evcz.tk

whmcs {php}base64decode tickets

EvolutionCrazy — Sat, 26 Jan 2013 12:15:35 +0000

create a .php file with this content:

 
$checkvars = array('subject','message'); 
foreach ($checkvars AS $checkvar){
	if(strpos($_REQUEST[$checkvar],'{php}') !== false){
		header('Location: http://www.interpol.int/');
		die('now'); 
		exit;
	}
}
?>

and place it into whmcs /includes/hooks/ directory

Processing mysql dumps in hurry (convert single insert to extended insert)

EvolutionCrazy — Sat, 05 Jan 2013 17:18:00 +0000

Most time there’s little time, sometime there’s NO TIME!

A few days ago I had no time, and had to manipulate a badly exported database (2million+ single myisam insert statements) tuning mysqld was useless, insert delayed useless, increasing buffers useless… and so on… import was taking hours (many hours) on the target box due to impressively high disk io!

So I just fired up a vmware instance with 32gb of ram, 10gb hdd and 8cpu cores (of a xeon L56xx) and did everything in ram.
What was going to take hours on the target box took just 2minutes on the vmware instance…
Then I did a proper “mysqldump –opt” and imported it back into the target box in just 20seconds

yum upgrade -y
wget -q -O - http://www.atomicorp.com/installers/atomic | sh
mkdir -p /var/lib/mysql && mount -v -t tmpfs -o size=24G none /var/lib/mysql
yum install mysql mysql-server -y
nano -w /etc/my.cnf

tune it up a little, in my case

thread_concurrency=16

was enough

service mysqld restart
mysql_secure_installation

and you are good to go!

import the bad export and after that export it making use of all the proper settings (extended queries, locking and so on) … –opt handles all of them by default

So yes… sometime I make use of “the cloud” too :O

PS: I do the same (storage on ramdisk) when I’ve to compile a linux kernel.

wget ftp download specific directory content – no recursion

EvolutionCrazy — Fri, 04 Jan 2013 15:02:25 +0000

This one command allows you to download the content of a directory to a local directory without doing recuirsive searches

wget -np -N --cut-dirs=1 -A .dem ftp://user:password@host.tld/tf2/orangebox/tf/*

specifically this one downloads all the “.dem” (-A .dem) (team fortress demo files) located into the remote “/tf2/orangebox/tf/” directory.
Files are saved into the current directory (–cut-dirs=1)

Additionally it makes use of timestamping (-N) in order to not download already existing files when doing a subsequent run.

Romania – DDoS botnets trash can

EvolutionCrazy — Fri, 07 Dec 2012 13:16:12 +0000

As I’m tired of contacting useless abuse desks (rackspace is a perfect example of what I consider a useless abuse desk, If you ever got in touch with them I’m sure you know what I mean) I’ll start collecting here offending IPs.

Latest attack went beyond what’s “reasonable” as it exceeded by large the 1 million packet per second rate threshold.

So here comes the first batch of *possibly infected* hosts…
I’m sure this list will be useful for both building a banlist or to expand your botnet with vulnerable hosts…

52 hosts accomplished a short 1M+ pps attack: 226 milions total ddos packets processed (dropped) by the firewall totalling 6.5 gigabyte of traffic

Times in the reported firewall log lines are CET

Dec  6 23:24:47 SRC=81.177.157.86 LEN=29 TOS=0x10 PREC=0x00 TTL=57 ID=2857 PROTO=UDP SPT=54267 DPT=10363 LEN=9
Dec  6 23:24:47 SRC=222.35.137.36 LEN=29 TOS=0x10 PREC=0x00 TTL=50 ID=0 DF PROTO=UDP SPT=54688 DPT=49170 LEN=9
Dec  6 23:24:47 SRC=118.175.28.88 LEN=29 TOS=0x10 PREC=0x00 TTL=49 ID=0 DF PROTO=UDP SPT=45343 DPT=45618 LEN=9
Dec  6 23:24:47 SRC=145.108.240.173 LEN=29 TOS=0x10 PREC=0x00 TTL=55 ID=20834 PROTO=UDP SPT=64284 DPT=45097 LEN=9
Dec  6 23:24:47 SRC=156.54.108.45 LEN=29 TOS=0x10 PREC=0x00 TTL=50 ID=0 DF PROTO=UDP SPT=43199 DPT=47447 LEN=9
Dec  6 23:24:47 SRC=184.107.212.130 LEN=29 TOS=0x10 PREC=0x00 TTL=48 ID=0 DF PROTO=UDP SPT=35464 DPT=41601 LEN=9
Dec  6 23:24:47 SRC=58.17.30.43 LEN=29 TOS=0x10 PREC=0x00 TTL=45 ID=0 DF PROTO=UDP SPT=41127 DPT=532 LEN=9
Dec  6 23:24:47 SRC=184.107.176.2 LEN=29 TOS=0x10 PREC=0x00 TTL=48 ID=0 DF PROTO=UDP SPT=35397 DPT=6135 LEN=9
Dec  6 23:24:47 SRC=173.204.47.90 LEN=29 TOS=0x10 PREC=0x00 TTL=56 ID=0 DF PROTO=UDP SPT=57234 DPT=15824 LEN=9
Dec  6 23:24:47 SRC=74.86.116.114 LEN=29 TOS=0x10 PREC=0x00 TTL=46 ID=0 DF PROTO=UDP SPT=54792 DPT=30393 LEN=9
Dec  6 23:24:47 SRC=195.138.198.208 LEN=29 TOS=0x10 PREC=0x00 TTL=52 ID=18935 PROTO=UDP SPT=58848 DPT=6021 LEN=9
Dec  6 23:24:47 SRC=194.149.154.11 LEN=29 TOS=0x10 PREC=0x00 TTL=49 ID=0 DF PROTO=UDP SPT=51991 DPT=60182 LEN=9
Dec  6 23:24:47 SRC=61.175.253.59 LEN=29 TOS=0x10 PREC=0x00 TTL=52 ID=0 DF PROTO=UDP SPT=32848 DPT=14437 LEN=9
Dec  6 23:24:47 SRC=82.135.194.224 LEN=29 TOS=0x10 PREC=0x00 TTL=57 ID=0 DF PROTO=UDP SPT=50077 DPT=15957 LEN=9
Dec  6 23:24:47 SRC=217.12.215.215 LEN=29 TOS=0x10 PREC=0x00 TTL=55 ID=47885 PROTO=UDP SPT=6602 DPT=21368 LEN=9
Dec  6 23:24:47 SRC=218.29.222.4 LEN=29 TOS=0x10 PREC=0x00 TTL=49 ID=0 DF PROTO=UDP SPT=41149 DPT=36208 LEN=9
Dec  6 23:24:47 SRC=139.82.24.179 LEN=29 TOS=0x10 PREC=0x00 TTL=54 ID=0 DF PROTO=UDP SPT=49876 DPT=40883 LEN=9
Dec  6 23:24:47 SRC=184.82.245.44 LEN=29 TOS=0x10 PREC=0x00 TTL=51 ID=0 DF PROTO=UDP SPT=50100 DPT=57737 LEN=9
Dec  6 23:24:47 SRC=66.132.47.3 LEN=29 TOS=0x10 PREC=0x00 TTL=54 ID=0 DF PROTO=UDP SPT=44871 DPT=1331 LEN=9
Dec  6 23:24:47 SRC=107.21.202.117 LEN=29 TOS=0x10 PREC=0x00 TTL=48 ID=0 DF PROTO=UDP SPT=56779 DPT=16772 LEN=9
Dec  6 23:24:47 SRC=93.88.6.162 LEN=29 TOS=0x10 PREC=0x00 TTL=51 ID=0 DF PROTO=UDP SPT=39608 DPT=39890 LEN=9
Dec  6 23:24:47 SRC=203.158.223.152 LEN=29 TOS=0x10 PREC=0x00 TTL=49 ID=0 DF PROTO=UDP SPT=60325 DPT=8548 LEN=9
Dec  6 23:24:47 SRC=198.101.252.228 LEN=29 TOS=0x10 PREC=0x00 TTL=51 ID=0 DF PROTO=UDP SPT=39016 DPT=1764 LEN=9
Dec  6 23:24:47 SRC=194.44.123.92 LEN=29 TOS=0x10 PREC=0x00 TTL=58 ID=51376 PROTO=UDP SPT=50396 DPT=49700 LEN=9
Dec  6 23:24:47 SRC=114.34.31.140 LEN=29 TOS=0x10 PREC=0x00 TTL=50 ID=0 DF PROTO=UDP SPT=41229 DPT=7545 LEN=9
Dec  6 23:24:47 SRC=131.247.120.135 LEN=29 TOS=0x10 PREC=0x00 TTL=51 ID=39882 PROTO=UDP SPT=59865 DPT=39148 LEN=9
Dec  6 23:24:47 SRC=82.144.222.66 LEN=29 TOS=0x10 PREC=0x00 TTL=50 ID=55678 PROTO=UDP SPT=63341 DPT=18336 LEN=9
Dec  6 23:24:47 SRC=89.237.37.254 LEN=29 TOS=0x10 PREC=0x00 TTL=54 ID=44145 PROTO=UDP SPT=55354 DPT=14988 LEN=9
Dec  6 23:24:47 SRC=80.188.127.134 LEN=29 TOS=0x10 PREC=0x00 TTL=49 ID=0 PROTO=UDP SPT=52559 DPT=39412 LEN=9
Dec  6 23:24:47 SRC=183.62.138.55 LEN=29 TOS=0x10 PREC=0x00 TTL=50 ID=0 DF PROTO=UDP SPT=55382 DPT=11511 LEN=9
Dec  6 23:24:47 SRC=63.247.82.100 LEN=29 TOS=0x10 PREC=0x00 TTL=49 ID=0 DF PROTO=UDP SPT=41471 DPT=58283 LEN=9
Dec  6 23:24:47 SRC=83.172.21.22 LEN=29 TOS=0x10 PREC=0x00 TTL=52 ID=35703 PROTO=UDP SPT=26446 DPT=43949 LEN=9
Dec  6 23:24:47 SRC=203.156.196.12 LEN=29 TOS=0x10 PREC=0x00 TTL=49 ID=0 DF PROTO=UDP SPT=34034 DPT=36717 LEN=9
Dec  6 23:24:47 SRC=195.22.232.130 LEN=29 TOS=0x10 PREC=0x00 TTL=51 ID=40849 PROTO=UDP SPT=60392 DPT=46348 LEN=9
Dec  6 23:24:47 SRC=95.131.69.64 LEN=29 TOS=0x10 PREC=0x00 TTL=54 ID=0 DF PROTO=UDP SPT=43309 DPT=10405 LEN=9
Dec  6 23:24:47 SRC=91.222.64.189 LEN=29 TOS=0x10 PREC=0x00 TTL=55 ID=50849 PROTO=UDP SPT=25997 DPT=11544 LEN=9
Dec  6 23:24:47 SRC=121.78.145.72 LEN=29 TOS=0x10 PREC=0x00 TTL=43 ID=0 DF PROTO=UDP SPT=55705 DPT=19956 LEN=9
Dec  6 23:24:47 SRC=1.223.105.253 LEN=29 TOS=0x10 PREC=0x00 TTL=50 ID=0 DF PROTO=UDP SPT=47195 DPT=45067 LEN=9
Dec  6 23:24:48 SRC=14.32.87.182 LEN=29 TOS=0x10 PREC=0x00 TTL=46 ID=0 DF PROTO=UDP SPT=38773 DPT=41837 LEN=9
Dec  6 23:24:48 SRC=175.210.187.221 LEN=29 TOS=0x10 PREC=0x00 TTL=46 ID=0 DF PROTO=UDP SPT=55733 DPT=7166 LEN=9
Dec  6 23:24:48 SRC=194.44.237.30 LEN=29 TOS=0x10 PREC=0x00 TTL=58 ID=11654 PROTO=UDP SPT=52883 DPT=23400 LEN=9
Dec  6 23:24:48 SRC=202.143.141.5 LEN=29 TOS=0x10 PREC=0x00 TTL=50 ID=0 DF PROTO=UDP SPT=35101 DPT=52660 LEN=9
Dec  6 23:24:48 SRC=188.92.72.128 LEN=29 TOS=0x10 PREC=0x00 TTL=53 ID=21094 PROTO=UDP SPT=59287 DPT=11819 LEN=9
Dec  6 23:24:48 SRC=187.33.34.114 LEN=29 TOS=0x10 PREC=0x00 TTL=56 ID=0 DF PROTO=UDP SPT=42399 DPT=32729 LEN=9
Dec  6 23:24:48 SRC=216.149.178.107 LEN=29 TOS=0x10 PREC=0x00 TTL=46 ID=0 DF PROTO=UDP SPT=45068 DPT=10779 LEN=9
Dec  6 23:24:49 SRC=219.118.175.146 LEN=29 TOS=0x10 PREC=0x00 TTL=43 ID=27484 PROTO=UDP SPT=50801 DPT=17777 LEN=9
Dec  6 23:24:49 SRC=84.200.69.69 LEN=29 TOS=0x10 PREC=0x00 TTL=54 ID=0 DF PROTO=UDP SPT=54995 DPT=41746 LEN=9
Dec  6 23:24:49 SRC=188.92.73.107 LEN=29 TOS=0x10 PREC=0x00 TTL=53 ID=9419 PROTO=UDP SPT=59339 DPT=30163 LEN=9
Dec  6 23:24:49 SRC=188.92.77.66 LEN=29 TOS=0x10 PREC=0x00 TTL=53 ID=60588 PROTO=UDP SPT=53340 DPT=48379 LEN=9
Dec  6 23:24:50 SRC=98.101.221.18 LEN=29 TOS=0x10 PREC=0x00 TTL=53 ID=33306 PROTO=UDP SPT=52568 DPT=31206 LEN=9
Dec  6 23:24:51 SRC=68.171.158.204 LEN=29 TOS=0x10 PREC=0x00 TTL=52 ID=0 DF PROTO=UDP SPT=29325 DPT=49341 LEN=9
Dec  6 23:24:53 SRC=64.85.250.196 LEN=29 TOS=0x10 PREC=0x00 TTL=48 ID=0 DF PROTO=UDP SPT=43655 DPT=46972 LEN=9

