[
{
"path": "LICENSE",
"content": "MIT License\n\nCopyright (c) 2019 Cybersecurity Ops with bash\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n"
},
{
"path": "ch03/echoparams.sh",
"content": "#!/bin/bash -\n#\n# Cybersecurity Ops with bash\n# echoparams.sh\n#\n# Description: \n# Demonstrates accessing parameters in bash\n#\n# Usage:\n# ./echoparms.sh \n#\n\necho $#\necho $0\necho $1\necho $2\necho $3\n"
},
{
"path": "ch03/osdetect.sh",
"content": "#!/bin/bash -\n#\n# Cybersecurity Ops with bash\n# osdetect.sh\n#\n# Description: \n# Distinguish between MS-Windows/Linux/MacOS\n#\n# Usage: bash osdetect.sh\n# output will be one of: Linux MSWin macOS\n#\n\nif type -t wevtutil &> /dev/null # <1>\nthen\n OS=MSWin\nelif type -t scutil &> /dev/null # <2>\nthen\n OS=macOS\nelse\n OS=Linux\nfi\necho $OS\n"
},
{
"path": "ch04/frost.txt",
"content": "1 Two roads diverged in a yellow wood,\n2 And sorry I could not travel both\n3 And be one traveler, long I stood\n4 And looked down one as far as I could\n5 To where it bent in the undergrowth;\n6\n7 Excerpt from The Road Not Taken by Robert Frost\n"
},
{
"path": "ch05/cmds.txt",
"content": "#Linux Command |MSWin Bash |XML tag |Purpose\n#----------------+------------+-----------+------------------------------\nuname -a |uname -a |uname |O.S. version etc\ncat /proc/cpuinfo|systeminfo |sysinfo |system hardware and related info\nifconfig |ipconfig |nwinterface|Network interface information\nip route |route print |nwroute |routing table\narp -a |arp -a |nwarp |ARP table\nnetstat -a |netstat -a |netstat |network connections\nmount |net share |diskinfo |mounted disks\nps -e |tasklist |processes |running processes\n"
},
{
"path": "ch05/cutfile.txt",
"content": "12/05/2017 192.168.10.14 test.html\n12/30/2017 192.168.10.185 login.html\n"
},
{
"path": "ch05/getlocal.sh",
"content": "#!/bin/bash -\n#\n# Cybersecurity Ops with bash\n# getlocal.sh\n#\n# Description: \n# Gathers general system information and dumps it to a file\n#\n# Usage:\n# bash getlocal.sh < cmds.txt\n# cmds.txt is a file with list of commands to run\n#\n\n# SepCmds - separate the commands from the line of input\nfunction SepCmds()\n{\n LCMD=${ALINE%%|*} # <11>\n REST=${ALINE#*|} # <12>\n WCMD=${REST%%|*} # <13>\n REST=${REST#*|}\n TAG=${REST%%|*} # <14>\n \n if [[ $OSTYPE == \"MSWin\" ]]\n then\n CMD=\"$WCMD\"\n else\n CMD=\"$LCMD\"\n fi\n}\n\nfunction DumpInfo ()\n{ # <5>\n printf '\\n' \"$(date '+%F')\" \"$(date '+%T')\"\n readarray CMDS # <6>\n for ALINE in \"${CMDS[@]}\" # <7>\n do\n # ignore comments\n if [[ ${ALINE:0:1} == '#' ]] ; then continue ; fi # <8>\n\n SepCmds\n\n if [[ ${CMD:0:3} == N/A ]] # <9>\n then\n continue\n else\n printf \"<%s>\\n\" $TAG # <10>\n $CMD\n printf \"\\n\" $TAG\n fi\n done\n printf \"\\n\"\n} \n\nOSTYPE=$(./osdetect.sh) # <1>\nHOSTNM=$(hostname) # <2>\nTMPFILE=\"${HOSTNM}.info\" # <3>\n\n# gather the info into the tmp file; errors, too\nDumpInfo > $TMPFILE 2>&1 # <4>\n\n"
},
{
"path": "ch05/hashsearch.sh",
"content": "#!/bin/bash -\n#\n# Cybersecurity Ops with bash\n# hashsearch.sh\n#\n# Description: \n# Recursively search a given directory for a file that\n# matches a given SHA-1 hash\n#\n# Usage:\n# hashsearch.sh \n# hash - SHA-1 hash value to file to find\n# directory - Top directory to start search\n#\n\nHASH=$1\nDIR=${2:-.}\t# default is here, cwd\n\n# convert pathname into an absolute path\nfunction mkabspath ()\t\t\t\t# <6>\n{\n if [[ $1 == /* ]]\t\t\t\t# <7>\n then\n \tABS=$1\n else\n \tABS=\"$PWD/$1\"\t\t\t\t# <8>\n fi\n}\n\nfind $DIR -type f |\t\t\t\t# <1>\nwhile read fn\ndo\n THISONE=$(sha1sum \"$fn\")\t\t\t# <2>\n THISONE=${THISONE%% *}\t\t\t# <3>\n if [[ $THISONE == $HASH ]]\n then\n\tmkabspath \"$fn\"\t\t\t\t# <4>\n\techo $ABS\t\t\t\t# <5>\n fi\ndone\n"
},
{
"path": "ch05/typesearch.sh",
"content": "#!/bin/bash -\n#\n# Cybersecurity Ops with bash\n# typesearch.sh\n#\n# Description: \n# Search the file system for a given file type. It prints out the\n# pathname when found.\n#\n# Usage:\n# typesearch.sh [-c dir] [-i] [-R|r] \n# -c Copy files found to dir\n# -i Ignore case\n# -R|r Recursively search subdirectories\n# File type pattern to search for\n# Path to start search\n#\n\nDEEPORNOT=\"-maxdepth 1\"\t\t# just the current dir; default\n\n# PARSE option arguments:\nwhile getopts 'c:irR' opt; do # <1>\n case \"${opt}\" in # <2>\n c) # copy found files to specified directory\n\t COPY=YES\n\t DESTDIR=\"$OPTARG\" # <3>\n\t ;;\n i) # ignore u/l case differences in search\n\t CASEMATCH='-i'\n\t ;;\n [Rr]) # recursive # <4>\n unset DEEPORNOT;; # <5>\n *) # unknown/unsupported option # <6>\n # error mesg will come from getopts, so just exit\n exit 2 ;;\n esac\ndone\nshift $((OPTIND - 1)) # <7>\n\n\nPATTERN=${1:-PDF document} # <8>\nSTARTDIR=${2:-.}\t# by default start here\n\nfind $STARTDIR $DEEPORNOT -type f | while read FN # <9>\ndo\n file $FN | egrep -q $CASEMATCH \"$PATTERN\" # <10>\n if (( $? == 0 )) # found one # <11>\n then\n\t echo $FN\n\t if [[ $COPY ]] # <12>\n\t then\n\t cp -p $FN $DESTDIR # <13>\n\t fi\n fi\ndone\n\n"
},
{
"path": "ch05/winlogs.sh",
"content": "#!/bin/bash -\n#\n# Cybersecurity Ops with bash\n# winlogs.sh\n#\n# Description: \n# Gather copies of Windows log files\n#\n# Usage:\n# winlogs.sh [-z] [dir]\n# -z Tar and zip the output\n# dir Optional scratch directory for holding the log files\n\nTGZ=0\nif (( $# > 0 ))\t\t\t\t\t\t# <1>\nthen\n if [[ ${1:0:2} == '-z' ]]\t\t\t\t# <2>\n then\n\tTGZ=1\t# tgz flag to tar/zip the log files\n\tshift\n fi\nfi\nSYSNAM=$(hostname)\nLOGDIR=${1:-/tmp/${SYSNAM}_logs}\t\t\t# <3>\n\nmkdir -p $LOGDIR\t\t\t\t\t# <4>\ncd ${LOGDIR} || exit -2\n\nwevtutil el | while read ALOG\t\t\t\t# <5>\ndo\n ALOG=\"${ALOG%$'\\r'}\"\t\t\t\t# <6>\n echo \"${ALOG}:\"\t\t\t\t\t# <7>\n SAFNAM=\"${ALOG// /_}\"\t\t\t\t# <8>\n SAFNAM=\"${SAFNAM//\\//-}\"\n wevtutil epl \"$ALOG\" \"${SYSNAM}_${SAFNAM}.evtx\"\ndone\n\nif (( TGZ == 1 ))\t\t\t\t\t# <9>\nthen\n tar -czvf ${SYSNAM}_logs.tgz *.evtx\t\t\t# <10>\nfi\n"
},
{
"path": "ch06/accesstime.txt",
"content": "0745,file1.txt,1\n0830,file4.txt,2\n0830,file5.txt,3\n"
},
{
"path": "ch06/awkusers.txt",
"content": "Mike Jones\nJohn Smith\nKathy Jones\nJane Kennedy\nTim Scott\n"
