits to 3 ports)
- 443 (115)
- 54576 (1707)
- 80 (115)
- Destination: dhcp085150.res-hall.northwestern.edu
[199.74.85.150] (1805 hits to 3 ports)
- 36865 (1315)
- 443 (245)
- 80 (245)
- Destination: bzq-82-81-199-233.cablep.bezeqint.net
[82.81.199.233] (1753 hits to 3 ports)
- 27447 (1225)
- 443 (264)
- 80 (264)
- Destination: host243-217.eksjo.com [195.49.243.217] (1732
hits to 3 ports)
- 443 (181)
- 52238 (1370)
- 80 (181)
- Destination: syr-69-201-1-3.twcny.rr.com [69.201.1.3] (1727
hits to 3 ports)
- 17067 (1379)
- 443 (174)
- 80 (174)
- Destination: [202.199.162.97] (1712 hits to 3 ports)
- 443 (188)
- 49307 (1336)
- 80 (188)
- Destination: studentcnsat.ncl.ac.uk [128.240.4.237] (1712
hits to 3 ports)
- 39793 (1376)
- 443 (168)
- 80 (168)
- Destination: sm-pc314.sm.luth.se [130.240.3.87] (1705 hits to
3 ports)
- 443 (163)
- 51563 (1379)
- 80 (163)
- Destination: 68-185-51-218.wa.charter.com [68.185.51.218]
(1699 hits to 3 ports)
- 29253 (1356)
- 443 (172)
- 80 (171)
- Destination: henz214-dharnisch-dellpc2.unl.edu [129.93.84.97]
(1679 hits to 3 ports)
- 44286 (1373)
- 443 (153)
- 80 (153)
- Destination: ip68-13-164-36.om.om.cox.net [68.13.164.36]
(1677 hits to 3 ports)
- 13699 (1361)
- 443 (158)
- 80 (158)
- Destination: 3E6B1B51.rev.stofanet.dk [62.107.27.81] (1669
hits to 3 ports)
- 443 (155)
- 5472 (1359)
- 80 (155)
- Destination: YahooBB220006060057.bbtec.net [220.6.60.57]
(1659 hits to 3 ports)
- 443 (148)
- 44753 (1363)
- 80 (148)
- Destination:
c-495070d5.027-317-73746f7.cust.bredbandsbolaget.se [213.112.80.73] (1658 hits
to 3 ports)
- 33435 (1374)
- 443 (142)
- 80 (142)
- Destination: errorek.sh.cvut.cz [147.32.118.118] (1647 hits
to 3 ports)
- 13972 (1375)
- 443 (136)
- 80 (136)
- Destination: 82-35-52-107.cable.ubr03.camd.blueyonder.co.uk
[82.35.52.107] (1635 hits to 3 ports)
- 443 (257)
- 64553 (1121)
- 80 (257)
- Destination: c-24-125-75-142.va.client2.attbi.com
[24.125.75.142] (1617 hits to 3 ports)
- 443 (127)
- 52838 (1363)
- 80 (127)
- Destination: YahooBB220026145016.bbtec.net [220.26.145.16]
(1616 hits to 3 ports)
- 15850 (1300)
- 443 (158)
- 80 (158)
- Destination: ip-56.59.home-lan.fastnet.lv [80.81.59.56] (1584
hits to 3 ports)
- 31202 (1242)
- 443 (171)
- 80 (171)
- Destination: 24-205-105-48.rno-cres.charterpipeline.net
[24.205.105.48] (1562 hits to 3 ports)
- 443 (271)
- 55645 (1020)
- 80 (271)
- Destination: rs-64-246-49-61.ev1.net [64.246.49.61] (1535
hits to 3 ports)
- 443 (261)
- 7856 (1013)
- 80 (261)
- Destination: modemcable128.159-203-24.mc.videotron.ca
[24.203.159.128] (1528 hits to 3 ports)
- 443 (76)
- 59950 (1376)
- 80 (76)
- Destination: [212.179.162.1722] (1525 hits to 3 ports)
- 34489 (1027)
- 443 (249)
- 80 (249)
From source address: [145.x.x.x] (236377 hits to 324
Destinations)
- Destination: rs-64-246-49-61.ev1.net [64.246.49.61] (5936
hits to 7 ports)
- 11912 (788)
- 17944 (788)
- 20480 (788)
- 3760 (788)
- 443 (998)
- 7856 (788)
- 80 (998)