another smaller attack

rx: 305.68 Mbit/s 610312 p/s

this one was just 600k pps

Jan  2 16:12:41 SRC=198.49.66.168 LEN=29 TOS=0x10 PREC=0x00 TTL=56 ID=0 DF PROTO=UDP SPT=55210 DPT=27015 LEN=9
Jan  2 16:12:44 SRC=198.101.203.12 LEN=29 TOS=0x10 PREC=0x00 TTL=49 ID=0 DF PROTO=UDP SPT=38023 DPT=27015 LEN=9
Jan  2 16:12:56 SRC=198.101.252.30 LEN=29 TOS=0x10 PREC=0x00 TTL=49 ID=0 DF PROTO=UDP SPT=58359 DPT=27015 LEN=9
Jan  2 16:13:08 SRC=168.61.24.194 LEN=29 TOS=0x10 PREC=0x00 TTL=50 ID=0 DF PROTO=UDP SPT=1024 DPT=27015 LEN=9
Jan  2 16:13:12 SRC=221.123.170.73 LEN=29 TOS=0x10 PREC=0x00 TTL=45 ID=0 DF PROTO=UDP SPT=56326 DPT=27015 LEN=9
Jan  2 16:13:15 SRC=173.0.50.121 LEN=29 TOS=0x10 PREC=0x00 TTL=51 ID=0 DF PROTO=UDP SPT=39243 DPT=27015 LEN=9
Jan  2 16:13:19 SRC=108.61.6.138 LEN=29 TOS=0x10 PREC=0x00 TTL=57 ID=0 DF PROTO=UDP SPT=42452 DPT=27015 LEN=9
Jan  2 16:15:03 SRC=108.61.6.138 LEN=29 TOS=0x10 PREC=0x00 TTL=56 ID=0 DF PROTO=UDP SPT=51661 DPT=27015 LEN=9
Jan  2 16:15:07 SRC=168.61.24.194 LEN=29 TOS=0x10 PREC=0x00 TTL=51 ID=0 DF PROTO=UDP SPT=1025 DPT=27015 LEN=9
Jan  2 16:15:12 SRC=198.101.203.12 LEN=29 TOS=0x10 PREC=0x00 TTL=49 ID=0 DF PROTO=UDP SPT=51425 DPT=27015 LEN=9

yeah… there’s even a microsoft IP in there… 168.61.24.194 (168.61.0.0/16 – MSFT-EP) … it doesn’t seems to be spoofed and seems to be running ubuntu (openssh2 on port 22) … no idea if that network is being used for azure customers or if that is really hotmail/outlook/msn IP…

got attacked by the same IP on 3rd of december 2012

Dec  3 01:04:11 SRC=168.61.24.194 LEN=29 TOS=0x10 PREC=0x00 TTL=50 ID=0 DF PROTO=UDP SPT=1024 DPT=20002 LEN=9

traffic didn’t look spoofed and ttl was correct… additionally seeing same IP attacking two times within a month is a strange coincidence if they were just spoofing…

an even smaller attack (30mbit – 40k pps) targeting the same service but from just a single host:

Jan  3 15:30:32 SRC=84.200.83.182 LEN=29 TOS=0x10 PREC=0x00 TTL=54 ID=0 DF PROTO=UDP SPT=33970 DPT=27015 LEN=9

as usual log lines are CET

bite me!

Map a network – PTR / reverse DNS values [php]

EvolutionCrazy — Thu, 18 Oct 2012 21:22:30 +0000


 
$start = '149.3.176.1';
$end = '149.3.177.254';
 
$first_ip = ip2long($start);
$last_ip = ip2long($end);
$current_ip = ip2long($start);
 
if($last_ip <= $first_ip){
	die('I saved you from an infinite loop.');
	exit;
}
 
echo "IP\t\tREVERSE\n";
while ($current_ip < $last_ip){
	echo long2ip($current_ip)."\t\t".gethostbyaddr(long2ip($current_ip))."\n";
	$current_ip++;
}
 
?>

Munin 2 CGI graphs generation cpu usage

EvolutionCrazy — Tue, 16 Oct 2012 09:48:07 +0000

This is what happens when you move a munin master node from CRON to CGI graphs:

Telecom Italia making use of ARIN / AT&T networks for internal private routing

EvolutionCrazy — Mon, 15 Oct 2012 11:43:05 +0000

C:\Users\Marco>tracert -w 100  172.15.5.233
 
Traccia instradamento verso 172.15.5.233 su un massimo di 30 punti di passaggio
 
  1    <1 ms    <1 ms    <1 ms  internet.gateway [192.168.0.200]
  2     *        *        *     Richiesta scaduta.
  3     9 ms     9 ms     9 ms  172.17.81.21
  4     9 ms     9 ms    10 ms  172.17.80.9
  5    18 ms    19 ms    20 ms  172.17.6.181
  6    17 ms    15 ms    15 ms  172.15.5.233
 
Traccia completata.

More amusing traceroutes can be seen here:
https://www.google.it/search?q=telecom+italia+tracert+”172.15.5.233″

NetRange:       172.0.0.0 - 172.15.255.255
CIDR:           172.0.0.0/12
OriginAS:       AS7132
NetName:        SIS-80-8-2012
NetHandle:      NET-172-0-0-0-1
Parent:         NET-172-0-0-0-0
NetType:        Direct Allocation
RegDate:        2012-08-20
Updated:        2012-08-20
Ref:            http://whois.arin.net/rest/net/NET-172-0-0-0-1

Are they aware that only 172.16.0.0/12 is reserved for private use and not the whole 172/8 as per RFC1918?

You are copying the bad things of fastweb… We want FTTH connections not RFC violations!

update 11 december 2012

  1    <1 ms    <1 ms    <1 ms  internet.gateway [192.168.0.200]
  2     *        *        *     Richiesta scaduta.
  3     9 ms     9 ms     9 ms  172.17.81.149
  4    10 ms    10 ms    10 ms  172.17.80.25
  5    25 ms    20 ms    16 ms  172.17.6.181
  6    16 ms    20 ms    15 ms  172-15-5-237.lightspeed.stlsmo.sbcglobal.net [172.15.5.237]
  7    19 ms    18 ms    15 ms  pos1-11-0-0.milano26.mil.seabone.net [195.22.192.85]
  8    37 ms    37 ms    37 ms  xe-11-1-0.franco31.fra.seabone.net [89.221.34.183]
  9     *       48 ms    47 ms  ffm-s2-rou-1041.DE.eurorings.net [134.222.249.25]
 10    76 ms    73 ms    73 ms  ffm-s1-rou-1102.DE.eurorings.net [134.222.229.73]
 11     *       72 ms     *     ffm-s1-rou-1006.DE.eurorings.net [134.222.230.222]
 12    40 ms    38 ms    39 ms  ffm-s1-rou-1022.DE.eurorings.net [134.222.227.9]
 13    80 ms    75 ms    74 ms  mla-s1-rou-1003.IT.eurorings.net [134.222.228.6]
 14    41 ms    41 ms    41 ms  134.222.125.138
 15     *       48 ms   119 ms  cr1-ge5-1-cal2.mil.kpnqwest.it [94.141.0.22]
 16    41 ms    41 ms    42 ms  kqi-cal2-fw.comm2000.it [94.141.30.244]
 17    42 ms    42 ms    42 ms  www.kqi.it [109.168.113.85]

15 december 2012

  1    <1 ms    <1 ms    <1 ms  internet.gateway [192.168.0.200]
  2     *        *        *     Richiesta scaduta.
  3     8 ms     9 ms     9 ms  172.17.81.149
  4     9 ms    10 ms     9 ms  172.17.80.25
  5    17 ms    17 ms    16 ms  172.17.9.233
  6    17 ms    19 ms    15 ms  172-15-5-237.lightspeed.stlsmo.sbcglobal.net [172.15.5.237]
  7    19 ms    18 ms    19 ms  bundle-ether14.milano26.mil.seabone.net [93.186.128.213]
  8    37 ms    38 ms    38 ms  xe-11-1-0.franco31.fra.seabone.net [89.221.34.183]
  9    47 ms    48 ms    49 ms  ffm-b12-link.telia.net [213.248.68.189]
 10    49 ms     *       49 ms  ffm-bb1-link.telia.net [80.91.246.102]
 11    50 ms    48 ms    56 ms  prs-bb1-link.telia.net [213.155.132.156]
 12    55 ms    60 ms    60 ms  ldn-bb1-link.telia.net [213.155.134.35]
 13    60 ms     *       72 ms  ldn-b3-link.telia.net [80.91.250.241]
 14    65 ms    75 ms    58 ms  80.239.194.126
 15     *       55 ms    53 ms  po126.msw01.01.lhr2.tfbnw.net [31.13.28.225]
 16     *        *        *     Richiesta scaduta.
 17     *        *        *     Richiesta scaduta.
 18     *        *        *     Richiesta scaduta.
 19     *        *        *     Richiesta scaduta.
 20     *        *        *     Richiesta scaduta.
 21     *        *        *     Richiesta scaduta.
 22     *        *        *     Richiesta scaduta.