},
{
"path": "ch06/book.json",
"content": "{ <1>\n \"title\": \"Cybersecurity Ops with bash\", <2>\n \"edition\": 1,\n \"authors\": [ <3>\n {\n \"firstName\": \"Paul\",\n \"lastName\": \"Troncone\"\n },\n {\n \"firstName\": \"Carl\",\n \"lastName\": \"Albing\"\n }\n ]\n}\n"
},
{
"path": "ch06/book.xml",
"content": " <1>\n <2>\n Paul <3>\n Troncone\n <4>\n \n Carl\n Albing\n \n\n"
},
{
"path": "ch06/csvex.txt",
"content": "\"name\",\"username\",\"phone\",\"password hash\"\n\"John Smith\",\"jsmith\",\"555-555-1212\",5f4dcc3b5aa765d61d8327deb882cf99\n\"Jane Smith\",\"jnsmith\",\"555-555-1234\",e10adc3949ba59abbe56e057f20f883e\n\"Bill Jones\",\"bjones\",\"555-555-6789\",d8578edf8458ce06fbc5bb76a58c5ca4"
},
{
"path": "ch06/ips.txt",
"content": "ip,OS\n10.0.4.2,Windows 8\n10.0.4.35,Ubuntu 16\n10.0.4.107,macOS\n10.0.4.145,macOS\n"
},
{
"path": "ch06/passwords.txt",
"content": "password,md5hash\n123456,e10adc3949ba59abbe56e057f20f883e\npassword,5f4dcc3b5aa765d61d8327deb882cf99\nwelcome,40be4e59b9a2a2b5dffb918c0e86b3d7\nninja,3899dcbab79f92af727c2190bbd8abc5\nabc123,e99a18c428cb38d5f260853678922e03\n123456789,25f9e794323b453885f5181f1b624d0b\n12345678,25d55ad283aa400af464c76d713c07ad\nsunshine,0571749e2ac330a7455809c6b0e7af90\nprincess,8afa847f50a716e64932d995c8e7435a\nqwerty,d8578edf8458ce06fbc5bb76a58c5c"
},
{
"path": "ch06/procowner.txt",
"content": "Process Owner;PID\njdoe;0\ntjones;4\njsmith;340\nmsmith;528\n"
},
{
"path": "ch06/tasks.txt",
"content": "\nImage Name;PID;Session Name;Session#;Mem Usage\nSystem Idle Process;0;Services;0;4 K\nSystem;4;Services;0;2,140 K\nsmss.exe;340;Services;0;1,060 K\ncsrss.exe;528;Services;0;4,756 K\n"
},
{
"path": "ch06/user.txt",
"content": "user,ip\njdoe,10.0.4.2\njsmith,10.0.4.35\nmsmith,10.0.4.107\ntjones,10.0.4.145\n"
},
{
"path": "ch06/usernames.txt",
"content": "1,jdoe\n2,puser\n3,jsmith\n"
},
{
"path": "ch07/access.log",
"content": "192.168.0.37 - - [12/Nov/2017:15:52:59 -0500] \"GET / HTTP/1.1\" 200 2377 \"-\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:15:52:59 -0500] \"GET /backblue.gif HTTP/1.1\" 200 4529 \"http://192.168.0.35/\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:15:52:59 -0500] \"GET /fade.gif HTTP/1.1\" 200 1112 \"http://192.168.0.35/\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:15:52:59 -0500] \"GET /favicon.ico HTTP/1.1\" 404 503 \"-\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:15:52:59 -0500] \"GET /index.html HTTP/1.1\" 200 6933 \"-\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:15:52:59 -0500] \"GET /favicon.ico HTTP/1.1\" 404 504 \"-\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:15:52:59 -0500] \"GET /files/main_styleaf0e.css?1509483497 HTTP/1.1\" 200 5022 \"http://192.168.0.35/index.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:15:52:59 -0500] \"GET /files/theme/mobile49c2.js?1490908488 HTTP/1.1\" 200 3413 \"http://192.168.0.35/index.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:15:52:59 -0500] \"GET /files/theme/custom49c2.js?1490908488 HTTP/1.1\" 200 1429 \"http://192.168.0.35/index.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:15:52:59 -0500] \"GET /files/theme/plugin49c2.js?1490908488 HTTP/1.1\" 200 19444 \"http://192.168.0.35/index.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:15:53:00 -0500] \"GET /uploads/2/9/1/4/29147191/941880.png HTTP/1.1\" 200 7835 \"http://192.168.0.35/index.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:15:53:00 -0500] \"GET /uploads/2/9/1/4/29147191/31549414299.png?457 HTTP/1.1\" 200 81377 \"http://192.168.0.35/index.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:15:53:00 -0500] \"GET /uploads/2/9/1/4/29147191/2670902_orig.jpg HTTP/1.1\" 200 19526 \"http://192.168.0.35/index.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:15:53:00 -0500] \"GET /uploads/2/9/1/4/29147191/2267842_orig.jpg HTTP/1.1\" 200 42818 \"http://192.168.0.35/index.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:15:53:00 -0500] \"GET /uploads/2/9/1/4/29147191/2992005_orig.jpg HTTP/1.1\" 200 47030 \"http://192.168.0.35/index.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:15:53:11 -0500] \"GET /about.html HTTP/1.1\" 200 7042 \"http://192.168.0.35/index.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:15:53:11 -0500] \"GET /files/main_styleaf0e.css?1509483497 HTTP/1.1\" 200 5022 \"http://192.168.0.35/about.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:15:53:11 -0500] \"GET /files/theme/mobile49c2.js?1490908488 HTTP/1.1\" 200 3414 \"http://192.168.0.35/about.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:15:53:11 -0500] \"GET /files/theme/custom49c2.js?1490908488 HTTP/1.1\" 200 1430 \"http://192.168.0.35/about.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:15:53:11 -0500] \"GET /uploads/2/9/1/4/29147191/page-layouts-4078890_orig.jpg HTTP/1.1\" 200 265418 \"http://192.168.0.35/about.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:15:53:11 -0500] \"GET /files/theme/plugin49c2.js?1490908488 HTTP/1.1\" 200 19445 \"http://192.168.0.35/about.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:15:53:11 -0500] \"GET /_/cdn2.editmysite.com/images/editor/theme-background/stock/GW-bridge.html HTTP/1.1\" 200 5011 \"http://192.168.0.35/about.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:15:54:10 -0500] \"GET /consulting.html HTTP/1.1\" 200 7269 \"http://192.168.0.35/about.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:15:54:10 -0500] \"GET /files/main_styleaf0e.css?1509483497 HTTP/1.1\" 200 5022 \"http://192.168.0.35/consulting.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:15:54:10 -0500] \"GET /files/theme/custom49c2.js?1490908488 HTTP/1.1\" 200 1430 \"http://192.168.0.35/consulting.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:15:54:10 -0500] \"GET /files/theme/mobile49c2.js?1490908488 HTTP/1.1\" 200 3414 \"http://192.168.0.35/consulting.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:15:54:10 -0500] \"GET /uploads/2/9/1/4/29147191/398980_orig.png HTTP/1.1\" 200 120188 \"http://192.168.0.35/consulting.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:15:54:10 -0500] \"GET /files/theme/plugin49c2.js?1490908488 HTTP/1.1\" 200 19445 \"http://192.168.0.35/consulting.