Victim IP	Max Score	Profiles	CCs	Events
192.168.1.85	1.0	VIEW 10	157.55.32.152 157.55.32.152 (Dsl), Msn.Net, Microsoft Corp, Redmond, Washington, United States. 157.55.33.77 157.55.33.77 (Dsl), Msn.Net, Microsoft Corp, New York, United States. 157.55.35.105 157.55.35.105 (Dsl), Msn.Net, Microsoft Corp, Redmond, Washington, United States. 157.55.32.106 157.55.32.106 (Dsl), Msn.Net, Microsoft Corp, Redmond, Washington, United States. 157.55.32.77 157.55.32.77 (Dsl), Msn.Net, Microsoft Corp, Redmond, Washington, United States. 157.55.35.44 157.55.35.44 (Dsl), Msn.Net, Microsoft Corp, Redmond, Washington, United States.	1:2002033 {tcp} C&C Communication: ET TROJAN BOT - potential response; 80->37054 1:552123 (10) {tcp} Outbound Attack: REGISTERED FREE ATTACK-RESPONSES Microsoft cmd.exe banner; 80->28416 1:552123 (3) {tcp} Outbound Attack: REGISTERED FREE ATTACK-RESPONSES Microsoft cmd.exe banner; 80->37950 1:552123 (4) {tcp} Outbound Attack: REGISTERED FREE ATTACK-RESPONSES Microsoft cmd.exe banner; 80->49624 1:2002033 (8) {tcp} C&C Communication: ET TROJAN BOT - potential response; 80->37054 1:2002033 {tcp} C&C Communication: ET TROJAN BOT - potential response; 80->54262 1:552123 (14) {tcp} Outbound Attack: REGISTERED FREE ATTACK-RESPONSES Microsoft cmd.exe banner; 80->22654 1:552123 (3) {tcp} Outbound Attack: REGISTERED FREE ATTACK-RESPONSES Microsoft cmd.exe banner; 80->62735 1:2002033 (2) {tcp} C&C Communication: ET TROJAN BOT - potential response; 80->54262 1:2002033 (2) {tcp} C&C Communication: ET TROJAN BOT - potential response; 80->24417 1:2002033 {tcp} C&C Communication: ET TROJAN BOT - potential response; 80->62114 1:2002033 (2) {tcp} C&C Communication: ET TROJAN BOT - potential response; 80->26116 1:2002033 {tcp} C&C Communication: ET TROJAN BOT - potential response; 80->14086 1:2002033 (2) {tcp} C&C Communication: ET TROJAN BOT - potential response; 80->14086 1:2002033 {tcp} C&C Communication: ET TROJAN BOT - potential response; 80->47980 1:2002033 {tcp} C&C Communication: ET TROJAN BOT - potential response; 80->42053
192.168.1.76	0.8	VIEW 2	142.4.35.36 142.4.35.36 (Dsl), -, Department Of Health (Canada), Ottawa, Ontario, Canada.	1:22009201 {tcp} Inbound Attack: ET TROJAN Conficker.b Shellcode MAC_Dst: 00:30:48:30:03:AE; 445<-1983 1:2009114 {tcp} C&C Communication: ET TROJAN Downadup/Conficker A Worm reporting, [/search?q=0&aq=7]; 2102->80 1:2009024 {tcp} C&C Communication: ET TROJAN Downadup/Conficker A or B Worm reporting; 2102->80 1:2009114 {tcp} C&C Communication: ET TROJAN Downadup/Conficker A Worm reporting, [/search?q=0&aq=7]; 2102->80
192.168.1.127	1.3	VIEW 2	149.20.56.32 149.20.56.32 (Dsl), Tech.Org, Internet Systems Consortium Inc, Redwood City, California, United States, Malware Controller.	1:22009201 {tcp} Inbound Attack: ET TROJAN Conficker.b Shellcode MAC_Dst: 00:30:48:30:03:AE; 445<-1328 1:2009114 {tcp} C&C Communication: ET TROJAN Downadup/Conficker A Worm reporting, [/search?q=0&aq=7]; 1026->80 1:3300003 {tcp} Egg Download: BotHunter HTTP-based .exe Upload on backdoor port; 1031->80 1:2009024 (8) {tcp} C&C Communication: ET TROJAN Downadup/Conficker A or B Worm reporting; 1026->80 1:2009114 (9) {tcp} C&C Communication: ET TROJAN Downadup/Conficker A Worm reporting, [/search?q=0&aq=7]; 1026->80
192.168.1.100	0.9	VIEW 2	8.5.1.45 8.5.1.45 (Dsl), Name-Services.Com, Enom Incorporated, Bellevue, Washington, United States, Malware Controller. 218.30.115.254 218.30.115.254 (Dsl), Hichina.Com, Chinanet Idc Center, Beijing, China, Malware Controller.	1:9930009 {tcp} Bot Space Access: ET ShadowServer confirmed botnet control server on non-standard port 1:3810007 {tcp} Russian Business Network: ET Known Russian Business Network Monitored Domain; 37301->80
192.168.1.102	0.8	VIEW 1	8.5.1.45 8.5.1.45 (Dsl), Name-Services.Com, Enom Incorporated, Bellevue, Washington, United States, Malware Controller.	1:9930020 {udp} Bot Space Access: ET ShadowServer confirmed botnet control server on non-standard port
192.168.1.46	1.6	VIEW 28		777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (6 /24s) (# pkts S/M/O/I=0/10/0/0): 22:10 1:2003068 {tcp} Outbound Attack: ET SCAN Potential SSH Scan OUTBOUND; 44427->22 1:2001219 {tcp} Outbound Attack: ET SCAN Potential SSH Scan (20 in 60 secs); 46666->22 1:2003068 {tcp} Outbound Attack: ET SCAN Potential SSH Scan OUTBOUND; 46666->22 1:2003068 {tcp} Outbound Attack: ET SCAN Potential SSH Scan OUTBOUND; 45866->22 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 39 IPs (24 /24s) (# pkts S/M/O/I=0/39/0/0): 22:39 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 22:10 1:2003068 {tcp} Outbound Attack: ET SCAN Potential SSH Scan OUTBOUND; 56062->22 1:2003068 {tcp} Outbound Attack: ET SCAN Potential SSH Scan OUTBOUND; 56306->22 1:2003068 {tcp} Outbound Attack: ET SCAN Potential SSH Scan OUTBOUND; 56040->22 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 40 IPs (25 /24s) (# pkts S/M/O/I=0/40/0/0): 22:40 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (7 /24s) (# pkts S/M/O/I=0/10/0/0): 22:10 1:2003068 {tcp} Outbound Attack: ET SCAN Potential SSH Scan OUTBOUND; 57054->22 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (9 /24s) (# pkts S/M/O/I=0/10/0/0): 22:10 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 40 IPs (25 /24s) (# pkts S/M/O/I=0/39/1/0): 22:39
192.168.1.36	0.8	VIEW 12	69.43.161.167 69.43.161.167 (Dsl), 22a52.Com, Castle Access Inc, Coronado, California, United States, Mail Abuser Malware Controller.	1:9930009 {tcp} Bot Space Access: ET ShadowServer confirmed botnet control server on non-standard port 1:9930020 {udp} Bot Space Access: ET ShadowServer confirmed botnet control server on non-standard port