Softlayer private network routing on centos6

EvolutionCrazy — Sat, 29 Sep 2012 12:27:29 +0000

echo '10.0.0.0/8 via 10.0.0.1' > /etc/sysconfig/network-scripts/route-eth0
service network restart

where 10.0.0.1 is your private network ip gw and eth0 is your private network interface

Solaris in.routed (udp 520) reflected ddos

EvolutionCrazy — Fri, 27 Jul 2012 22:53:06 +0000

Another service being exploited…
this time instead of chargen or the usual dns (UDP 53) the sources of the attack appeared to be running Solaris in.routed service (source port UDP 520)

if you are running an unsecured box please CLOSE THAT FUCKING PORT (IN UDP 520) or at least do some proper rate limiting!
if you are a carrier/ISP that allows spoofed traffic to leave your network: HOPE YOU GET BANKRUPT AND CLOSE YOUR FUCKING DOORS FOR GOOD!

read more for additional details and logs

(376hosts totaling ~600mbit / 140k PPS) full log (CEST time):

Jul 27 21:00:46 SRC=91.198.174.197 LEN=532 TOS=0x10 PREC=0x00 TTL=247 ID=33225 DF PROTO=UDP SPT=520 DPT=53302 LEN=512 
Jul 27 21:00:46 SRC=85.159.233.248 LEN=532 TOS=0x10 PREC=0x00 TTL=246 ID=26476 PROTO=UDP SPT=520 DPT=59087 LEN=512 
Jul 27 21:00:46 SRC=85.159.145.5 LEN=532 TOS=0x10 PREC=0x00 TTL=59 ID=35665 PROTO=UDP SPT=520 DPT=59190 LEN=512 
Jul 27 21:00:46 SRC=78.41.236.42 LEN=532 TOS=0x10 PREC=0x00 TTL=55 ID=61379 PROTO=UDP SPT=520 DPT=27949 LEN=512 
Jul 27 21:00:46 SRC=95.131.30.66 LEN=532 TOS=0x10 PREC=0x00 TTL=57 ID=35655 PROTO=UDP SPT=520 DPT=61021 LEN=512 
Jul 27 21:00:46 SRC=93.152.172.70 LEN=532 TOS=0x10 PREC=0x00 TTL=58 ID=51601 PROTO=UDP SPT=520 DPT=63296 LEN=512 
Jul 27 21:00:46 SRC=62.41.28.252 LEN=532 TOS=0x10 PREC=0x00 TTL=53 ID=45535 PROTO=UDP SPT=520 DPT=28024 LEN=512 
Jul 27 21:00:46 SRC=81.211.77.234 LEN=532 TOS=0x10 PREC=0x00 TTL=57 ID=15275 PROTO=UDP SPT=520 DPT=566 LEN=512 
Jul 27 21:00:46 SRC=83.166.112.193 LEN=532 TOS=0x10 PREC=0x00 TTL=52 ID=9405 PROTO=UDP SPT=520 DPT=22883 LEN=512 
Jul 27 21:00:46 SRC=77.42.129.120 LEN=532 TOS=0x10 PREC=0x00 TTL=50 ID=15269 PROTO=UDP SPT=520 DPT=52865 LEN=512 
Jul 27 21:00:46 SRC=77.42.129.119 LEN=532 TOS=0x10 PREC=0x00 TTL=50 ID=26905 PROTO=UDP SPT=520 DPT=56553 LEN=512 
Jul 27 21:00:46 SRC=96.8.126.9 LEN=532 TOS=0x10 PREC=0x00 TTL=47 ID=20870 PROTO=UDP SPT=520 DPT=35238 LEN=512 
Jul 27 21:00:46 SRC=96.8.126.7 LEN=532 TOS=0x10 PREC=0x00 TTL=49 ID=50039 PROTO=UDP SPT=520 DPT=63433 LEN=512 
Jul 27 21:00:46 SRC=217.29.33.130 LEN=532 TOS=0x10 PREC=0x00 TTL=57 ID=41756 PROTO=UDP SPT=520 DPT=60930 LEN=512 
Jul 27 21:00:46 SRC=194.183.225.111 LEN=532 TOS=0x10 PREC=0x00 TTL=54 ID=26939 PROTO=UDP SPT=520 DPT=39365 LEN=512 
Jul 27 21:00:46 SRC=195.14.55.10 LEN=532 TOS=0x10 PREC=0x00 TTL=54 ID=512 PROTO=UDP SPT=520 DPT=38561 LEN=512 
Jul 27 21:00:46 SRC=216.36.121.238 LEN=532 TOS=0x10 PREC=0x00 TTL=247 ID=57940 PROTO=UDP SPT=520 DPT=60072 LEN=512 
Jul 27 21:00:46 SRC=188.210.237.4 LEN=532 TOS=0x10 PREC=0x00 TTL=245 ID=7067 PROTO=UDP SPT=520 DPT=19437 LEN=512 
Jul 27 21:00:46 SRC=193.232.60.6 LEN=532 TOS=0x10 PREC=0x00 TTL=59 ID=13412 PROTO=UDP SPT=520 DPT=33250 LEN=512 
Jul 27 21:00:46 SRC=193.10.233.223 LEN=532 TOS=0x10 PREC=0x00 TTL=54 ID=17695 PROTO=UDP SPT=520 DPT=42006 LEN=512 
Jul 27 21:00:46 SRC=193.10.233.220 LEN=532 TOS=0x10 PREC=0x00 TTL=54 ID=32587 PROTO=UDP SPT=520 DPT=19582 LEN=512 
Jul 27 21:00:46 SRC=193.10.100.122 LEN=532 TOS=0x10 PREC=0x00 TTL=52 ID=27725 PROTO=UDP SPT=520 DPT=32957 LEN=512 
Jul 27 21:00:46 SRC=193.10.100.121 LEN=532 TOS=0x10 PREC=0x00 TTL=52 ID=28491 PROTO=UDP SPT=520 DPT=55735 LEN=512 
Jul 27 21:00:46 SRC=216.36.118.110 LEN=532 TOS=0x10 PREC=0x00 TTL=244 ID=13360 PROTO=UDP SPT=520 DPT=1368 LEN=512 
Jul 27 21:00:46 SRC=163.1.249.100 LEN=532 TOS=0x10 PREC=0x00 TTL=243 ID=56291 DF PROTO=UDP SPT=520 DPT=60228 LEN=512 
Jul 27 21:00:46 SRC=163.1.250.59 LEN=532 TOS=0x10 PREC=0x00 TTL=48 ID=26074 PROTO=UDP SPT=520 DPT=31745 LEN=512 
Jul 27 21:00:46 SRC=69.36.163.206 LEN=532 TOS=0x10 PREC=0x00 TTL=50 ID=53957 DF PROTO=UDP SPT=520 DPT=42067 LEN=512 
Jul 27 21:00:46 SRC=155.253.2.104 LEN=532 TOS=0x10 PREC=0x00 TTL=45 ID=18091 PROTO=UDP SPT=520 DPT=18475 LEN=512 
Jul 27 21:00:46 SRC=66.119.48.38 LEN=532 TOS=0x10 PREC=0x00 TTL=238 ID=16922 PROTO=UDP SPT=520 DPT=12211 LEN=512 
Jul 27 21:00:46 SRC=66.119.48.37 LEN=532 TOS=0x10 PREC=0x00 TTL=238 ID=64374 PROTO=UDP SPT=520 DPT=38977 LEN=512 
Jul 27 21:00:46 SRC=161.53.40.218 LEN=532 TOS=0x10 PREC=0x00 TTL=52 ID=5769 DF PROTO=UDP SPT=520 DPT=46427 LEN=512 
Jul 27 21:00:46 SRC=161.53.42.5 LEN=532 TOS=0x10 PREC=0x00 TTL=51 ID=11183 DF PROTO=UDP SPT=520 DPT=8092 LEN=512 
Jul 27 21:00:46 SRC=62.76.193.19 LEN=532 TOS=0x10 PREC=0x00 TTL=248 ID=30323 PROTO=UDP SPT=520 DPT=60391 LEN=512 
Jul 27 21:00:46 SRC=161.53.157.4 LEN=532 TOS=0x10 PREC=0x00 TTL=50 ID=20878 DF PROTO=UDP SPT=520 DPT=47685 LEN=512 
Jul 27 21:00:46 SRC=161.53.141.241 LEN=532 TOS=0x10 PREC=0x00 TTL=51 ID=14631 DF PROTO=UDP SPT=520 DPT=23524 LEN=512 
Jul 27 21:00:46 SRC=157.181.165.121 LEN=532 TOS=0x10 PREC=0x00 TTL=233 ID=27009 PROTO=UDP SPT=520 DPT=49106 LEN=512 
Jul 27 21:00:46 SRC=161.53.30.190 LEN=532 TOS=0x10 PREC=0x00 TTL=52 ID=27424 DF PROTO=UDP SPT=520 DPT=55617 LEN=512 
Jul 27 21:00:46 SRC=157.88.35.64 LEN=532 TOS=0x10 PREC=0x00 TTL=238 ID=48699 DF PROTO=UDP SPT=520 DPT=64232 LEN=512 
Jul 27 21:00:46 SRC=158.129.0.39 LEN=532 TOS=0x10 PREC=0x00 TTL=244 ID=54966 PROTO=UDP SPT=520 DPT=9700 LEN=512 
Jul 27 21:00:46 SRC=159.93.111.20 LEN=532 TOS=0x10 PREC=0x00 TTL=245 ID=48419 PROTO=UDP SPT=520 DPT=25864 LEN=512 
Jul 27 21:00:46 SRC=159.93.110.253 LEN=532 TOS=0x10 PREC=0x00 TTL=245 ID=33414 PROTO=UDP SPT=520 DPT=38931 LEN=512 
Jul 27 21:00:46 SRC=147.175.111.63 LEN=532 TOS=0x10 PREC=0x00 TTL=54 ID=61066 PROTO=UDP SPT=520 DPT=17582 LEN=512 
Jul 27 21:00:46 SRC=157.88.37.236 LEN=532 TOS=0x10 PREC=0x00 TTL=41 ID=41713 PROTO=UDP SPT=520 DPT=58218 LEN=512 
Jul 27 21:00:46 SRC=164.106.185.191 LEN=532 TOS=0x10 PREC=0x00 TTL=46 ID=7486 PROTO=UDP SPT=520 DPT=31343 LEN=512 
Jul 27 21:00:46 SRC=141.2.164.10 LEN=532 TOS=0x10 PREC=0x00 TTL=248 ID=3733 DF PROTO=UDP SPT=520 DPT=347 LEN=512 
Jul 27 21:00:46 SRC=202.159.215.133 LEN=532 TOS=0x10 PREC=0x00 TTL=237 ID=52721 DF PROTO=UDP SPT=520 DPT=16525 LEN=512 
Jul 27 21:00:46 SRC=165.91.74.123 LEN=532 TOS=0x10 PREC=0x00 TTL=45 ID=31589 PROTO=UDP SPT=520 DPT=48713 LEN=512 
Jul 27 21:00:46 SRC=165.91.67.66 LEN=532 TOS=0x10 PREC=0x00 TTL=43 ID=35192 PROTO=UDP SPT=520 DPT=32381 LEN=512 
Jul 27 21:00:46 SRC=165.91.23.116 LEN=532 TOS=0x10 PREC=0x00 TTL=44 ID=52285 PROTO=UDP SPT=520 DPT=65148 LEN=512 
Jul 27 21:00:46 SRC=152.3.62.4 LEN=532 TOS=0x10 PREC=0x00 TTL=51 ID=40224 PROTO=UDP SPT=520 DPT=42275 LEN=512 