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:15:54:11 -0500] \"GET /_/cdn2.editmysite.com/images/editor/theme-background/stock/Colaboration.html HTTP/1.1\" 200 5011 \"http://192.168.0.35/consulting.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.11 - - [12/Nov/2017:15:54:26 -0500] \"GET / HTTP/1.1\" 200 2377 \"-\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.11 - - [12/Nov/2017:15:54:26 -0500] \"GET /backblue.gif HTTP/1.1\" 200 4529 \"http://192.168.0.35/\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.11 - - [12/Nov/2017:15:54:26 -0500] \"GET /fade.gif HTTP/1.1\" 200 1113 \"http://192.168.0.35/\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.11 - - [12/Nov/2017:15:54:26 -0500] \"GET /favicon.ico HTTP/1.1\" 404 503 \"-\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.11 - - [12/Nov/2017:15:54:26 -0500] \"GET /index.html HTTP/1.1\" 200 6932 \"-\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.11 - - [12/Nov/2017:15:54:26 -0500] \"GET /files/main_styleaf0e.css?1509483497 HTTP/1.1\" 200 5022 \"http://192.168.0.35/index.html\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.11 - - [12/Nov/2017:15:54:26 -0500] \"GET /files/theme/mobile49c2.js?1490908488 HTTP/1.1\" 200 3414 \"http://192.168.0.35/index.html\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.11 - - [12/Nov/2017:15:54:26 -0500] \"GET /files/theme/custom49c2.js?1490908488 HTTP/1.1\" 200 1430 \"http://192.168.0.35/index.html\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.11 - - [12/Nov/2017:15:54:26 -0500] \"GET /files/theme/plugin49c2.js?1490908488 HTTP/1.1\" 200 19444 \"http://192.168.0.35/index.html\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.11 - - [12/Nov/2017:15:54:26 -0500] \"GET /uploads/2/9/1/4/29147191/941880.png HTTP/1.1\" 200 7835 \"http://192.168.0.35/index.html\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.11 - - [12/Nov/2017:15:54:26 -0500] \"GET /uploads/2/9/1/4/29147191/31549414299.png?457 HTTP/1.1\" 200 81377 \"http://192.168.0.35/index.html\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.11 - - [12/Nov/2017:15:54:26 -0500] \"GET /uploads/2/9/1/4/29147191/2670902_orig.jpg HTTP/1.1\" 200 19525 \"http://192.168.0.35/index.html\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.11 - - [12/Nov/2017:15:54:26 -0500] \"GET /uploads/2/9/1/4/29147191/2992005_orig.jpg HTTP/1.1\" 200 47029 \"http://192.168.0.35/index.html\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.11 - - [12/Nov/2017:15:54:26 -0500] \"GET /uploads/2/9/1/4/29147191/2267842_orig.jpg HTTP/1.1\" 200 42819 \"http://192.168.0.35/index.html\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.11 - - [12/Nov/2017:15:54:30 -0500] \"GET /support.html HTTP/1.1\" 200 6207 \"http://192.168.0.35/index.html\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.11 - - [12/Nov/2017:15:54:30 -0500] \"GET /files/main_styleaf0e.css?1509483497 HTTP/1.1\" 200 5022 \"http://192.168.0.35/support.html\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.11 - - [12/Nov/2017:15:54:31 -0500] \"GET /_/cdn2.editmysite.com/images/editor/theme-background/stock/Working2.html HTTP/1.1\" 200 5011 \"http://192.168.0.35/support.html\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.11 - - [12/Nov/2017:15:54:39 -0500] \"GET /request-quote.html HTTP/1.1\" 200 7326 \"http://192.168.0.35/support.html\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.11 - - [12/Nov/2017:15:54:39 -0500] \"GET /files/main_styleaf0e.css?1509483497 HTTP/1.1\" 200 5022 \"http://192.168.0.35/request-quote.html\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.11 - - [12/Nov/2017:15:54:39 -0500] \"GET /_/cdn2.editmysite.com/images/editor/theme-background/stock/Colaboration.html HTTP/1.1\" 200 5011 \"http://192.168.0.35/request-quote.html\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.11 - - [12/Nov/2017:15:54:39 -0500] \"GET /files/theme/images/select-arrowaf0e.png?1509483497 HTTP/1.1\" 200 1386 \"http://192.168.0.35/files/main_styleaf0e.css?1509483497\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.37 - - [12/Nov/2017:15:56:52 -0500] \"GET /products.html HTTP/1.1\" 200 7158 \"http://192.168.0.35/consulting.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:15:56:52 -0500] \"GET /files/main_styleaf0e.css?1509483497 HTTP/1.1\" 200 5022 \"http://192.168.0.35/products.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:15:56:52 -0500] \"GET /uploads/2/9/1/4/29147191/253922682aa.png?162 HTTP/1.1\" 200 16602 \"http://192.168.0.35/products.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:15:56:52 -0500] \"GET /uploads/2/9/1/4/29147191/99480889766.png?165 HTTP/1.1\" 200 26428 \"http://192.168.0.35/products.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:15:56:52 -0500] \"GET /uploads/2/9/1/4/29147191/32981bd4c.png?161 HTTP/1.1\" 200 38062 \"http://192.168.0.35/products.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:15:56:52 -0500] \"GET /files/theme/mobile49c2.js?1490908488 HTTP/1.1\" 200 3414 \"http://192.168.0.35/products.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:15:56:52 -0500] \"GET /files/theme/custom49c2.js?1490908488 HTTP/1.1\" 200 1430 \"http://192.168.0.35/products.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:15:56:52 -0500] \"GET /files/theme/plugin49c2.js?1490908488 HTTP/1.1\" 200 19445 \"http://192.168.0.35/products.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:15:56:53 -0500] \"GET /_/cdn2.editmysite.com/images/editor/theme-background/stock/Working2.html HTTP/1.1\" 200 5011 \"http://192.168.0.35/products.