Overview

URLhttp://p.rfihub.com/cm?id=CAESEDGTurRzxSMEI0CaiB-dObQ&cver=1&forward=http%3A%2F%2Fib.adnxs.com%2Fgetuidu%3Fhttp%3A%2F%2Fp.rfihub.com%2Fcm%3Fapxuid%3D%24UID%26forward%3Dhttp%253A%252F%252Fr.openx.net%252Fset%253Fpid%253D2076250f-92c2-4ecd-9043-cc63ee6c4577%2526rtb%253D667940120659467146
IP193.0.160.244
ASNAS54312 Rocket Fuel Inc.
Location Netherlands
Report completed2012-11-08 16:32:45 CET
StatusLoading report..
urlQuery Alerts No alerts detected


Settings

UserAgentMozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Referer
Adobe Reader8.0
Java1.6.0_26


Intrusion Detection Systems

Suricata /w Emerging Threats Pro No alerts detected
Snort /w Sourcefire VRT
Timestamp Source IP Destination IP Severity Alert
2012-11-08 16:32:07 urlQuery Client 193.0.160.2441MALWARE-CNC Win32.Delf outbound connection
2012-11-08 16:32:07 urlQuery Client 68.67.185.2171MALWARE-CNC Win32.Delf outbound connection
2012-11-08 16:32:07 urlQuery Client 68.67.185.2171MALWARE-CNC Win32.Delf outbound connection
2012-11-08 16:32:07 urlQuery Client 193.0.160.2441MALWARE-CNC Win32.Delf outbound connection
2012-11-08 16:32:07 urlQuery Client 173.241.240.71MALWARE-CNC Win32.Delf outbound connection
2012-11-08 16:32:07 urlQuery Client 173.241.240.71MALWARE-CNC Win32.Delf outbound connection


Recent reports on same IP/ASN/Domain

Last 6 reports on IP: 193.0.160.244

Date Alerts / IDS URL IP
2013-02-07 21:53:120 / 0http://20500973p.rfihub.com/193.0.160.244
2013-02-07 15:47:550 / 0http://20497799p.rfihub.com/ca.gif?rb=2611&ca=20497799&ra=REPLACE_ME_WITH_YOU (...)193.0.160.244
2013-02-04 21:54:350 / 0http://20498157p.rfihub.com193.0.160.244
2013-02-02 05:57:210 / 0http://p.rfihub.com/ca.html?ra=7500228250.48426185199059546&rb=1147&ca=204760 (...)193.0.160.244
2013-01-30 17:35:470 / 0http://20500973p.rfihub.com/193.0.160.244
2013-01-17 16:31:120 / 0http://a.rfihub.com193.0.160.244

Last 6 reports on ASN: AS54312 Rocket Fuel Inc.

Date Alerts / IDS URL IP
2013-02-07 21:53:120 / 0http://20500973p.rfihub.com/193.0.160.244
2013-02-07 15:47:550 / 0http://20497799p.rfihub.com/ca.gif?rb=2611&ca=20497799&ra=REPLACE_ME_WITH_YOUR_CACHE_BU (...)193.0.160.244
2013-02-04 21:54:350 / 0http://20498157p.rfihub.com193.0.160.244
2013-02-02 05:57:210 / 0http://p.rfihub.com/ca.html?ra=7500228250.48426185199059546&rb=1147&ca=20476075&rc= (...)193.0.160.244
2013-01-30 17:35:470 / 0http://20500973p.rfihub.com/193.0.160.244
2013-01-25 02:32:130 / 0http://205.210.187.119205.210.187.119

Last 2 reports on domain: p.rfihub.com

Date Alerts / IDS URL IP
2013-02-02 05:57:210 / 0http://p.rfihub.com/ca.html?ra=7500228250.48426185199059546&rb=1147&ca=20476075&rc= (...)193.0.160.244
2012-12-12 10:53:330 / 0http://p.rfihub.com193.0.160.244



JavaScript

Executed Scripts (0)