Jul 27 21:00:46 SRC=152.46.255.206 LEN=532 TOS=0x10 PREC=0x00 TTL=53 ID=13187 PROTO=UDP SPT=520 DPT=25089 LEN=512 
Jul 27 21:00:46 SRC=165.91.23.115 LEN=532 TOS=0x10 PREC=0x00 TTL=44 ID=43323 PROTO=UDP SPT=520 DPT=26818 LEN=512 
Jul 27 21:00:46 SRC=165.91.22.183 LEN=532 TOS=0x10 PREC=0x00 TTL=44 ID=37177 PROTO=UDP SPT=520 DPT=5097 LEN=512 
Jul 27 21:00:46 SRC=152.3.15.154 LEN=532 TOS=0x10 PREC=0x00 TTL=51 ID=60023 PROTO=UDP SPT=520 DPT=40168 LEN=512 
Jul 27 21:00:46 SRC=165.91.227.20 LEN=532 TOS=0x10 PREC=0x00 TTL=40 ID=18369 PROTO=UDP SPT=520 DPT=25210 LEN=512 
Jul 27 21:00:46 SRC=152.3.104.165 LEN=532 TOS=0x10 PREC=0x00 TTL=50 ID=31805 PROTO=UDP SPT=520 DPT=4872 LEN=512 
Jul 27 21:00:46 SRC=165.91.148.139 LEN=532 TOS=0x10 PREC=0x00 TTL=40 ID=17879 PROTO=UDP SPT=520 DPT=18399 LEN=512 
Jul 27 21:00:46 SRC=152.19.196.95 LEN=532 TOS=0x10 PREC=0x00 TTL=52 ID=55629 PROTO=UDP SPT=520 DPT=36576 LEN=512 
Jul 27 21:00:46 SRC=152.19.196.94 LEN=532 TOS=0x10 PREC=0x00 TTL=52 ID=19790 PROTO=UDP SPT=520 DPT=18688 LEN=512 
Jul 27 21:00:46 SRC=152.19.180.166 LEN=532 TOS=0x10 PREC=0x00 TTL=52 ID=42868 PROTO=UDP SPT=520 DPT=19838 LEN=512 
Jul 27 21:00:46 SRC=140.164.14.98 LEN=532 TOS=0x10 PREC=0x00 TTL=240 ID=40533 PROTO=UDP SPT=520 DPT=6501 LEN=512 
Jul 27 21:00:46 SRC=152.19.180.165 LEN=532 TOS=0x10 PREC=0x00 TTL=51 ID=48393 PROTO=UDP SPT=520 DPT=52167 LEN=512 
Jul 27 21:00:46 SRC=140.164.14.41 LEN=532 TOS=0x10 PREC=0x00 TTL=240 ID=35619 PROTO=UDP SPT=520 DPT=16028 LEN=512 
Jul 27 21:00:46 SRC=190.60.209.74 LEN=532 TOS=0x10 PREC=0x00 TTL=236 ID=56358 PROTO=UDP SPT=520 DPT=26179 LEN=512 
Jul 27 21:00:46 SRC=169.229.194.41 LEN=532 TOS=0x10 PREC=0x00 TTL=239 ID=41235 PROTO=UDP SPT=520 DPT=53749 LEN=512 
Jul 27 21:00:46 SRC=169.236.154.97 LEN=532 TOS=0x10 PREC=0x00 TTL=238 ID=61668 PROTO=UDP SPT=520 DPT=3165 LEN=512 
Jul 27 21:00:46 SRC=169.236.151.110 LEN=532 TOS=0x10 PREC=0x00 TTL=47 ID=17417 PROTO=UDP SPT=520 DPT=24973 LEN=512 
Jul 27 21:00:46 SRC=169.236.164.20 LEN=532 TOS=0x10 PREC=0x00 TTL=47 ID=44648 PROTO=UDP SPT=520 DPT=33942 LEN=512 
Jul 27 21:00:46 SRC=169.236.253.97 LEN=532 TOS=0x10 PREC=0x00 TTL=238 ID=7777 PROTO=UDP SPT=520 DPT=10410 LEN=512 
Jul 27 21:00:46 SRC=140.105.127.103 LEN=532 TOS=0x10 PREC=0x00 TTL=47 ID=28856 PROTO=UDP SPT=520 DPT=57647 LEN=512 
Jul 27 21:00:46 SRC=139.18.52.177 LEN=532 TOS=0x10 PREC=0x00 TTL=51 ID=28080 PROTO=UDP SPT=520 DPT=18694 LEN=512 
Jul 27 21:00:46 SRC=139.18.50.139 LEN=532 TOS=0x10 PREC=0x00 TTL=51 ID=8604 PROTO=UDP SPT=520 DPT=58442 LEN=512 
Jul 27 21:00:46 SRC=134.91.35.6 LEN=532 TOS=0x10 PREC=0x00 TTL=48 ID=48887 PROTO=UDP SPT=520 DPT=47563 LEN=512 
Jul 27 21:00:46 SRC=200.142.254.226 LEN=532 TOS=0x10 PREC=0x00 TTL=49 ID=20502 PROTO=UDP SPT=520 DPT=43291 LEN=512 
Jul 27 21:00:46 SRC=146.6.139.131 LEN=532 TOS=0x10 PREC=0x00 TTL=44 ID=42902 PROTO=UDP SPT=520 DPT=31345 LEN=512 
Jul 27 21:00:46 SRC=146.201.212.132 LEN=532 TOS=0x10 PREC=0x00 TTL=47 ID=50953 PROTO=UDP SPT=520 DPT=4693 LEN=512 
Jul 27 21:00:46 SRC=146.201.212.48 LEN=532 TOS=0x10 PREC=0x00 TTL=47 ID=34193 PROTO=UDP SPT=520 DPT=40527 LEN=512 
Jul 27 21:00:46 SRC=146.201.212.67 LEN=532 TOS=0x10 PREC=0x00 TTL=47 ID=6073 PROTO=UDP SPT=520 DPT=36175 LEN=512 
Jul 27 21:00:46 SRC=134.102.204.70 LEN=532 TOS=0x10 PREC=0x00 TTL=247 ID=52130 DF PROTO=UDP SPT=520 DPT=23719 LEN=512 
Jul 27 21:00:46 SRC=218.45.226.194 LEN=532 TOS=0x10 PREC=0x00 TTL=230 ID=8335 DF PROTO=UDP SPT=520 DPT=39079 LEN=512 
Jul 27 21:00:46 SRC=134.102.219.138 LEN=532 TOS=0x10 PREC=0x00 TTL=247 ID=7864 DF PROTO=UDP SPT=520 DPT=41822 LEN=512 
Jul 27 21:00:46 SRC=140.247.30.17 LEN=532 TOS=0x10 PREC=0x00 TTL=53 ID=710 PROTO=UDP SPT=520 DPT=41975 LEN=512 
Jul 27 21:00:46 SRC=140.247.30.18 LEN=532 TOS=0x10 PREC=0x00 TTL=53 ID=5056 PROTO=UDP SPT=520 DPT=25714 LEN=512 
Jul 27 21:00:46 SRC=189.127.48.27 LEN=532 TOS=0x10 PREC=0x00 TTL=52 ID=42663 PROTO=UDP SPT=520 DPT=59872 LEN=512 
Jul 27 21:00:46 SRC=134.102.219.135 LEN=532 TOS=0x10 PREC=0x00 TTL=247 ID=62748 DF PROTO=UDP SPT=520 DPT=62053 LEN=512 
Jul 27 21:00:46 SRC=134.102.210.65 LEN=532 TOS=0x10 PREC=0x00 TTL=247 ID=31258 PROTO=UDP SPT=520 DPT=15123 LEN=512 
Jul 27 21:00:46 SRC=134.106.11.74 LEN=532 TOS=0x10 PREC=0x00 TTL=56 ID=41423 PROTO=UDP SPT=520 DPT=36120 LEN=512 
Jul 27 21:00:46 SRC=134.102.210.170 LEN=532 TOS=0x10 PREC=0x00 TTL=247 ID=14119 DF PROTO=UDP SPT=520 DPT=52709 LEN=512 
Jul 27 21:00:46 SRC=134.102.210.160 LEN=532 TOS=0x10 PREC=0x00 TTL=247 ID=24580 DF PROTO=UDP SPT=520 DPT=31387 LEN=512 
Jul 27 21:00:46 SRC=134.102.202.5 LEN=532 TOS=0x10 PREC=0x00 TTL=247 ID=54835 DF PROTO=UDP SPT=520 DPT=43998 LEN=512 
Jul 27 21:00:46 SRC=134.102.202.20 LEN=532 TOS=0x10 PREC=0x00 TTL=247 ID=45696 DF PROTO=UDP SPT=520 DPT=45515 LEN=512 
Jul 27 21:00:46 SRC=135.196.68.141 LEN=532 TOS=0x10 PREC=0x00 TTL=54 ID=24066 PROTO=UDP SPT=520 DPT=36683 LEN=512 
Jul 27 21:00:46 SRC=134.102.201.9 LEN=532 TOS=0x10 PREC=0x00 TTL=247 ID=47396 DF PROTO=UDP SPT=520 DPT=62153 LEN=512 
Jul 27 21:00:46 SRC=134.102.202.10 LEN=532 TOS=0x10 PREC=0x00 TTL=247 ID=25013 DF PROTO=UDP SPT=520 DPT=38746 LEN=512 
Jul 27 21:00:46 SRC=142.55.230.55 LEN=532 TOS=0x10 PREC=0x00 TTL=43 ID=28897 PROTO=UDP SPT=520 DPT=24163 LEN=512 
Jul 27 21:00:46 SRC=134.102.200.3 LEN=532 TOS=0x10 PREC=0x00 TTL=247 ID=16884 DF PROTO=UDP SPT=520 DPT=8722 LEN=512 
Jul 27 21:00:46 SRC=134.102.201.3 LEN=532 TOS=0x10 PREC=0x00 TTL=247 ID=2713 DF PROTO=UDP SPT=520 DPT=55049 LEN=512 
Jul 27 21:00:46 SRC=134.102.201.101 LEN=532 TOS=0x10 PREC=0x00 TTL=247 ID=20290 DF PROTO=UDP SPT=520 DPT=157 LEN=512 
Jul 27 21:00:46 SRC=134.102.201.2 LEN=532 TOS=0x10 PREC=0x00 TTL=247 ID=14446 DF PROTO=UDP SPT=520 DPT=58701 LEN=512 
Jul 27 21:00:46 SRC=134.102.200.11 LEN=532 TOS=0x10 PREC=0x00 TTL=247 ID=55034 DF PROTO=UDP SPT=520 DPT=18438 LEN=512 
Jul 27 21:00:46 SRC=141.213.15.72 LEN=532 TOS=0x10 PREC=0x00 TTL=241 ID=62965 PROTO=UDP SPT=520 DPT=64361 LEN=512 
Jul 27 21:00:46 SRC=141.217.48.113 LEN=532 TOS=0x10 PREC=0x00 TTL=242 ID=23653 PROTO=UDP SPT=520 DPT=31451 LEN=512 
Jul 27 21:00:46 SRC=132.230.80.6 LEN=532 TOS=0x10 PREC=0x00 TTL=245 ID=22838 DF PROTO=UDP SPT=520 DPT=59363 LEN=512 
Jul 27 21:00:46 SRC=132.230.139.145 LEN=532 TOS=0x10 PREC=0x00 TTL=245 ID=30567 DF PROTO=UDP SPT=520 DPT=16480 LEN=512 
Jul 27 21:00:46 SRC=131.155.130.25 LEN=532 TOS=0x10 PREC=0x00 TTL=54 ID=135 PROTO=UDP SPT=520 DPT=33751 LEN=512 
Jul 27 21:00:46 SRC=131.155.116.96 LEN=532 TOS=0x10 PREC=0x00 TTL=54 ID=35631 PROTO=UDP SPT=520 DPT=21597 LEN=512 
Jul 27 21:00:46 SRC=131.155.116.150 LEN=532 TOS=0x10 PREC=0x00 TTL=54 ID=50991 PROTO=UDP SPT=520 DPT=4056 LEN=512 