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.11 - - [12/Nov/2017:15:57:10 -0500] \"GET /resources.html HTTP/1.1\" 200 7569 \"http://192.168.0.35/request-quote.html\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.11 - - [12/Nov/2017:15:57:10 -0500] \"GET /files/main_styleaf0e.css?1509483497 HTTP/1.1\" 200 5022 \"http://192.168.0.35/resources.html\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.11 - - [12/Nov/2017:15:57:10 -0500] \"GET /uploads/2/9/1/4/29147191/identity_orig.png HTTP/1.1\" 200 47804 \"http://192.168.0.35/resources.html\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.11 - - [12/Nov/2017:15:57:10 -0500] \"GET /uploads/2/9/1/4/29147191/editor/078519-blue-jelly-icon-business-envelope5ca13.png?1492225862 HTTP/1.1\" 200 7769 \"http://192.168.0.35/resources.html\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.11 - - [12/Nov/2017:15:57:10 -0500] \"GET /uploads/2/9/1/4/29147191/428026.png HTTP/1.1\" 200 20174 \"http://192.168.0.35/resources.html\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.11 - - [12/Nov/2017:15:57:10 -0500] \"GET /uploads/2/9/1/4/29147191/principlesofcyber_orig.png HTTP/1.1\" 200 43725 \"http://192.168.0.35/resources.html\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.11 - - [12/Nov/2017:15:57:10 -0500] \"GET /uploads/2/9/1/4/29147191/principlesofencryption-nb_orig.png HTTP/1.1\" 200 45954 \"http://192.168.0.35/resources.html\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.11 - - [12/Nov/2017:15:57:10 -0500] \"GET /_/cdn2.editmysite.com/images/editor/theme-background/stock/Work-Outside.html HTTP/1.1\" 200 5011 \"http://192.168.0.35/resources.html\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.11 - - [12/Nov/2017:15:57:15 -0500] \"GET /uploads/2/9/1/4/29147191/protecting_your_identity.pdf HTTP/1.1\" 200 775340 \"http://192.168.0.35/resources.html\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.26 - - [12/Nov/2017:16:16:01 -0500] \"GET / HTTP/1.1\" 200 2377 \"-\" \"Mozilla/5.0 (iPad; CPU OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A372 Safari/604.1\"\n192.168.0.26 - - [12/Nov/2017:16:16:02 -0500] \"GET /backblue.gif HTTP/1.1\" 200 4529 \"http://192.168.0.35/\" \"Mozilla/5.0 (iPad; CPU OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A372 Safari/604.1\"\n192.168.0.26 - - [12/Nov/2017:16:16:02 -0500] \"GET /fade.gif HTTP/1.1\" 200 1113 \"http://192.168.0.35/\" \"Mozilla/5.0 (iPad; CPU OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A372 Safari/604.1\"\n192.168.0.26 - - [12/Nov/2017:16:16:02 -0500] \"GET /index.html HTTP/1.1\" 200 6932 \"http://192.168.0.35/\" \"Mozilla/5.0 (iPad; CPU OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A372 Safari/604.1\"\n192.168.0.26 - - [12/Nov/2017:16:16:02 -0500] \"GET /files/main_styleaf0e.css?1509483497 HTTP/1.1\" 200 5022 \"http://192.168.0.35/index.html\" \"Mozilla/5.0 (iPad; CPU OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A372 Safari/604.1\"\n192.168.0.26 - - [12/Nov/2017:16:16:02 -0500] \"GET /uploads/2/9/1/4/29147191/941880.png HTTP/1.1\" 200 7835 \"http://192.168.0.35/index.html\" \"Mozilla/5.0 (iPad; CPU OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A372 Safari/604.1\"\n192.168.0.26 - - [12/Nov/2017:16:16:02 -0500] \"GET /files/theme/plugin49c2.js?1490908488 HTTP/1.1\" 200 19444 \"http://192.168.0.35/index.html\" \"Mozilla/5.0 (iPad; CPU OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A372 Safari/604.1\"\n192.168.0.26 - - [12/Nov/2017:16:16:02 -0500] \"GET /uploads/2/9/1/4/29147191/31549414299.png?457 HTTP/1.1\" 200 81378 \"http://192.168.0.35/index.html\" \"Mozilla/5.0 (iPad; CPU OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A372 Safari/604.1\"\n192.168.0.26 - - [12/Nov/2017:16:16:02 -0500] \"GET /uploads/2/9/1/4/29147191/2670902_orig.jpg HTTP/1.1\" 200 19526 \"http://192.168.0.35/index.html\" \"Mozilla/5.0 (iPad; CPU OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A372 Safari/604.1\"\n192.168.0.26 - - [12/Nov/2017:16:16:02 -0500] \"GET /files/theme/mobile49c2.js?1490908488 HTTP/1.1\" 200 3413 \"http://192.168.0.35/index.html\" \"Mozilla/5.0 (iPad; CPU OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A372 Safari/604.1\"\n192.168.0.26 - - [12/Nov/2017:16:16:02 -0500] \"GET /files/theme/custom49c2.js?1490908488 HTTP/1.1\" 200 1429 \"http://192.168.0.35/index.html\" \"Mozilla/5.0 (iPad; CPU OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A372 Safari/604.1\"\n192.168.0.26 - - [12/Nov/2017:16:16:02 -0500] \"GET /uploads/2/9/1/4/29147191/2267842_orig.jpg HTTP/1.1\" 200 42818 \"http://192.168.0.35/index.html\" \"Mozilla/5.0 (iPad; CPU OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A372 Safari/604.1\"\n192.168.0.26 - - [12/Nov/2017:16:16:02 -0500] \"GET /uploads/2/9/1/4/29147191/2992005_orig.jpg HTTP/1.1\" 200 47029 \"http://192.168.0.35/index.html\" \"Mozilla/5.0 (iPad; CPU OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A372 Safari/604.1\"\n192.168.0.26 - - [12/Nov/2017:16:16:06 -0500] \"GET /products.html HTTP/1.1\" 200 7157 \"http://192.168.0.35/index.html\" \"Mozilla/5.0 (iPad; CPU OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A372 Safari/604.1\"\n192.168.0.26 - - [12/Nov/2017:16:16:07 -0500] \"GET /uploads/2/9/1/4/29147191/253922682aa.png?162 HTTP/1.1\" 200 16602 \"http://192.168.0.35/products.html\" \"Mozilla/5.0 (iPad; CPU OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A372 Safari/604.1\"\n192.168.0.26 - - [12/Nov/2017:16:16:07 -0500] \"GET /uploads/2/9/1/4/29147191/99480889766.png?165 HTTP/1.1\" 200 26427 \"http://192.168.0.35/products.html\" \"Mozilla/5.0 (iPad; CPU OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A372 Safari/604.1\"\n192.168.0.26 - - [12/Nov/2017:16:16:07 -0500] \"GET /uploads/2/9/1/4/29147191/32981bd4c.png?161 HTTP/1.1\" 200 38061 \"http://192.168.0.35/products.html\" \"Mozilla/5.0 (iPad; CPU OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A372 Safari/604.1\"\n192.168.0.26 - - [12/Nov/2017:16:16:07 -0500] \"GET /_/cdn2.editmysite.com/images/editor/theme-background/stock/Working2.html HTTP/1.1\" 200 5011 \"http://192.168.0.35/products.html\" \"Mozilla/5.0 (iPad; CPU OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A372 Safari/604.1\"\n192.168.0.26 - - [12/Nov/2017:16:16:16 -0500] \"GET /bcp.html HTTP/1.1\" 200 6651 \"http://192.168.0.35/products.html\" \"Mozilla/5.0 (iPad; CPU OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A372 Safari/604.1\"\n192.168.0.26 - - [12/Nov/2017:16:16:16 -0500] \"GET /uploads/2/9/1/4/29147191/601239_orig.png HTTP/1.1\" 200 111181 \"http://192.168.0.35/bcp.html\" \"Mozilla/5.0 (iPad; CPU OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A372 Safari/604.1\"\n192.168.0.26 - - [12/Nov/2017:16:16:16 -0500] \"GET /uploads/2/9/1/4/29147191/4304070_orig.png HTTP/1.1\" 200 57269 \"http://192.168.0.35/bcp.html\" \"Mozilla/5.0 (iPad; CPU OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A372 Safari/604.1\"\n192.168.0.26 - - [12/Nov/2017:16:16:16 -0500] \"GET /_/cdn2.editmysite.com/images/editor/theme-background/stock/Coffee.html HTTP/1.1\" 200 5011 \"http://192.168.0.35/bcp.html\" \"Mozilla/5.0 (iPad; CPU OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A372 Safari/604.1\"\n192.168.0.26 - - [12/Nov/2017:16:18:05 -0500] \"GET /consulting.html HTTP/1.1\" 200 7269 \"http://192.168.0.35/bcp.html\" \"Mozilla/5.0 (iPad; CPU OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A372 Safari/604.1\"\n192.168.0.26 - - [12/Nov/2017:16:18:06 -0500] \"GET /uploads/2/9/1/4/29147191/398980_orig.png HTTP/1.1\" 200 120188 \"http://192.168.0.35/consulting.html\" \"Mozilla/5.0 (iPad; CPU OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A372 Safari/604.1\"\n192.168.0.26 - - [12/Nov/2017:16:18:06 -0500] \"GET /_/cdn2.editmysite.com/images/editor/theme-background/stock/Colaboration.html HTTP/1.1\" 200 5012 \"http://192.168.0.35/consulting.html\" \"Mozilla/5.0 (iPad; CPU OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A372 Safari/604.1\"\n192.168.0.26 - - [12/Nov/2017:16:18:42 -0500] \"GET /contact.html HTTP/1.1\" 200 6976 \"http://192.168.0.35/consulting.html\" \"Mozilla/5.0 (iPad; CPU OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A372 Safari/604.1\"\n192.168.0.26 - - [12/Nov/2017:16:18:42 -0500] \"GET /files/main_styleaf0e.css?1509483497 HTTP/1.1\" 200 5022 \"http://192.168.0.35/contact.html\" \"Mozilla/5.0 (iPad; CPU OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A372 Safari/604.1\"\n192.168.0.26 - - [12/Nov/2017:16:18:42 -0500] \"GET /_/cdn2.editmysite.com/images/editor/theme-background/stock/iPad.html HTTP/1.1\" 200 5011 \"http://192.168.0.35/contact.html\" \"Mozilla/5.0 (iPad; CPU OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A372 Safari/604.1\"\n192.168.0.14 - - [12/Nov/2017:16:42:22 -0500] \"GET / HTTP/1.1\" 200 2377 \"-\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 11_1 like Mac OS X) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0 Mobile/15B93 Safari/604.1\"\n192.168.0.14 - - [12/Nov/2017:16:42:22 -0500] \"GET /backblue.gif HTTP/1.1\" 200 4529 \"http://192.168.0.35/\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 11_1 like Mac OS X) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0 Mobile/15B93 Safari/604.1\"\n192.168.0.14 - - [12/Nov/2017:16:42:22 -0500] \"GET /fade.gif HTTP/1.1\" 200 1113 \"http://192.168.0.35/\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 11_1 like Mac OS X) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0 Mobile/15B93 Safari/604.1\"\n192.168.0.14 - - [12/Nov/2017:16:42:23 -0500] \"GET /index.html HTTP/1.1\" 200 6932 \"http://192.168.0.35/\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 11_1 like Mac OS X) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0 Mobile/15B93 Safari/604.1\"\n192.168.0.14 - - [12/Nov/2017:16:42:23 -0500] \"GET /uploads/2/9/1/4/29147191/941880.png HTTP/1.1\" 200 7835 \"http://192.168.0.35/index.html\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 11_1 like Mac OS X) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0 Mobile/15B93 Safari/604.1\"\n192.168.0.14 - - [12/Nov/2017:16:42:23 -0500] \"GET /files/main_styleaf0e.css?1509483497 HTTP/1.1\" 200 5022 \"http://192.168.0.35/index.html\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 11_1 like Mac OS X) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0 Mobile/15B93 Safari/604.1\"\n192.168.0.14 - - [12/Nov/2017:16:42:23 -0500] \"GET /uploads/2/9/1/4/29147191/31549414299.png?457 HTTP/1.1\" 200 81378 \"http://192.168.0.35/index.html\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 11_1 like Mac OS X) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0 Mobile/15B93 Safari/604.1\"\n192.168.0.14 - - [12/Nov/2017:16:42:23 -0500] \"GET /uploads/2/9/1/4/29147191/2670902_orig.jpg HTTP/1.1\" 200 19526 \"http://192.168.0.35/index.html\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 11_1 like Mac OS X) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0 Mobile/15B93 Safari/604.1\"\n192.168.0.14 - - [12/Nov/2017:16:42:23 -0500] \"GET /files/theme/mobile49c2.js?1490908488 HTTP/1.1\" 200 3413 \"http://192.168.0.35/index.html\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 11_1 like Mac OS X) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0 Mobile/15B93 Safari/604.1\"\n192.168.0.14 - - [12/Nov/2017:16:42:23 -0500] \"GET /files/theme/plugin49c2.js?1490908488 HTTP/1.1\" 200 19444 \"http://192.168.0.35/index.html\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 11_1 like Mac OS X) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0 Mobile/15B93 Safari/604.1\"\n192.168.0.14 - - [12/Nov/2017:16:42:23 -0500] \"GET /files/theme/custom49c2.js?1490908488 HTTP/1.1\" 200 1429 \"http://192.168.0.35/index.html\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 11_1 like Mac OS X) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0 Mobile/15B93 Safari/604.1\"\n192.168.0.14 - - [12/Nov/2017:16:42:23 -0500] \"GET /uploads/2/9/1/4/29147191/2267842_orig.jpg HTTP/1.1\" 200 42818 \"http://192.168.0.35/index.html\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 11_1 like Mac OS X) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0 Mobile/15B93 Safari/604.1\"\n192.168.0.14 - - [12/Nov/2017:16:42:23 -0500] \"GET /uploads/2/9/1/4/29147191/2992005_orig.jpg HTTP/1.1\" 200 47029 \"http://192.168.0.35/index.html\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 11_1 like Mac OS X) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0 Mobile/15B93 Safari/604.1\"\n192.168.0.14 - - [12/Nov/2017:16:42:28 -0500] \"GET /resources.html HTTP/1.1\" 200 7569 \"http://192.168.0.35/index.html\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 11_1 like Mac OS X) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0 Mobile/15B93 Safari/604.1\"\n192.168.0.14 - - [12/Nov/2017:16:42:28 -0500] \"GET /uploads/2/9/1/4/29147191/identity_orig.png HTTP/1.1\" 200 47804 \"http://192.168.0.35/resources.html\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 11_1 like Mac OS X) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0 Mobile/15B93 