- Destination: [66.235.181.59] (5858 hits to 7 ports)
- 15432 (788)
- 20480 (789)
- 34840 (788)
- 36896 (789)
- 443 (958)
- 44968 (788)
- 80 (958)
- Destination: herning.hostero.pil.dk [195.41.47.100] (4664
hits to 6 ports)
- 15776 (788)
- 443 (756)
- 63680 (788)
- 7784 (788)
- 80 (756)
- 9736 (788)
- Destination: pk47st119.uio.no [129.240.47.119] (1246 hits to
3 ports)
- 3367 (788)
- 443 (229)
- 80 (229)
- Destination: [220.234.32.84] (1234 hits to 3 ports)
- 3661 (788)
- 443 (223)
- 80 (223)
- Destination: c213-100-56-238.swipnet.se [213.100.56.238]
(1230 hits to 3 ports)
- 443 (221)
- 46934 (788)
- 80 (221)
- Destination: rliex01.studbost.vxu.se [194.47.126.123] (1228
hits to 3 ports)
- 443 (220)
- 44378 (788)
- 80 (220)
- Destination: i222-150-141-238.s05.a008.ap.plala.or.jp
[222.150.141.238] (1226 hits to 3 ports)
- 443 (219)
- 44764 (788)
- 80 (219)
- Destination: catv-d5de8038.catv.broadband.hu [213.222.128.56]
(1224 hits to 3 ports)
- 443 (218)
- 80 (218)
- 8014 (788)
- Destination: [200.222.81.173] (1221 hits to 3 ports)
- 443 (216)
- 45805 (789)
- 80 (216)
- Destination: cablep-179-105-241.cablep.bezeqint.net
[212.179.105.241] (1220 hits to 3 ports)
- 443 (216)
- 61365 (788)
- 80 (216)
- Destination: sr-145.srtb05.resnet.ubc.ca [128.189.142.145]
(1220 hits to 3 ports)
- 443 (216)
- 55964 (788)
- 80 (216)
- Destination: [163.23.218.93] (1220 hits to 3 ports)
- 14457 (788)
- 443 (216)
- 80 (216)
- Destination:
c-208672d5.02-66-73746f42.cust.bredbandsbolaget.se [213.114.134.32] (1219 hits
to 3 ports)
- 443 (215)
- 54259 (789)
- 80 (215)
- Destination: rdu162-239-101.nc.rr.com [24.162.239.101] (1219
hits to 3 ports)
- 443 (215)
- 80 (215)
- 9014 (789)
- Destination: [83.209.5.16] (1217 hits to 3 ports)
- 14657 (789)
- 443 (214)
- 80 (214)
- Destination: [210.107.135.91] (1217 hits to 3 ports)
- 443 (214)
- 48383 (789)
- 80 (214)
- Destination: drzhangpc.cs.wright.edu [130.108.13.154] (1216
hits to 3 ports)
- 24071 (788)
- 443 (214)
- 80 (214)
- Destination: d5153A343.kabel.telenet.be [81.83.163.67] (1215
hits to 3 ports)
- 36119 (789)
- 443 (213)
- 80 (213)
- Destination: gislab4.csie.thu.edu.tw [140.128.101.74] (1214
hits to 3 ports)
- 443 (213)
- 57818 (788)
- 80 (213)
- Destination: cs2426239-108.satx.rr.com [24.26.239.108] (1212
hits to 3 ports)
- 36519 (788)
- 443 (212)
- 80 (212)
- Destination: bzq-218-158-130.cablep.bezeqint.net
[81.218.158.130] (1210 hits to 3 ports)
- 443 (211)
- 80 (211)
- 8303 (788)
- Destination: orff.wiwi.uni-rostock.de [139.30.131.69] (1210
hits to 3 ports)
- 443 (211)
- 58252 (788)
- 80 (211)
- Destination: c906156e.virtua.com.br [201.6.21.110] (1210 hits
to 3 ports)
- 443 (211)
- 6557 (788)
- 80 (211)
- Destination: pc-202-169-152-251.cable.kumin.ne.jp
[202.169.152.251] (1210 hits to 3 ports)
- 443 (211)
- 64700 (788)
- 80 (211)
- Destination: CPE-65-30-247-82.mn.rr.com [65.30.247.82] (1209
hits to 3 ports)
- 10791 (789)
- 443 (210)
- 80 (210)