Jul 27 21:00:46 SRC=132.230.80.5 LEN=532 TOS=0x10 PREC=0x00 TTL=245 ID=34518 DF PROTO=UDP SPT=520 DPT=13144 LEN=512 
Jul 27 21:00:46 SRC=130.88.110.65 LEN=532 TOS=0x10 PREC=0x00 TTL=242 ID=18424 DF PROTO=UDP SPT=520 DPT=50777 LEN=512 
Jul 27 21:00:46 SRC=146.187.217.10 LEN=532 TOS=0x10 PREC=0x00 TTL=45 ID=186 PROTO=UDP SPT=520 DPT=8162 LEN=512 
Jul 27 21:00:46 SRC=146.187.217.11 LEN=532 TOS=0x10 PREC=0x00 TTL=45 ID=59199 PROTO=UDP SPT=520 DPT=43369 LEN=512 
Jul 27 21:00:46 SRC=130.88.157.195 LEN=532 TOS=0x10 PREC=0x00 TTL=242 ID=59390 DF PROTO=UDP SPT=520 DPT=6643 LEN=512 
Jul 27 21:00:46 SRC=142.103.121.8 LEN=532 TOS=0x10 PREC=0x00 TTL=46 ID=64812 PROTO=UDP SPT=520 DPT=22726 LEN=512 
Jul 27 21:00:46 SRC=137.45.2.21 LEN=532 TOS=0x10 PREC=0x00 TTL=47 ID=59658 PROTO=UDP SPT=520 DPT=20927 LEN=512 
Jul 27 21:00:46 SRC=130.209.13.185 LEN=532 TOS=0x10 PREC=0x00 TTL=242 ID=40101 PROTO=UDP SPT=520 DPT=62789 LEN=512 
Jul 27 21:00:46 SRC=218.24.21.82 LEN=532 TOS=0x10 PREC=0x00 TTL=44 ID=43117 PROTO=UDP SPT=520 DPT=13879 LEN=512 
Jul 27 21:00:46 SRC=137.45.2.12 LEN=532 TOS=0x10 PREC=0x00 TTL=47 ID=58704 PROTO=UDP SPT=520 DPT=12692 LEN=512 
Jul 27 21:00:46 SRC=202.75.248.129 LEN=532 TOS=0x10 PREC=0x00 TTL=242 ID=37726 DF PROTO=UDP SPT=520 DPT=30011 LEN=512 
Jul 27 21:00:46 SRC=140.211.127.153 LEN=532 TOS=0x10 PREC=0x00 TTL=50 ID=30071 PROTO=UDP SPT=520 DPT=34882 LEN=512 
Jul 27 21:00:46 SRC=140.211.127.117 LEN=532 TOS=0x10 PREC=0x00 TTL=50 ID=59313 PROTO=UDP SPT=520 DPT=40503 LEN=512 
Jul 27 21:00:46 SRC=163.20.240.202 LEN=532 TOS=0x10 PREC=0x00 TTL=43 ID=26073 PROTO=UDP SPT=520 DPT=65061 LEN=512 
Jul 27 21:00:46 SRC=130.238.96.196 LEN=532 TOS=0x10 PREC=0x00 TTL=52 ID=40246 PROTO=UDP SPT=520 DPT=9045 LEN=512 
Jul 27 21:00:46 SRC=138.47.18.16 LEN=532 TOS=0x10 PREC=0x00 TTL=242 ID=13502 PROTO=UDP SPT=520 DPT=14938 LEN=512 
Jul 27 21:00:46 SRC=163.20.240.201 LEN=532 TOS=0x10 PREC=0x00 TTL=43 ID=8918 PROTO=UDP SPT=520 DPT=18740 LEN=512 
Jul 27 21:00:46 SRC=137.192.180.39 LEN=532 TOS=0x10 PREC=0x00 TTL=48 ID=57193 PROTO=UDP SPT=520 DPT=46177 LEN=512 
Jul 27 21:00:46 SRC=130.237.225.23 LEN=532 TOS=0x10 PREC=0x00 TTL=242 ID=38907 PROTO=UDP SPT=520 DPT=47494 LEN=512 
Jul 27 21:00:46 SRC=130.237.234.37 LEN=532 TOS=0x10 PREC=0x00 TTL=242 ID=64895 DF PROTO=UDP SPT=520 DPT=58341 LEN=512 
Jul 27 21:00:46 SRC=130.236.60.38 LEN=532 TOS=0x10 PREC=0x00 TTL=241 ID=19707 DF PROTO=UDP SPT=520 DPT=43543 LEN=512 
Jul 27 21:00:46 SRC=130.237.234.43 LEN=532 TOS=0x10 PREC=0x00 TTL=242 ID=34026 DF PROTO=UDP SPT=520 DPT=24115 LEN=512 
Jul 27 21:00:46 SRC=163.143.3.51 LEN=532 TOS=0x10 PREC=0x00 TTL=43 ID=12869 PROTO=UDP SPT=520 DPT=13365 LEN=512 
Jul 27 21:00:46 SRC=163.143.3.53 LEN=532 TOS=0x10 PREC=0x00 TTL=43 ID=1549 PROTO=UDP SPT=520 DPT=41926 LEN=512 
Jul 27 21:00:46 SRC=163.143.3.50 LEN=532 TOS=0x10 PREC=0x00 TTL=43 ID=8915 PROTO=UDP SPT=520 DPT=55669 LEN=512 
Jul 27 21:00:46 SRC=160.193.8.5 LEN=532 TOS=0x10 PREC=0x00 TTL=236 ID=30474 DF PROTO=UDP SPT=520 DPT=11763 LEN=512 
Jul 27 21:00:46 SRC=160.193.162.1 LEN=532 TOS=0x10 PREC=0x00 TTL=234 ID=14829 DF PROTO=UDP SPT=520 DPT=25060 LEN=512 
Jul 27 21:00:46 SRC=132.206.9.90 LEN=532 TOS=0x10 PREC=0x00 TTL=41 ID=22855 PROTO=UDP SPT=520 DPT=46673 LEN=512 
Jul 27 21:00:46 SRC=211.245.216.90 LEN=532 TOS=0x10 PREC=0x00 TTL=244 ID=25103 DF PROTO=UDP SPT=520 DPT=38337 LEN=512 
Jul 27 21:00:46 SRC=132.204.2.41 LEN=532 TOS=0x10 PREC=0x00 TTL=41 ID=48584 PROTO=UDP SPT=520 DPT=59604 LEN=512 
Jul 27 21:00:46 SRC=129.206.245.243 LEN=532 TOS=0x10 PREC=0x00 TTL=248 ID=60456 DF PROTO=UDP SPT=520 DPT=38295 LEN=512 
Jul 27 21:00:46 SRC=130.64.1.41 LEN=532 TOS=0x10 PREC=0x00 TTL=50 ID=16323 PROTO=UDP SPT=520 DPT=26241 LEN=512 
Jul 27 21:00:46 SRC=129.215.237.64 LEN=532 TOS=0x10 PREC=0x00 TTL=49 ID=19812 PROTO=UDP SPT=520 DPT=13013 LEN=512 
Jul 27 21:00:46 SRC=129.206.109.120 LEN=532 TOS=0x10 PREC=0x00 TTL=53 ID=8620 PROTO=UDP SPT=520 DPT=51736 LEN=512 
Jul 27 21:00:46 SRC=137.82.18.11 LEN=532 TOS=0x10 PREC=0x00 TTL=46 ID=29230 PROTO=UDP SPT=520 DPT=16051 LEN=512 
Jul 27 21:00:46 SRC=130.64.1.146 LEN=532 TOS=0x10 PREC=0x00 TTL=50 ID=59834 PROTO=UDP SPT=520 DPT=5270 LEN=512 
Jul 27 21:00:46 SRC=129.215.166.150 LEN=532 TOS=0x10 PREC=0x00 TTL=244 ID=58698 DF PROTO=UDP SPT=520 DPT=16381 LEN=512 
Jul 27 21:00:46 SRC=137.82.18.7 LEN=532 TOS=0x10 PREC=0x00 TTL=46 ID=61741 PROTO=UDP SPT=520 DPT=58005 LEN=512 
Jul 27 21:00:46 SRC=132.204.157.103 LEN=532 TOS=0x10 PREC=0x00 TTL=46 ID=30140 PROTO=UDP SPT=520 DPT=55702 LEN=512 
Jul 27 21:00:46 SRC=129.215.128.99 LEN=532 TOS=0x10 PREC=0x00 TTL=244 ID=19119 DF PROTO=UDP SPT=520 DPT=29282 LEN=512 
Jul 27 21:00:46 SRC=129.215.13.205 LEN=532 TOS=0x10 PREC=0x00 TTL=243 ID=62805 DF PROTO=UDP SPT=520 DPT=7969 LEN=512 
Jul 27 21:00:46 SRC=129.215.237.123 LEN=532 TOS=0x10 PREC=0x00 TTL=49 ID=7641 PROTO=UDP SPT=520 DPT=42858 LEN=512 
Jul 27 21:00:46 SRC=129.187.244.12 LEN=532 TOS=0x10 PREC=0x00 TTL=246 ID=36332 PROTO=UDP SPT=520 DPT=50463 LEN=512 
Jul 27 21:00:46 SRC=132.204.157.102 LEN=532 TOS=0x10 PREC=0x00 TTL=46 ID=9665 PROTO=UDP SPT=520 DPT=63377 LEN=512 
Jul 27 21:00:46 SRC=129.215.237.39 LEN=532 TOS=0x10 PREC=0x00 TTL=49 ID=33877 PROTO=UDP SPT=520 DPT=36759 LEN=512 
Jul 27 21:00:46 SRC=129.215.128.142 LEN=532 TOS=0x10 PREC=0x00 TTL=244 ID=12281 DF PROTO=UDP SPT=520 DPT=9148 LEN=512 
Jul 27 21:00:46 SRC=130.238.96.194 LEN=532 TOS=0x10 PREC=0x00 TTL=52 ID=4733 PROTO=UDP SPT=520 DPT=38689 LEN=512 
Jul 27 21:00:46 SRC=131.225.58.110 LEN=532 TOS=0x10 PREC=0x00 TTL=47 ID=35488 PROTO=UDP SPT=520 DPT=13884 LEN=512 
Jul 27 21:00:46 SRC=129.241.160.128 LEN=532 TOS=0x10 PREC=0x00 TTL=52 ID=6454 PROTO=UDP SPT=520 DPT=37929 LEN=512 
Jul 27 21:00:46 SRC=129.241.160.126 LEN=532 TOS=0x10 PREC=0x00 TTL=52 ID=16183 PROTO=UDP SPT=520 DPT=59621 LEN=512 
Jul 27 21:00:46 SRC=131.225.58.109 LEN=532 TOS=0x10 PREC=0x00 TTL=47 ID=24575 PROTO=UDP SPT=520 DPT=9593 LEN=512 
Jul 27 21:00:46 SRC=129.241.112.46 LEN=532 TOS=0x10 PREC=0x00 TTL=52 ID=38789 PROTO=UDP SPT=520 DPT=60182 LEN=512 
Jul 27 21:00:46 SRC=138.23.62.10 LEN=532 TOS=0x10 PREC=0x00 TTL=240 ID=6331 PROTO=UDP SPT=520 DPT=56795 LEN=512 
Jul 27 21:00:46 SRC=129.241.112.44 LEN=532 TOS=0x10 PREC=0x00 TTL=52 ID=57772 PROTO=UDP SPT=520 DPT=43719 LEN=512 
Jul 27 21:00:46 SRC=134.121.0.103 LEN=532 TOS=0x10 PREC=0x00 TTL=40 ID=56473 PROTO=UDP SPT=520 DPT=35712 LEN=512 
Jul 27 21:00:46 SRC=138.23.151.36 LEN=532 TOS=0x10 PREC=0x00 TTL=45 ID=52465 PROTO=UDP SPT=520 DPT=60672 LEN=512 
Jul 27 21:00:46 SRC=202.100.85.87 LEN=532 TOS=0x10 PREC=0x00 TTL=43 ID=64436 DF PROTO=UDP SPT=520 DPT=24574 LEN=512 
Jul 27 21:00:46 SRC=136.159.34.51 LEN=532 TOS=0x10 PREC=0x00 TTL=47 ID=3627 PROTO=UDP SPT=520 DPT=20158 LEN=512 