Executed Evals (0)


Executed Writes (0)



HTTP Transactions (6)


Request Response 
GET /cm?id=CAESEDGTurRzxSMEI0CaiB-dObQ&cver=1&forward=http%3A%2F%2Fib.adnxs.com%2Fgetuidu%3Fhttp%3A%2F%2Fp.rfihub.com%2Fcm%3Fapxuid%3D%24UID%26forward%3Dhttp%253A%252F%252Fr.openx.net%252Fset%253Fpid%253D2076250f-92c2-4ecd-9043-cc63ee6c4577%2526rtb%253D667940120659467146 HTTP/1.1

Host: p.rfihub.com
GET /cm?id=CAESEDGTurRzxSMEI0CaiB-dObQ&cver=1&forward=http%3A%2F%2Fib.adnxs.com%2Fgetuidu%3Fhttp%3A%2F%2Fp.rfihub.com%2Fcm%3Fapxuid%3D%24UID%26forward%3Dhttp%253A%252F%252Fr.openx.net%252Fset%253Fpid%253D2076250f-92c2-4ecd-9043-cc63ee6c4577%2526rtb%253D667940120659467146 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 
HTTP/1.1 302 Found

HTTP/1.1 302 Found

P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: a1=1CAESEDGTurRzxSMEI0CaiB-dObQ;Path=/;Domain=.rfihub.com;Expires=Mon, 27-Apr-15 15:32:07 GMT
j1=1CAESEDGTurRzxSMEI0CaiB-dObQ;Path=/;Domain=.rfihub.com
t=1352388727144;Path=/;Domain=.rfihub.com;Expires=Mon, 27-Apr-15 15:32:07 GMT
s1=1352388727144;Path=/;Domain=.rfihub.com;Expires=Mon, 27-Apr-15 15:32:07 GMT
u="aABG9o-eg==AI3oyfww==AAABOuCmUWg=";Path=/;Domain=.rfihub.com;Expires=Mon, 27-Apr-15 15:32:07 GMT
e=cr;Path=/;Domain=.rfihub.com;Expires=Mon, 27-Apr-15 15:32:07 GMT
a=c637540823982352662;Path=/;Domain=.rfihub.com;Expires=Mon, 27-Apr-15 15:32:07 GMT
j=c637540823982352662;Path=/;Domain=.rfihub.com
r=1352388727144;Path=/;Domain=.rfihub.com;Expires=Mon, 27-Apr-15 15:32:07 GMT
o=1-gs-bFL4U3nNf;Path=/;Domain=.rfihub.com;Expires=Mon, 27-Apr-15 15:32:07 GMT
p=1-gs-bFL4U3nNf;Path=/;Domain=.rfihub.com
Location: http://ib.adnxs.com/pxj?bidder=18&seg=378601&action=setuids('637540823982352662','1CAESEDGTurRzxSMEI0CaiB-dObQ');&redir=http%3A%2F%2Fib.adnxs.com%2Fgetuidu%3Fhttp%3A%2F%2Fp.rfihub.com%2Fcm%3Fapxuid%3D%24UID%26forward%3Dhttp%253A%252F%252Fr.openx.net%252Fset%253Fpid%253D2076250f-92c2-4ecd-9043-cc63ee6c4577%2526rtb%253D667940120659467146
Content-Length: 0
GET /pxj?bidder=18&seg=378601&action=setuids(%27637540823982352662%27,%271CAESEDGTurRzxSMEI0CaiB-dObQ%27);&redir=http%3A%2F%2Fib.adnxs.com%2Fgetuidu%3Fhttp%3A%2F%2Fp.rfihub.com%2Fcm%3Fapxuid%3D%24UID%26forward%3Dhttp%253A%252F%252Fr.openx.net%252Fset%253Fpid%253D2076250f-92c2-4ecd-9043-cc63ee6c4577%2526rtb%253D667940120659467146 HTTP/1.1

