Victim IP	Max Score	Profiles	CCs	Events
192.168.1.100	0.8	VIEW 1	5.135.19.212 5.135.19.212 (-), -, -, -, Malware Controller.	1:9930020 {udp} Bot Space Access: ET ShadowServer confirmed botnet control server on non-standard port
192.168.1.41	1.6	VIEW 48		777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (6 /24s) (# pkts S/M/O/I=0/10/0/0): 22:10 1:2003068 {tcp} Outbound Attack: ET SCAN Potential SSH Scan OUTBOUND; 59847->22 1:2003068 {tcp} Outbound Attack: ET SCAN Potential SSH Scan OUTBOUND; 37559->22 1:2003068 {tcp} Outbound Attack: ET SCAN Potential SSH Scan OUTBOUND; 48060->22 1:2001219 {tcp} Outbound Attack: ET SCAN Potential SSH Scan (20 in 60 secs); 60096->22 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (10 /24s) (# pkts S/M/O/I=0/10/0/0): 22:10 1:2003068 {tcp} Outbound Attack: ET SCAN Potential SSH Scan OUTBOUND; 50101->22 1:2003068 {tcp} Outbound Attack: ET SCAN Potential SSH Scan OUTBOUND; 46016->22 1:2003068 {tcp} Outbound Attack: ET SCAN Potential SSH Scan OUTBOUND; 37870->22 1:2003068 {tcp} Outbound Attack: ET SCAN Potential SSH Scan OUTBOUND; 50336->22 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 45 IPs (28 /24s) (# pkts S/M/O/I=0/45/0/0): 22:45 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 20 IPs (17 /24s) (# pkts S/M/O/I=0/20/0/0): 22:20 1:2003068 {tcp} Outbound Attack: ET SCAN Potential SSH Scan OUTBOUND; 39279->22 777:7777005 {tcp} Outbound Scan: Detected moderate malware port scanning of 10 IPs (7 /24s) (# pkts S/M/O/I=0/10/0/0): 22:10 1:2003068 {tcp} Outbound Attack: ET SCAN Potential SSH Scan OUTBOUND; 55324->22 1:2003068 {tcp} Outbound Attack: ET SCAN Potential SSH Scan OUTBOUND; 55574->22 1:2003068 {tcp} Outbound Attack: ET SCAN Potential SSH Scan OUTBOUND; 40496->22 1:2003068 {tcp} Outbound Attack: ET SCAN Potential SSH Scan OUTBOUND; 56049->22 1:2003068 {tcp} Outbound Attack: ET SCAN Potential SSH Scan OUTBOUND; 40971->22 777:7777008 {tcp} Malware Scan: Detected intense malware port scanning of 46 IPs (29 /24s) (# pkts S/M/O/I=0/45/1/0): 22:45
192.168.1.14	1.0	VIEW 4	173.31.74.145 173.31.74.145 (Dsl), Mchsi.Com, Mediacom Communications Corp, Clearlake, California, United States. 158.255.213.231 158.255.213.231 (Dsl), Termbilling.Com, Various Registries, United Kingdom.	1:2002033 {tcp} C&C Communication: ET TROJAN BOT - potential response; 80->5485 1:552123 (4) {tcp} Outbound Attack: REGISTERED FREE ATTACK-RESPONSES Microsoft cmd.exe banner; 80->5485 1:2002033 (17) {tcp} C&C Communication: ET TROJAN BOT - potential response; 80->34014 1:552123 (19) {tcp} Outbound Attack: REGISTERED FREE ATTACK-RESPONSES Microsoft cmd.exe banner; 80->22677 1:2002033 {tcp} C&C Communication: ET TROJAN BOT - potential response; 80->44338 1:552123 (4) {tcp} Outbound Attack: REGISTERED FREE ATTACK-RESPONSES Microsoft cmd.exe banner; 80->42504 1:2002033 (9) {tcp} C&C Communication: ET TROJAN BOT - potential response; 80->44338 1:552123 (5) {tcp} Outbound Attack: REGISTERED FREE ATTACK-RESPONSES Microsoft cmd.exe banner; 80->42504