Jul 27 21:00:46 SRC=131.193.196.232 LEN=532 TOS=0x10 PREC=0x00 TTL=49 ID=61944 PROTO=UDP SPT=520 DPT=26422 LEN=512 
Jul 27 21:00:46 SRC=137.110.114.51 LEN=532 TOS=0x10 PREC=0x00 TTL=239 ID=61452 PROTO=UDP SPT=520 DPT=15313 LEN=512 
Jul 27 21:00:46 SRC=150.83.68.146 LEN=532 TOS=0x10 PREC=0x00 TTL=43 ID=23049 PROTO=UDP SPT=520 DPT=42204 LEN=512 
Jul 27 21:00:46 SRC=129.241.160.125 LEN=532 TOS=0x10 PREC=0x00 TTL=52 ID=48280 PROTO=UDP SPT=520 DPT=10560 LEN=512 
Jul 27 21:00:46 SRC=129.98.105.172 LEN=532 TOS=0x10 PREC=0x00 TTL=240 ID=8043 PROTO=UDP SPT=520 DPT=14030 LEN=512 
Jul 27 21:00:46 SRC=130.15.126.120 LEN=532 TOS=0x10 PREC=0x00 TTL=244 ID=63454 DF PROTO=UDP SPT=520 DPT=35221 LEN=512 
Jul 27 21:00:46 SRC=130.156.100.25 LEN=532 TOS=0x10 PREC=0x00 TTL=243 ID=17704 DF PROTO=UDP SPT=520 DPT=10408 LEN=512 
Jul 27 21:00:46 SRC=130.15.48.78 LEN=532 TOS=0x10 PREC=0x00 TTL=241 ID=57618 DF PROTO=UDP SPT=520 DPT=37872 LEN=512 
Jul 27 21:00:46 SRC=129.49.23.119 LEN=532 TOS=0x10 PREC=0x00 TTL=50 ID=54454 PROTO=UDP SPT=520 DPT=352 LEN=512 
Jul 27 21:00:46 SRC=128.176.188.158 LEN=532 TOS=0x10 PREC=0x00 TTL=50 ID=62939 PROTO=UDP SPT=520 DPT=63631 LEN=512 
Jul 27 21:00:46 SRC=128.176.188.130 LEN=532 TOS=0x10 PREC=0x00 TTL=50 ID=18943 PROTO=UDP SPT=520 DPT=59144 LEN=512 
Jul 27 21:00:46 SRC=128.176.188.124 LEN=532 TOS=0x10 PREC=0x00 TTL=50 ID=12160 PROTO=UDP SPT=520 DPT=31813 LEN=512 
Jul 27 21:00:46 SRC=165.194.95.122 LEN=532 TOS=0x10 PREC=0x00 TTL=49 ID=5711 PROTO=UDP SPT=520 DPT=20339 LEN=512 
Jul 27 21:00:46 SRC=130.179.48.22 LEN=532 TOS=0x10 PREC=0x00 TTL=47 ID=4695 PROTO=UDP SPT=520 DPT=58021 LEN=512 
Jul 27 21:00:46 SRC=132.241.140.12 LEN=532 TOS=0x10 PREC=0x00 TTL=48 ID=46325 PROTO=UDP SPT=520 DPT=18200 LEN=512 
Jul 27 21:00:46 SRC=132.249.243.51 LEN=532 TOS=0x10 PREC=0x00 TTL=49 ID=32047 PROTO=UDP SPT=520 DPT=18168 LEN=512 
Jul 27 21:00:46 SRC=132.239.16.31 LEN=532 TOS=0x10 PREC=0x00 TTL=239 ID=64964 PROTO=UDP SPT=520 DPT=15923 LEN=512 
Jul 27 21:00:46 SRC=132.239.16.124 LEN=532 TOS=0x10 PREC=0x00 TTL=239 ID=29906 PROTO=UDP SPT=520 DPT=50828 LEN=512 
Jul 27 21:00:46 SRC=130.179.48.19 LEN=532 TOS=0x10 PREC=0x00 TTL=47 ID=57530 PROTO=UDP SPT=520 DPT=14899 LEN=512 
Jul 27 21:00:46 SRC=109.169.74.9 LEN=532 TOS=0x10 PREC=0x00 TTL=54 ID=55481 PROTO=UDP SPT=520 DPT=32958 LEN=512 
Jul 27 21:00:46 SRC=109.104.118.7 LEN=532 TOS=0x10 PREC=0x00 TTL=54 ID=53422 PROTO=UDP SPT=520 DPT=10269 LEN=512 
Jul 27 21:00:46 SRC=109.169.74.7 LEN=532 TOS=0x10 PREC=0x00 TTL=54 ID=42684 PROTO=UDP SPT=520 DPT=62670 LEN=512 
Jul 27 21:00:46 SRC=141.223.129.19 LEN=532 TOS=0x10 PREC=0x00 TTL=36 ID=5037 PROTO=UDP SPT=520 DPT=5393 LEN=512 
Jul 27 21:00:46 SRC=132.241.140.9 LEN=532 TOS=0x10 PREC=0x00 TTL=48 ID=37331 PROTO=UDP SPT=520 DPT=63035 LEN=512 
Jul 27 21:00:46 SRC=129.93.41.88 LEN=532 TOS=0x10 PREC=0x00 TTL=47 ID=37082 PROTO=UDP SPT=520 DPT=37750 LEN=512 
Jul 27 21:00:46 SRC=129.2.126.123 LEN=532 TOS=0x10 PREC=0x00 TTL=46 ID=19233 PROTO=UDP SPT=520 DPT=35035 LEN=512 
Jul 27 21:00:46 SRC=129.2.126.84 LEN=532 TOS=0x10 PREC=0x00 TTL=46 ID=11761 PROTO=UDP SPT=520 DPT=34204 LEN=512 
Jul 27 21:00:46 SRC=132.239.1.16 LEN=532 TOS=0x10 PREC=0x00 TTL=48 ID=27976 PROTO=UDP SPT=520 DPT=38002 LEN=512 
Jul 27 21:00:46 SRC=141.223.54.228 LEN=532 TOS=0x10 PREC=0x00 TTL=36 ID=19798 PROTO=UDP SPT=520 DPT=16209 LEN=512 
Jul 27 21:00:46 SRC=165.194.95.121 LEN=532 TOS=0x10 PREC=0x00 TTL=49 ID=54048 PROTO=UDP SPT=520 DPT=17101 LEN=512 
Jul 27 21:00:46 SRC=129.2.126.119 LEN=532 TOS=0x10 PREC=0x00 TTL=46 ID=23242 PROTO=UDP SPT=520 DPT=53408 LEN=512 
Jul 27 21:00:46 SRC=140.131.39.224 LEN=532 TOS=0x10 PREC=0x00 TTL=43 ID=41820 PROTO=UDP SPT=520 DPT=31342 LEN=512 
Jul 27 21:00:46 SRC=129.170.60.47 LEN=532 TOS=0x10 PREC=0x00 TTL=51 ID=35360 PROTO=UDP SPT=520 DPT=29314 LEN=512 
Jul 27 21:00:46 SRC=129.170.60.46 LEN=532 TOS=0x10 PREC=0x00 TTL=51 ID=33837 PROTO=UDP SPT=520 DPT=56171 LEN=512 
Jul 27 21:00:46 SRC=128.91.127.111 LEN=532 TOS=0x10 PREC=0x00 TTL=50 ID=58083 PROTO=UDP SPT=520 DPT=26224 LEN=512 
Jul 27 21:00:46 SRC=128.91.127.110 LEN=532 TOS=0x10 PREC=0x00 TTL=51 ID=34995 PROTO=UDP SPT=520 DPT=62171 LEN=512 
Jul 27 21:00:46 SRC=128.36.196.74 LEN=532 TOS=0x10 PREC=0x00 TTL=47 ID=875 PROTO=UDP SPT=520 DPT=59781 LEN=512 
Jul 27 21:00:46 SRC=128.59.232.238 LEN=532 TOS=0x10 PREC=0x00 TTL=241 ID=36447 PROTO=UDP SPT=520 DPT=62946 LEN=512 
Jul 27 21:00:46 SRC=129.81.139.20 LEN=532 TOS=0x10 PREC=0x00 TTL=47 ID=32101 PROTO=UDP SPT=520 DPT=61978 LEN=512 
Jul 27 21:00:46 SRC=128.36.196.73 LEN=532 TOS=0x10 PREC=0x00 TTL=48 ID=64613 PROTO=UDP SPT=520 DPT=16793 LEN=512 
Jul 27 21:00:46 SRC=129.7.239.54 LEN=532 TOS=0x10 PREC=0x00 TTL=43 ID=40018 PROTO=UDP SPT=520 DPT=5720 LEN=512 
Jul 27 21:00:46 SRC=140.120.152.125 LEN=532 TOS=0x10 PREC=0x00 TTL=49 ID=3188 PROTO=UDP SPT=520 DPT=8766 LEN=512 
Jul 27 21:00:46 SRC=140.115.17.41 LEN=532 TOS=0x10 PREC=0x00 TTL=42 ID=57913 PROTO=UDP SPT=520 DPT=61047 LEN=512 
Jul 27 21:00:46 SRC=140.120.152.120 LEN=532 TOS=0x10 PREC=0x00 TTL=49 ID=9296 PROTO=UDP SPT=520 DPT=31610 LEN=512 
Jul 27 21:00:46 SRC=140.127.23.38 LEN=532 TOS=0x10 PREC=0x00 TTL=232 ID=1793 PROTO=UDP SPT=520 DPT=40262 LEN=512 
Jul 27 21:00:46 SRC=140.115.17.40 LEN=532 TOS=0x10 PREC=0x00 TTL=42 ID=25072 PROTO=UDP SPT=520 DPT=56061 LEN=512 
Jul 27 21:00:46 SRC=129.10.116.97 LEN=532 TOS=0x10 PREC=0x00 TTL=49 ID=63900 PROTO=UDP SPT=520 DPT=49276 LEN=512 
Jul 27 21:00:46 SRC=129.10.116.9 LEN=532 TOS=0x10 PREC=0x00 TTL=49 ID=30811 PROTO=UDP SPT=520 DPT=55986 LEN=512 
Jul 27 21:00:46 SRC=140.123.230.89 LEN=532 TOS=0x10 PREC=0x00 TTL=42 ID=24381 PROTO=UDP SPT=520 DPT=23969 LEN=512 
Jul 27 21:00:46 SRC=140.123.4.200 LEN=532 TOS=0x10 PREC=0x00 TTL=43 ID=23870 PROTO=UDP SPT=520 DPT=20158 LEN=512 
Jul 27 21:00:46 SRC=140.123.66.28 LEN=532 TOS=0x10 PREC=0x00 TTL=233 ID=32384 DF PROTO=UDP SPT=520 DPT=20702 LEN=512 
Jul 27 21:00:46 SRC=128.220.233.167 LEN=532 TOS=0x10 PREC=0x00 TTL=244 ID=28038 PROTO=UDP SPT=520 DPT=36786 LEN=512 
Jul 27 21:00:46 SRC=129.114.50.8 LEN=532 TOS=0x10 PREC=0x00 TTL=237 ID=53545 PROTO=UDP SPT=520 DPT=60144 LEN=512 
Jul 27 21:00:46 SRC=129.114.50.7 LEN=532 TOS=0x10 PREC=0x00 TTL=237 ID=8387 PROTO=UDP SPT=520 DPT=12228 LEN=512 
Jul 27 21:00:46 SRC=128.239.2.11 LEN=532 TOS=0x10 PREC=0x00 TTL=47 ID=24681 PROTO=UDP SPT=520 DPT=6575 LEN=512 
Jul 27 21:00:46 SRC=140.112.22.223 LEN=532 TOS=0x10 PREC=0x00 TTL=46 ID=35737 PROTO=UDP SPT=520 DPT=22534 LEN=512 
Jul 27 21:00:46 SRC=129.219.30.9 LEN=532 TOS=0x10 PREC=0x00 TTL=43 ID=3728 PROTO=UDP SPT=520 DPT=63058 LEN=512 
Jul 27 21:00:46 SRC=129.114.50.3 LEN=532 TOS=0x10 PREC=0x00 TTL=237 ID=59764 PROTO=UDP SPT=520 DPT=47250 LEN=512 