Host: ib.adnxs.com
GET /pxj?bidder=18&seg=378601&action=setuids(%27637540823982352662%27,%271CAESEDGTurRzxSMEI0CaiB-dObQ%27);&redir=http%3A%2F%2Fib.adnxs.com%2Fgetuidu%3Fhttp%3A%2F%2Fp.rfihub.com%2Fcm%3Fapxuid%3D%24UID%26forward%3Dhttp%253A%252F%252Fr.openx.net%252Fset%253Fpid%253D2076250f-92c2-4ecd-9043-cc63ee6c4577%2526rtb%253D667940120659467146 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Cookie: uuid2=5858721859426781856; anj=Kfu=8fG7]PCxrx)0s]#%2L_'x%SEV/hnJip8Ep.I(G*axlrk5.$WN_]Dl5M7G(nDS'6pnU
 
HTTP/1.1 302 Found

Content-Type: text/html; charset=ISO-8859-1

Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=5858721859426781856; path=/; expires=Wed, 06-Feb-2013 15:32:07 GMT; domain=.adnxs.com; HttpOnly
sess=1; path=/; expires=Fri, 09-Nov-2012 15:32:07 GMT; domain=.adnxs.com; HttpOnly
anj=Kfu=8fG7]PCxrx)0s]#%2L_'x%SEV/hnJipUm`lD$aWqNdWkg'DvENc*]HjiAu1v=!.<<.BUAf*; path=/; expires=Wed, 06-Feb-2013 15:32:07 GMT; domain=.adnxs.com; HttpOnly
Location: http://ib.adnxs.com/getuidu?http://p.rfihub.com/cm?apxuid=$UID&forward=http%3A%2F%2Fr.openx.net%2Fset%3Fpid%3D2076250f-92c2-4ecd-9043-cc63ee6c4577%26rtb%3D667940120659467146
Date: Thu, 08 Nov 2012 15:32:07 GMT
Content-Length: 0
GET /getuidu?http://p.rfihub.com/cm?apxuid=$UID&forward=http%3A%2F%2Fr.openx.net%2Fset%3Fpid%3D2076250f-92c2-4ecd-9043-cc63ee6c4577%26rtb%3D667940120659467146 HTTP/1.1

Host: ib.adnxs.com
GET /getuidu?http://p.rfihub.com/cm?apxuid=$UID&forward=http%3A%2F%2Fr.openx.net%2Fset%3Fpid%3D2076250f-92c2-4ecd-9043-cc63ee6c4577%26rtb%3D667940120659467146 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Cookie: uuid2=5858721859426781856; anj=Kfu=8fG7]PCxrx)0s]#%2L_'x%SEV/hnJipUm`lD$aWqNdWkg'DvENc*]HjiAu1v=!.<<.BUAf*; sess=1
 
HTTP/1.1 302 Moved

Content-Type: text/html; charset=ISO-8859-1

Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=5858721859426781856; path=/; expires=Wed, 06-Feb-2013 15:32:07 GMT; domain=.adnxs.com; HttpOnly
sess=1; path=/; expires=Fri, 09-Nov-2012 15:32:07 GMT; domain=.adnxs.com; HttpOnly
Location: http://p.rfihub.com/cm?apxuid=5858721859426781856&forward=http%3A%2F%2Fr.openx.net%2Fset%3Fpid%3D2076250f-92c2-4ecd-9043-cc63ee6c4577%26rtb%3D667940120659467146
Date: Thu, 08 Nov 2012 15:32:07 GMT
Content-Length: 0
GET /cm?apxuid=5858721859426781856&forward=http%3A%2F%2Fr.openx.net%2Fset%3Fpid%3D2076250f-92c2-4ecd-9043-cc63ee6c4577%26rtb%3D667940120659467146 HTTP/1.1