Jul 27 21:00:46 SRC=128.248.155.55 LEN=532 TOS=0x10 PREC=0x00 TTL=51 ID=50622 PROTO=UDP SPT=520 DPT=23840 LEN=512 
Jul 27 21:00:46 SRC=128.248.155.68 LEN=532 TOS=0x10 PREC=0x00 TTL=51 ID=27177 PROTO=UDP SPT=520 DPT=28565 LEN=512 
Jul 27 21:00:46 SRC=129.114.50.4 LEN=532 TOS=0x10 PREC=0x00 TTL=237 ID=31005 PROTO=UDP SPT=520 DPT=40939 LEN=512 
Jul 27 21:00:46 SRC=128.122.20.251 LEN=532 TOS=0x10 PREC=0x00 TTL=242 ID=59553 DF PROTO=UDP SPT=520 DPT=8541 LEN=512 
Jul 27 21:00:46 SRC=129.244.101.240 LEN=532 TOS=0x10 PREC=0x00 TTL=51 ID=53362 PROTO=UDP SPT=520 DPT=44883 LEN=512 
Jul 27 21:00:46 SRC=128.248.155.189 LEN=532 TOS=0x10 PREC=0x00 TTL=51 ID=45607 PROTO=UDP SPT=520 DPT=23575 LEN=512 
Jul 27 21:00:46 SRC=128.248.155.192 LEN=532 TOS=0x10 PREC=0x00 TTL=51 ID=50542 PROTO=UDP SPT=520 DPT=12068 LEN=512 
Jul 27 21:00:46 SRC=128.248.155.213 LEN=532 TOS=0x10 PREC=0x00 TTL=51 ID=32880 PROTO=UDP SPT=520 DPT=56498 LEN=512 
Jul 27 21:00:46 SRC=128.83.63.223 LEN=532 TOS=0x10 PREC=0x00 TTL=45 ID=53783 PROTO=UDP SPT=520 DPT=15505 LEN=512 
Jul 27 21:00:46 SRC=128.83.129.25 LEN=532 TOS=0x10 PREC=0x00 TTL=236 ID=35016 PROTO=UDP SPT=520 DPT=30754 LEN=512 
Jul 27 21:00:46 SRC=128.83.40.13 LEN=532 TOS=0x10 PREC=0x00 TTL=44 ID=17792 PROTO=UDP SPT=520 DPT=27698 LEN=512 
Jul 27 21:00:46 SRC=160.194.154.67 LEN=532 TOS=0x10 PREC=0x00 TTL=45 ID=60205 PROTO=UDP SPT=520 DPT=21442 LEN=512 
Jul 27 21:00:46 SRC=128.83.40.12 LEN=532 TOS=0x10 PREC=0x00 TTL=44 ID=29538 PROTO=UDP SPT=520 DPT=28557 LEN=512 
Jul 27 21:00:46 SRC=129.123.21.87 LEN=532 TOS=0x10 PREC=0x00 TTL=234 ID=26648 PROTO=UDP SPT=520 DPT=11994 LEN=512 
Jul 27 21:00:46 SRC=128.135.53.7 LEN=532 TOS=0x10 PREC=0x00 TTL=244 ID=24304 PROTO=UDP SPT=520 DPT=31509 LEN=512 
Jul 27 21:00:46 SRC=128.135.174.160 LEN=532 TOS=0x10 PREC=0x00 TTL=49 ID=40359 PROTO=UDP SPT=520 DPT=673 LEN=512 
Jul 27 21:00:46 SRC=133.27.193.73 LEN=532 TOS=0x10 PREC=0x00 TTL=43 ID=64648 PROTO=UDP SPT=520 DPT=60258 LEN=512 
Jul 27 21:00:46 SRC=133.27.193.71 LEN=532 TOS=0x10 PREC=0x00 TTL=43 ID=51323 PROTO=UDP SPT=520 DPT=42041 LEN=512 
Jul 27 21:00:46 SRC=133.54.227.30 LEN=532 TOS=0x10 PREC=0x00 TTL=43 ID=4498 PROTO=UDP SPT=520 DPT=48661 LEN=512 
Jul 27 21:00:46 SRC=133.3.143.144 LEN=532 TOS=0x10 PREC=0x00 TTL=40 ID=36831 PROTO=UDP SPT=520 DPT=21909 LEN=512 
Jul 27 21:00:46 SRC=133.97.166.101 LEN=532 TOS=0x10 PREC=0x00 TTL=235 ID=11329 DF PROTO=UDP SPT=520 DPT=46408 LEN=512 
Jul 27 21:00:46 SRC=128.194.154.244 LEN=532 TOS=0x10 PREC=0x00 TTL=45 ID=59000 PROTO=UDP SPT=520 DPT=23352 LEN=512 
Jul 27 21:00:46 SRC=128.194.154.42 LEN=532 TOS=0x10 PREC=0x00 TTL=45 ID=339 PROTO=UDP SPT=520 DPT=52341 LEN=512 
Jul 27 21:00:46 SRC=128.194.154.41 LEN=532 TOS=0x10 PREC=0x00 TTL=45 ID=27793 PROTO=UDP SPT=520 DPT=62855 LEN=512 
Jul 27 21:00:46 SRC=128.194.138.101 LEN=532 TOS=0x10 PREC=0x00 TTL=44 ID=48478 PROTO=UDP SPT=520 DPT=32417 LEN=512 
Jul 27 21:00:46 SRC=133.5.148.1 LEN=532 TOS=0x10 PREC=0x00 TTL=44 ID=10027 PROTO=UDP SPT=520 DPT=40293 LEN=512 
Jul 27 21:00:46 SRC=128.3.28.72 LEN=532 TOS=0x10 PREC=0x00 TTL=45 ID=25933 PROTO=UDP SPT=520 DPT=34988 LEN=512 
Jul 27 21:00:46 SRC=128.3.28.57 LEN=532 TOS=0x10 PREC=0x00 TTL=45 ID=9549 PROTO=UDP SPT=520 DPT=2269 LEN=512 
Jul 27 21:00:46 SRC=128.3.28.245 LEN=532 TOS=0x10 PREC=0x00 TTL=45 ID=13643 PROTO=UDP SPT=520 DPT=60844 LEN=512 
Jul 27 21:00:46 SRC=128.3.28.152 LEN=532 TOS=0x10 PREC=0x00 TTL=45 ID=27216 PROTO=UDP SPT=520 DPT=40720 LEN=512 
Jul 27 21:00:46 SRC=129.244.101.241 LEN=532 TOS=0x10 PREC=0x00 TTL=51 ID=33155 PROTO=UDP SPT=520 DPT=4216 LEN=512 
Jul 27 21:00:46 SRC=133.242.48.252 LEN=532 TOS=0x10 PREC=0x00 TTL=240 ID=59405 PROTO=UDP SPT=520 DPT=65517 LEN=512 
Jul 27 21:00:46 SRC=128.95.48.25 LEN=532 TOS=0x10 PREC=0x00 TTL=240 ID=32668 PROTO=UDP SPT=520 DPT=19138 LEN=512 
Jul 27 21:00:46 SRC=128.196.60.71 LEN=532 TOS=0x10 PREC=0x00 TTL=240 ID=36287 PROTO=UDP SPT=520 DPT=44397 LEN=512 
Jul 27 21:00:46 SRC=217.107.218.236 LEN=532 TOS=0x10 PREC=0x00 TTL=58 ID=7074 PROTO=UDP SPT=520 DPT=31117 LEN=512 
Jul 27 21:00:46 SRC=128.223.142.86 LEN=532 TOS=0x10 PREC=0x00 TTL=52 ID=51759 PROTO=UDP SPT=520 DPT=35441 LEN=512 
Jul 27 21:00:46 SRC=128.223.142.47 LEN=532 TOS=0x10 PREC=0x00 TTL=52 ID=27031 PROTO=UDP SPT=520 DPT=65532 LEN=512 
Jul 27 21:00:46 SRC=128.223.142.46 LEN=532 TOS=0x10 PREC=0x00 TTL=52 ID=25861 PROTO=UDP SPT=520 DPT=1022 LEN=512 
Jul 27 21:00:46 SRC=140.124.13.25 LEN=532 TOS=0x10 PREC=0x00 TTL=41 ID=6378 PROTO=UDP SPT=520 DPT=10423 LEN=512 
Jul 27 21:00:46 SRC=128.218.178.83 LEN=532 TOS=0x10 PREC=0x00 TTL=238 ID=8497 DF PROTO=UDP SPT=520 DPT=33894 LEN=512 
Jul 27 21:00:46 SRC=128.114.125.191 LEN=532 TOS=0x10 PREC=0x00 TTL=47 ID=23345 PROTO=UDP SPT=520 DPT=62105 LEN=512 
Jul 27 21:00:46 SRC=128.114.125.192 LEN=532 TOS=0x10 PREC=0x00 TTL=47 ID=34076 PROTO=UDP SPT=520 DPT=60841 LEN=512 
Jul 27 21:00:46 SRC=131.236.201.253 LEN=532 TOS=0x10 PREC=0x00 TTL=236 ID=18904 PROTO=UDP SPT=520 DPT=23599 LEN=512 
Jul 27 21:00:46 SRC=125.206.198.58 LEN=532 TOS=0x10 PREC=0x00 TTL=235 ID=47191 DF PROTO=UDP SPT=520 DPT=45438 LEN=512 
Jul 27 21:00:46 SRC=206.135.12.194 LEN=532 TOS=0x10 PREC=0x00 TTL=242 ID=24090 PROTO=UDP SPT=520 DPT=61443 LEN=512 
Jul 27 21:00:46 SRC=164.106.185.190 LEN=532 TOS=0x10 PREC=0x00 TTL=46 ID=19518 PROTO=UDP SPT=520 DPT=11386 LEN=512 
Jul 27 21:00:46 SRC=160.193.3.18 LEN=532 TOS=0x10 PREC=0x00 TTL=45 ID=5226 PROTO=UDP SPT=520 DPT=47058 LEN=512 
Jul 27 21:00:46 SRC=140.164.14.97 LEN=532 TOS=0x10 PREC=0x00 TTL=240 ID=57907 PROTO=UDP SPT=520 DPT=8552 LEN=512 
Jul 27 21:00:46 SRC=123.129.207.70 LEN=532 TOS=0x10 PREC=0x00 TTL=44 ID=45459 DF PROTO=UDP SPT=520 DPT=5196 LEN=512 
Jul 27 21:00:46 SRC=115.168.24.207 LEN=532 TOS=0x10 PREC=0x00 TTL=235 ID=46909 DF PROTO=UDP SPT=520 DPT=54888 LEN=512 
Jul 27 21:00:46 SRC=128.97.23.70 LEN=532 TOS=0x10 PREC=0x00 TTL=43 ID=28488 PROTO=UDP SPT=520 DPT=472 LEN=512 
Jul 27 21:00:46 SRC=115.168.24.208 LEN=532 TOS=0x10 PREC=0x00 TTL=235 ID=54883 DF PROTO=UDP SPT=520 DPT=28922 LEN=512 
Jul 27 21:00:47 SRC=129.81.139.21 LEN=532 TOS=0x10 PREC=0x00 TTL=47 ID=17253 PROTO=UDP SPT=520 DPT=34393 LEN=512 
Jul 27 21:00:47 SRC=140.124.13.24 LEN=532 TOS=0x10 PREC=0x00 TTL=41 ID=47629 PROTO=UDP SPT=520 DPT=1143 LEN=512 
Jul 27 21:00:47 SRC=140.124.13.13 LEN=532 TOS=0x10 PREC=0x00 TTL=41 ID=4350 PROTO=UDP SPT=520 DPT=218 LEN=512 
Jul 27 21:00:47 SRC=140.124.13.14 LEN=532 TOS=0x10 PREC=0x00 TTL=41 ID=8914 PROTO=UDP SPT=520 DPT=34976 LEN=512 
Jul 27 21:00:47 SRC=140.123.4.63 LEN=532 TOS=0x10 PREC=0x00 TTL=43 ID=9790 PROTO=UDP SPT=520 DPT=5382 LEN=512 
Jul 27 21:00:47 SRC=140.123.2.166 LEN=532 TOS=0x10 PREC=0x00 TTL=234 ID=61615 DF PROTO=UDP SPT=520 DPT=14217 LEN=512 
Jul 27 21:00:47 SRC=140.121.91.232 LEN=532 TOS=0x10 PREC=0x00 TTL=42 ID=2778 PROTO=UDP SPT=520 DPT=55764 LEN=512 
Jul 27 21:00:47 SRC=140.116.2.243 LEN=532 TOS=0x10 PREC=0x00 TTL=42 ID=54842 PROTO=UDP SPT=520 DPT=26835 LEN=512 
Jul 27 21:00:47 SRC=140.116.2.244 LEN=532 TOS=0x10 PREC=0x00 TTL=42 ID=58426 PROTO=UDP SPT=520 DPT=29158 LEN=512 
Jul 27 21:00:47 SRC=130.132.195.221 LEN=532 TOS=0x10 PREC=0x00 TTL=51 ID=8343 PROTO=UDP SPT=520 DPT=54737 LEN=512 
Jul 27 21:00:47 SRC=130.132.195.220 LEN=532 TOS=0x10 PREC=0x00 TTL=51 ID=23979 PROTO=UDP SPT=520 DPT=31741 LEN=512 
Jul 27 21:00:47 SRC=130.237.234.216 LEN=532 TOS=0x10 PREC=0x00 TTL=242 ID=43942 PROTO=UDP SPT=520 DPT=28796 LEN=512 
Jul 27 21:00:47 SRC=163.13.243.8 LEN=532 TOS=0x10 PREC=0x00 TTL=41 ID=62450 PROTO=UDP SPT=520 DPT=60882 LEN=512 
Jul 27 21:00:47 SRC=140.123.66.9 LEN=532 TOS=0x10 PREC=0x00 TTL=233 ID=65319 DF PROTO=UDP SPT=520 DPT=2062 LEN=512 
Jul 27 21:00:47 SRC=140.123.188.15 LEN=532 TOS=0x10 PREC=0x00 TTL=42 ID=16702 PROTO=UDP SPT=520 DPT=4027 LEN=512 
Jul 27 21:00:48 SRC=128.223.142.85 LEN=532 TOS=0x10 PREC=0x00 TTL=52 ID=13864 PROTO=UDP SPT=520 DPT=12998 LEN=512 
Jul 27 21:00:48 SRC=128.114.150.56 LEN=532 TOS=0x10 PREC=0x00 TTL=44 ID=39331 PROTO=UDP SPT=520 DPT=64516 LEN=512 
Jul 27 21:00:48 SRC=131.212.97.1 LEN=532 TOS=0x10 PREC=0x00 TTL=236 ID=64424 DF PROTO=UDP SPT=520 DPT=28707 LEN=512 
Jul 27 21:00:49 SRC=128.83.121.19 LEN=532 TOS=0x10 PREC=0x00 TTL=44 ID=55974 PROTO=UDP SPT=520 DPT=35170 LEN=512 
Jul 27 21:00:49 SRC=150.135.109.100 LEN=532 TOS=0x10 PREC=0x00 TTL=240 ID=1788 PROTO=UDP SPT=520 DPT=19342 LEN=512 
Jul 27 21:00:52 SRC=169.237.218.3 LEN=532 TOS=0x10 PREC=0x00 TTL=43 ID=49486 PROTO=UDP SPT=520 DPT=16415 LEN=512 
Jul 27 21:00:55 SRC=204.50.53.98 LEN=152 TOS=0x10 PREC=0x00 TTL=180 ID=11072 PROTO=UDP SPT=520 DPT=7 LEN=132 
Jul 27 21:00:58 SRC=130.70.132.229 LEN=352 TOS=0x10 PREC=0x00 TTL=243 ID=61260 DF PROTO=UDP SPT=520 DPT=512 LEN=332 
Jul 27 21:00:58 SRC=150.19.34.4 LEN=532 TOS=0x10 PREC=0x00 TTL=36 ID=25135 PROTO=UDP SPT=520 DPT=7433 LEN=512 
Jul 27 21:01:00 SRC=169.237.218.18 LEN=532 TOS=0x10 PREC=0x00 TTL=43 ID=62929 PROTO=UDP SPT=520 DPT=34003 LEN=512 
Jul 27 21:01:04 SRC=131.220.43.95 LEN=532 TOS=0x10 PREC=0x00 TTL=54 ID=23385 PROTO=UDP SPT=520 DPT=47146 LEN=512 
Jul 27 21:01:05 SRC=134.102.201.6 LEN=532 TOS=0x10 PREC=0x00 TTL=247 ID=10385 DF PROTO=UDP SPT=520 DPT=35680 LEN=512 
Jul 27 21:01:05 SRC=188.93.146.100 LEN=532 TOS=0x10 PREC=0x00 TTL=58 ID=1768 PROTO=UDP SPT=520 DPT=11352 LEN=512 
Jul 27 21:01:06 SRC=62.240.190.252 LEN=532 TOS=0x10 PREC=0x00 TTL=55 ID=62501 PROTO=UDP SPT=520 DPT=39199 LEN=512 
Jul 27 21:01:07 SRC=202.143.142.6 LEN=532 TOS=0x10 PREC=0x00 TTL=45 ID=28436 PROTO=UDP SPT=520 DPT=7117 LEN=512 
Jul 27 21:01:09 SRC=219.136.253.34 LEN=532 TOS=0x10 PREC=0x00 TTL=43 ID=33819 DF PROTO=UDP SPT=520 DPT=19912 LEN=512 
Jul 27 21:01:12 SRC=211.5.189.10 LEN=532 TOS=0x10 PREC=0x00 TTL=48 ID=28979 PROTO=UDP SPT=520 DPT=512 LEN=512 
Jul 27 21:01:13 SRC=92.50.194.94 LEN=212 TOS=0x10 PREC=0x00 TTL=59 ID=47207 PROTO=UDP SPT=520 DPT=19 LEN=192 
Jul 27 21:01:17 SRC=203.48.155.2 LEN=212 TOS=0x10 PREC=0x00 TTL=105 ID=20600 PROTO=UDP SPT=520 DPT=640 LEN=192 
Jul 27 21:01:20 SRC=194.81.39.249 LEN=172 TOS=0x10 PREC=0x00 TTL=116 ID=37494 PROTO=UDP SPT=520 DPT=666 LEN=152 
Jul 27 21:01:27 SRC=163.143.1.21 LEN=212 TOS=0x10 PREC=0x00 TTL=44 ID=23458 PROTO=UDP SPT=520 DPT=17 LEN=192 
Jul 27 21:01:28 SRC=72.237.89.101 LEN=252 TOS=0x10 PREC=0x00 TTL=111 ID=40221 PROTO=UDP SPT=520 DPT=666 LEN=232 
Jul 27 21:01:34 SRC=139.82.183.60 LEN=212 TOS=0x10 PREC=0x00 TTL=236 ID=0 DF PROTO=UDP SPT=520 DPT=119 LEN=192 
Jul 27 21:01:38 SRC=216.166.34.238 LEN=192 TOS=0x10 PREC=0x00 TTL=233 ID=2958 DF PROTO=UDP SPT=520 DPT=119 LEN=172 
Jul 27 21:01:45 SRC=161.246.1.1 LEN=192 TOS=0x10 PREC=0x00 TTL=241 ID=54242 PROTO=UDP SPT=520 DPT=11 LEN=172 
Jul 27 21:01:54 SRC=92.50.194.94 LEN=532 TOS=0x10 PREC=0x00 TTL=59 ID=1439 PROTO=UDP SPT=520 DPT=35594 LEN=512 
Jul 27 21:01:54 SRC=132.206.9.29 LEN=532 TOS=0x10 PREC=0x00 TTL=42 ID=54819 PROTO=UDP SPT=520 DPT=45331 LEN=512 
Jul 27 21:02:01 SRC=67.17.159.182 LEN=212 TOS=0x10 PREC=0x00 TTL=54 ID=0 DF PROTO=UDP SPT=520 DPT=518 LEN=192 
Jul 27 21:02:13 SRC=145.253.98.100 LEN=172 TOS=0x10 PREC=0x00 TTL=119 ID=58738 PROTO=UDP SPT=520 DPT=666 LEN=152 
Jul 27 21:02:36 SRC=89.187.1.236 LEN=72 TOS=0x10 PREC=0x00 TTL=57 ID=27640 PROTO=UDP SPT=520 DPT=119 LEN=52 
Jul 27 21:02:52 SRC=178.250.31.231 LEN=472 TOS=0x10 PREC=0x00 TTL=248 ID=28577 PROTO=UDP SPT=520 DPT=17 LEN=452 
Jul 27 21:02:55 SRC=165.194.95.121 LEN=532 TOS=0x10 PREC=0x00 TTL=49 ID=14924 PROTO=UDP SPT=520 DPT=24307 LEN=512 
Jul 27 21:03:16 SRC=209.249.65.57 LEN=132 TOS=0x10 PREC=0x00 TTL=243 ID=54621 PROTO=UDP SPT=520 DPT=517 LEN=112 
Jul 27 21:03:30 SRC=165.194.95.122 LEN=532 TOS=0x10 PREC=0x00 TTL=49 ID=29859 PROTO=UDP SPT=520 DPT=39640 LEN=512 
Jul 27 21:03:35 SRC=134.102.200.3 LEN=532 TOS=0x10 PREC=0x00 TTL=247 ID=51975 DF PROTO=UDP SPT=520 DPT=22475 LEN=512 
Jul 27 21:03:46 SRC=213.25.92.118 LEN=172 TOS=0x10 PREC=0x00 TTL=117 ID=64388 PROTO=UDP SPT=520 DPT=79 LEN=152 
Jul 27 21:03:48 SRC=140.118.31.93 LEN=532 TOS=0x10 PREC=0x00 TTL=41 ID=14416 PROTO=UDP SPT=520 DPT=55186 LEN=512 
Jul 27 21:03:55 SRC=137.99.46.30 LEN=532 TOS=0x10 PREC=0x00 TTL=42 ID=15222 PROTO=UDP SPT=520 DPT=119 LEN=512 
Jul 27 21:03:58 SRC=130.243.57.139 LEN=532 TOS=0x10 PREC=0x00 TTL=241 ID=65455 DF PROTO=UDP SPT=520 DPT=57128 LEN=512 
Jul 27 21:03:59 SRC=165.194.95.121 LEN=532 TOS=0x10 PREC=0x00 TTL=49 ID=44641 PROTO=UDP SPT=520 DPT=46944 LEN=512 
Jul 27 21:03:59 SRC=98.19.102.53 LEN=112 TOS=0x10 PREC=0x00 TTL=48 ID=0 DF PROTO=UDP SPT=520 DPT=70 LEN=92 
Jul 27 21:04:07 SRC=130.156.100.23 LEN=532 TOS=0x10 PREC=0x00 TTL=243 ID=22217 DF PROTO=UDP SPT=520 DPT=48603 LEN=512 
Jul 27 21:04:35 SRC=134.102.201.6 LEN=532 TOS=0x10 PREC=0x00 TTL=247 ID=51501 DF PROTO=UDP SPT=520 DPT=9637 LEN=512 
Jul 27 21:04:36 SRC=134.102.200.9 LEN=532 TOS=0x10 PREC=0x00 TTL=247 ID=58431 DF PROTO=UDP SPT=520 DPT=52497 LEN=512 
Jul 27 21:04:45 SRC=61.239.248.4 LEN=532 TOS=0x10 PREC=0x00 TTL=53 ID=0 DF PROTO=UDP SPT=520 DPT=10582 LEN=512 
Jul 27 21:06:05 SRC=61.239.248.4 LEN=532 TOS=0x10 PREC=0x00 TTL=53 ID=0 DF PROTO=UDP SPT=520 DPT=31209 LEN=512

È successo: fastweb + ip bogon (5.0.0.0/8) = EPIC FAIL

EvolutionCrazy — Fri, 18 May 2012 00:24:18 +0000

http://www.hostingtalk.it/forum/server-dedicati-colocation-connettivita-e-scelta-data-center/25527-hetzner-fastweb.html

http://www.webhostingtalk.com/showthread.php?p=8130717#post8130717

AHAHAHAHAH

EDIT: per una spiegazione più completa:
http://blog.grg-web.eu/2012/05/rfc-ignorate-la-fine-del-mondo-inizia-con-fastweb/