Host: p.rfihub.com
GET /cm?apxuid=5858721859426781856&forward=http%3A%2F%2Fr.openx.net%2Fset%3Fpid%3D2076250f-92c2-4ecd-9043-cc63ee6c4577%26rtb%3D667940120659467146 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Cookie: a1=1CAESEDGTurRzxSMEI0CaiB-dObQ; j1=1CAESEDGTurRzxSMEI0CaiB-dObQ; t=1352388727144; s1=1352388727144; u="aABG9o-eg==AI3oyfww==AAABOuCmUWg="; e=cr; a=c637540823982352662; j=c637540823982352662; r=1352388727144; o=1-gs-bFL4U3nNf; p=1-gs-bFL4U3nNf
 
HTTP/1.1 302 Found

HTTP/1.1 302 Found

P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: v=1352388727271;Path=/;Domain=.rfihub.com;Expires=Mon, 27-Apr-15 15:32:07 GMT
a2=5858721859426781856;Path=/;Domain=.rfihub.com;Expires=Mon, 27-Apr-15 15:32:07 GMT
j2=5858721859426781856;Path=/;Domain=.rfihub.com
t1=1352388727270;Path=/;Domain=.rfihub.com;Expires=Mon, 27-Apr-15 15:32:07 GMT
u="aABG9pyjA==AI3oyfww==AAABOuCmUec=";Path=/;Domain=.rfihub.com;Expires=Mon, 27-Apr-15 15:32:07 GMT
e=cr;Path=/;Domain=.rfihub.com;Expires=Mon, 27-Apr-15 15:32:07 GMT
a=c637540823982352662;Path=/;Domain=.rfihub.com;Expires=Mon, 27-Apr-15 15:32:07 GMT
j=c637540823982352662;Path=/;Domain=.rfihub.com
r=1352388727144;Path=/;Domain=.rfihub.com;Expires=Mon, 27-Apr-15 15:32:07 GMT
o=1-gs-bFL4U3nNf;Path=/;Domain=.rfihub.com;Expires=Mon, 27-Apr-15 15:32:07 GMT
p=1-gs-bFL4U3nNf;Path=/;Domain=.rfihub.com
Location: http://r.openx.net/set?pid=2076250f-92c2-4ecd-9043-cc63ee6c4577&rtb=667940120659467146
Content-Length: 0
GET /set?pid=2076250f-92c2-4ecd-9043-cc63ee6c4577&rtb=667940120659467146 HTTP/1.1

Host: r.openx.net
GET /set?pid=2076250f-92c2-4ecd-9043-cc63ee6c4577&rtb=667940120659467146 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
 
HTTP/1.1 302 Found

Content-Type: text/html; charset=UTF-8

Date: Thu, 08 Nov 2012 15:32:07 GMT
Server: Apache
Cache-Control: no-cache, must-revalidate
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Pragma: no-cache
P3P: CP="CUR ADM OUR NOR STA NID"
Set-Cookie: i=191ae689-5070-4e0b-80c6-463e53d5711b; expires=Sat, 08-Nov-2014 15:32:07 GMT; path=/; domain=.openx.net
Location: /set?pid=2076250f-92c2-4ecd-9043-cc63ee6c4577&rtb=667940120659467146&cc=1
Content-Length: 0
Connection: close
GET /set?pid=2076250f-92c2-4ecd-9043-cc63ee6c4577&rtb=667940120659467146&cc=1 HTTP/1.1

Host: r.openx.net
GET /set?pid=2076250f-92c2-4ecd-9043-cc63ee6c4577&rtb=667940120659467146&cc=1 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Cookie: i=191ae689-5070-4e0b-80c6-463e53d5711b
 
HTTP/1.1 200 OK

Content-Type: image/gif

Date: Thu, 08 Nov 2012 15:32:07 GMT
Server: Apache
Cache-Control: public, max-age=30, proxy-revalidate
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Pragma: no-cache
P3P: CP="CUR ADM OUR NOR STA NID"
Set-Cookie: i=191ae689-5070-4e0b-80c6-463e53d5711b; expires=Sat, 08-Nov-2014 15:32:07 GMT; path=/; domain=.openx.net
Content-Length: 43
Connection: close