Safari/604.1\"\n192.168.0.14 - - [12/Nov/2017:16:42:28 -0500] \"GET /uploads/2/9/1/4/29147191/editor/078519-blue-jelly-icon-business-envelope5ca13.png?1492225862 HTTP/1.1\" 200 7769 \"http://192.168.0.35/resources.html\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 11_1 like Mac OS X) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0 Mobile/15B93 Safari/604.1\"\n192.168.0.14 - - [12/Nov/2017:16:42:28 -0500] \"GET /uploads/2/9/1/4/29147191/428026.png HTTP/1.1\" 200 20174 \"http://192.168.0.35/resources.html\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 11_1 like Mac OS X) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0 Mobile/15B93 Safari/604.1\"\n192.168.0.14 - - [12/Nov/2017:16:42:28 -0500] \"GET /uploads/2/9/1/4/29147191/principlesofcyber_orig.png HTTP/1.1\" 200 43725 \"http://192.168.0.35/resources.html\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 11_1 like Mac OS X) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0 Mobile/15B93 Safari/604.1\"\n192.168.0.14 - - [12/Nov/2017:16:42:28 -0500] \"GET /uploads/2/9/1/4/29147191/principlesofencryption-nb_orig.png HTTP/1.1\" 200 45953 \"http://192.168.0.35/resources.html\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 11_1 like Mac OS X) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0 Mobile/15B93 Safari/604.1\"\n192.168.0.14 - - [12/Nov/2017:16:42:28 -0500] \"GET /_/cdn2.editmysite.com/images/editor/theme-background/stock/Work-Outside.html HTTP/1.1\" 200 5011 \"http://192.168.0.35/resources.html\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 11_1 like Mac OS X) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0 Mobile/15B93 Safari/604.1\"\n192.168.0.14 - - [12/Nov/2017:16:42:34 -0500] \"GET /uploads/2/9/1/4/29147191/principles_of_cyber.pdf HTTP/1.1\" 200 765195 \"http://192.168.0.35/resources.html\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 11_1 like Mac OS X) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0 Mobile/15B93 Safari/604.1\"\n192.168.0.14 - - [12/Nov/2017:17:29:10 -0500] \"GET / HTTP/1.1\" 200 2377 \"-\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 11_1 like Mac OS X) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0 Mobile/15B93 Safari/604.1\"\n192.168.0.14 - - [12/Nov/2017:17:29:10 -0500] \"GET /backblue.gif HTTP/1.1\" 304 182 \"http://192.168.0.35/\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 11_1 like Mac OS X) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0 Mobile/15B93 Safari/604.1\"\n192.168.0.14 - - [12/Nov/2017:17:29:10 -0500] \"GET /fade.gif HTTP/1.1\" 304 181 \"http://192.168.0.35/\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 11_1 like Mac OS X) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0 Mobile/15B93 Safari/604.1\"\n192.168.0.14 - - [12/Nov/2017:17:29:10 -0500] \"GET /files/main_styleaf0e.css?1509483497 HTTP/1.1\" 200 5022 \"http://192.168.0.35/index.html\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 11_1 like Mac OS X) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0 Mobile/15B93 Safari/604.1\"\n192.168.0.14 - - [12/Nov/2017:17:29:10 -0500] \"GET /index.html HTTP/1.1\" 200 6932 \"http://192.168.0.35/\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 11_1 like Mac OS X) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0 Mobile/15B93 Safari/604.1\"\n192.168.0.14 - - [12/Nov/2017:17:29:12 -0500] \"GET /products.html HTTP/1.1\" 200 7157 \"http://192.168.0.35/index.html\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 11_1 like Mac OS X) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0 Mobile/15B93 Safari/604.1\"\n192.168.0.14 - - [12/Nov/2017:17:29:12 -0500] \"GET /uploads/2/9/1/4/29147191/253922682aa.png?162 HTTP/1.1\" 200 16602 \"http://192.168.0.35/products.html\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 11_1 like Mac OS X) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0 Mobile/15B93 Safari/604.1\"\n192.168.0.14 - - [12/Nov/2017:17:29:12 -0500] \"GET /uploads/2/9/1/4/29147191/32981bd4c.png?161 HTTP/1.1\" 200 38061 \"http://192.168.0.35/products.html\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 11_1 like Mac OS X) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0 Mobile/15B93 Safari/604.1\"\n192.168.0.14 - - [12/Nov/2017:17:29:12 -0500] \"GET /uploads/2/9/1/4/29147191/99480889766.png?165 HTTP/1.1\" 200 26427 \"http://192.168.0.35/products.html\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 11_1 like Mac OS X) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0 Mobile/15B93 Safari/604.1\"\n192.168.0.14 - - [12/Nov/2017:17:29:12 -0500] \"GET /_/cdn2.editmysite.com/images/editor/theme-background/stock/Working2.html HTTP/1.1\" 200 5012 \"http://192.168.0.35/products.html\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 11_1 like Mac OS X) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0 Mobile/15B93 Safari/604.1\"\n192.168.0.14 - - [12/Nov/2017:17:29:17 -0500] \"GET /risk.html HTTP/1.1\" 200 6606 \"http://192.168.0.35/products.html\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 11_1 like Mac OS X) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0 Mobile/15B93 Safari/604.1\"\n192.168.0.14 - - [12/Nov/2017:17:29:17 -0500] \"GET /uploads/2/9/1/4/29147191/43527096c52.png?356 HTTP/1.1\" 200 55344 \"http://192.168.0.35/risk.html\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 11_1 like Mac OS X) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0 Mobile/15B93 Safari/604.1\"\n192.168.0.14 - - [12/Nov/2017:17:29:17 -0500] \"GET /_/cdn2.editmysite.com/images/editor/theme-background/stock/Graph.html HTTP/1.1\" 200 5012 \"http://192.168.0.35/risk.html\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 11_1 like Mac OS X) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0 Mobile/15B93 Safari/604.1\"\n192.168.0.14 - - [12/Nov/2017:17:29:17 -0500] \"GET /uploads/2/9/1/4/29147191/4418930_orig.png HTTP/1.1\" 200 174914 \"http://192.168.0.35/risk.html\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 11_1 like Mac OS X) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0 Mobile/15B93 Safari/604.1\"\n192.168.0.14 - - [12/Nov/2017:18:18:05 -0500] \"GET /about.html HTTP/1.1\" 200 7042 \"http://192.168.0.35/risk.html\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 11_1 like Mac OS X) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0 Mobile/15B93 Safari/604.1\"\n192.168.0.14 - - [12/Nov/2017:18:18:06 -0500] \"GET /files/main_styleaf0e.css?1509483497 HTTP/1.1\" 200 5022 \"http://192.168.0.35/about.html\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 11_1 like Mac OS X) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0 Mobile/15B93 Safari/604.1\"\n192.168.0.14 - - [12/Nov/2017:18:18:06 -0500] \"GET /uploads/2/9/1/4/29147191/page-layouts-4078890_orig.jpg HTTP/1.1\" 200 265419 \"http://192.168.0.35/about.html\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 11_1 like Mac OS X) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0 Mobile/15B93 Safari/604.1\"\n192.168.0.14 - - [12/Nov/2017:18:18:06 -0500] \"GET /_/cdn2.editmysite.com/images/editor/theme-background/stock/GW-bridge.html HTTP/1.1\" 200 5011 \"http://192.168.0.35/about.html\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 11_1 like Mac OS X) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0 Mobile/15B93 Safari/604.1\"\n192.168.0.14 - - [12/Nov/2017:18:18:13 -0500] \"GET /resources.html HTTP/1.1\" 200 7569 \"http://192.168.0.35/about.html\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 11_1 like Mac OS X) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0 Mobile/15B93 Safari/604.1\"\n192.168.0.14 - - [12/Nov/2017:18:18:13 -0500] \"GET /_/cdn2.editmysite.com/images/editor/theme-background/stock/Work-Outside.html HTTP/1.1\" 200 5012 \"http://192.168.0.35/resources.html\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 11_1 like Mac OS X) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0 Mobile/15B93 Safari/604.1\"\n192.168.0.14 - - [12/Nov/2017:18:18:16 -0500] \"GET /uploads/2/9/1/4/29147191/principles_of_encryption.pdf HTTP/1.1\" 200 1045139 \"http://192.168.0.35/resources.html\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 11_1 like Mac OS X) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0 Mobile/15B93 Safari/604.1\"\n192.168.0.37 - - [12/Nov/2017:18:25:48 -0500] \"GET /incident.html HTTP/1.1\" 200 6621 \"http://192.168.0.35/products.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:18:25:48 -0500] \"GET /files/main_styleaf0e.css?1509483497 HTTP/1.1\" 200 5022 \"http://192.168.0.35/incident.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:18:25:48 -0500] \"GET /uploads/2/9/1/4/29147191/4174185_orig.png HTTP/1.1\" 200 99002 \"http://192.168.0.35/incident.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:18:25:48 -0500] \"GET /uploads/2/9/1/4/29147191/1888827_orig.png HTTP/1.1\" 200 59026 \"http://192.168.0.35/incident.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:18:25:48 -0500] \"GET /files/theme/plugin49c2.js?1490908488 HTTP/1.1\" 200 19444 \"http://192.168.0.35/incident.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:18:25:48 -0500] \"GET /files/theme/mobile49c2.js?1490908488 HTTP/1.1\" 200 3413 \"http://192.168.0.35/incident.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:18:25:48 -0500] \"GET /files/theme/custom49c2.js?1490908488 HTTP/1.1\" 200 1429 \"http://192.168.0.35/incident.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:18:25:48 -0500] \"GET /_/cdn2.editmysite.com/images/editor/theme-background/stock/Working.html HTTP/1.1\" 200 5011 \"http://192.168.0.35/incident.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.36 - - [12/Nov/2017:18:35:47 -0500] \"GET /robots.txt HTTP/1.1\" 404 503 \"-\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:35:48 -0500] \"GET / HTTP/1.1\" 200 2377 \"-\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:35:49 -0500] \"GET /backblue.gif HTTP/1.1\" 200 4529 \"http://192.168.0.35/\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:35:50 -0500] \"GET /fade.gif HTTP/1.1\" 200 1112 \"http://192.168.0.35/\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:35:51 -0500] \"GET /index.html HTTP/1.1\" 200 6932 \"http://192.168.0.35/\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:35:52 -0500] \"GET /uploads/2/9/1/4/29147191/31549414299.png?457 HTTP/1.1\" 200 81377 \"http://192.168.0.35/index.html\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:35:53 -0500] \"GET /uploads/2/9/1/4/29147191/2670902_orig.jpg HTTP/1.1\" 200 19526 \"http://192.168.0.35/index.html\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:35:54 -0500] \"GET /uploads/2/9/1/4/29147191/2267842_orig.jpg HTTP/1.1\" 200 42819 \"http://192.168.0.35/index.html\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:35:55 -0500] \"GET /uploads/2/9/1/4/29147191/2992005_orig.jpg HTTP/1.1\" 200 47030 \"http://192.168.0.35/index.html\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:35:58 -0500] \"GET /uploads/2/9/1/4/29147191/941880.png HTTP/1.1\" 200 7836 \"http://192.168.0.35/index.html\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:36:01 -0500] \"GET /files/main_styleaf0e.css?1509483497 HTTP/1.1\" 200 5022 \"http://192.168.0.35/index.html\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.11 - - [12/Nov/2017:18:36:01 -0500] \"GET /products.html HTTP/1.1\" 200 7158 \"http://192.168.0.35/resources.html\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.11 - - [12/Nov/2017:18:36:01 -0500] \"GET /files/main_styleaf0e.css?1509483497 HTTP/1.1\" 200 5022 \"http://192.168.0.35/products.html\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.11 - - [12/Nov/2017:18:36:01 -0500] \"GET /uploads/2/9/1/4/29147191/253922682aa.png?162 HTTP/1.1\" 200 16602 \"http://192.168.0.35/products.html\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.11 - - [12/Nov/2017:18:36:01 -0500] \"GET /uploads/2/9/1/4/29147191/99480889766.png?165 HTTP/1.1\" 200 26428 \"http://192.168.0.35/products.html\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.11 - - [12/Nov/2017:18:36:01 -0500] \"GET /uploads/2/9/1/4/29147191/32981bd4c.png?161 HTTP/1.1\" 200 38062 \"http://192.168.0.35/products.html\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.11 - - [12/Nov/2017:18:36:01 -0500] \"GET /_/cdn2.editmysite.com/images/editor/theme-background/stock/Working2.html HTTP/1.1\" 200 5011 \"http://192.168.0.35/products.html\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.36 - - [12/Nov/2017:18:36:02 -0500] \"GET /products.html HTTP/1.1\" 200 7158 \"http://192.168.0.35/index.html\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:36:03 -0500] \"GET /consulting.html HTTP/1.1\" 200 7268 \"http://192.168.0.35/index.html\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:36:04 -0500] \"GET /resources.html HTTP/1.1\" 200 7568 \"http://192.168.0.35/index.html\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:36:05 -0500] \"GET /about.html HTTP/1.1\" 200 7041 \"http://192.168.0.35/index.html\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:36:06 -0500] \"GET /support.html HTTP/1.1\" 200 6207 \"http://192.168.0.35/index.html\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:36:07 -0500] \"GET /contact.html HTTP/1.1\" 200 6975 \"http://192.168.0.35/index.html\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.37 - - [12/Nov/2017:18:36:08 -0500] \"GET /about.html HTTP/1.1\" 200 7042 \"http://192.168.0.35/incident.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.36 - - [12/Nov/2017:18:36:08 -0500] \"GET /request-quote.html HTTP/1.1\" 200 7325 \"http://192.168.0.35/index.html\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.37 - - [12/Nov/2017:18:36:08 -0500] \"GET /files/main_styleaf0e.css?1509483497 HTTP/1.1\" 200 5022 \"http://192.168.0.35/about.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:18:36:08 -0500] \"GET /files/theme/plugin49c2.js?1490908488 HTTP/1.1\" 200 19444 \"http://192.168.0.35/about.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:18:36:08 -0500] \"GET /files/theme/custom49c2.js?1490908488 HTTP/1.1\" 200 1430 \"http://192.168.0.35/about.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:18:36:08 -0500] \"GET /files/theme/mobile49c2.js?1490908488 HTTP/1.1\" 200 3413 \"http://192.168.0.35/about.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:18:36:08 -0500] \"GET /_/cdn2.editmysite.com/images/editor/theme-background/stock/GW-bridge.html HTTP/1.1\" 200 5011 \"http://192.168.0.35/about.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.36 - - [12/Nov/2017:18:36:09 -0500] \"GET /files/theme/plugin49c2.js?1490908488 HTTP/1.1\" 200 19444 \"http://192.168.0.35/index.html\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:36:10 -0500] \"GET /files/theme/mobile49c2.js?1490908488 HTTP/1.1\" 200 3414 \"http://192.168.0.35/index.html\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:36:11 -0500] \"GET /files/theme/custom49c2.js?1490908488 HTTP/1.1\" 200 1429 \"http://192.168.0.35/index.html\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:36:12 -0500] \"GET /files/theme/images/default-bgaf0e.jpg?1509483497 HTTP/1.1\" 200 239379 \"http://192.168.0.35/files/main_styleaf0e.css?1509483497\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:36:13 -0500] \"GET /files/theme/images/select-arrowaf0e.png?1509483497 HTTP/1.1\" 200 1385 \"http://192.168.0.35/files/main_styleaf0e.css?1509483497\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:36:14 -0500] \"GET /files/theme/images/light-checkboxaf0e.png?1509483497 HTTP/1.1\" 200 1456 \"http://192.168.0.35/files/main_styleaf0e.css?1509483497\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:36:15 -0500] \"GET /files/theme/images/icon-bubbleaf0e.png?1509483497 HTTP/1.1\" 200 1584 \"http://192.168.0.35/files/main_styleaf0e.css?1509483497\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:36:16 -0500] \"GET /uploads/2/9/1/4/29147191/253922682aa.png?162 HTTP/1.1\" 200 16602 \"http://192.168.0.35/products.html\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:36:17 -0500] \"GET /uploads/2/9/1/4/29147191/99480889766.png?165 HTTP/1.1\" 200 26427 \"http://192.168.0.35/products.html\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:36:18 -0500] \"GET /uploads/2/9/1/4/29147191/32981bd4c.png?161 HTTP/1.1\" 200 38062 \"http://192.168.0.35/products.html\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:36:19 -0500] \"GET /_/cdn2.editmysite.com/images/editor/theme-background/stock/Working2.html HTTP/1.1\" 200 5011 \"http://192.168.0.35/products.html\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:36:20 -0500] \"GET /risk.html HTTP/1.1\" 200 6605 \"http://192.168.0.35/products.html\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:36:21 -0500] \"GET /incident.html HTTP/1.1\" 200 6620 \"http://192.168.0.35/products.html\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:36:23 -0500] \"GET /bcp.html HTTP/1.1\" 200 6650 \"http://192.168.0.35/products.html\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:36:25 -0500] \"GET /uploads/2/9/1/4/29147191/398980_orig.png HTTP/1.1\" 200 120189 \"http://192.168.0.35/consulting.html\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:36:27 -0500] \"GET /_/cdn2.editmysite.com/images/editor/theme-background/stock/Colaboration.html HTTP/1.1\" 200 5011 \"http://192.168.0.35/consulting.html\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:36:29 -0500] \"GET /uploads/2/9/1/4/29147191/identity_orig.png HTTP/1.1\" 200 47805 \"http://192.168.0.35/resources.html\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:36:31 -0500] \"GET /uploads/2/9/1/4/29147191/editor/078519-blue-jelly-icon-business-envelope5ca13.png?1492225862 HTTP/1.1\" 200 7768 \"http://192.168.0.35/resources.html\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:36:35 -0500] \"GET /uploads/2/9/1/4/29147191/428026.png HTTP/1.1\" 200 20173 \"http://192.168.0.35/resources.html\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:36:40 -0500] \"GET /uploads/2/9/1/4/29147191/principlesofcyber_orig.png HTTP/1.1\" 200 43725 \"http://192.168.0.35/resources.html\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:36:41 -0500] \"GET /uploads/2/9/1/4/29147191/principlesofencryption-nb_orig.png HTTP/1.1\" 200 45954 \"http://192.168.0.35/resources.html\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:36:47 -0500] \"GET /_/cdn2.editmysite.com/images/editor/theme-background/stock/Work-Outside.html HTTP/1.1\" 200 5012 \"http://192.168.0.35/resources.html\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:36:53 -0500] \"GET /uploads/2/9/1/4/29147191/principles_of_encryption.pdf HTTP/1.1\" 200 1045140 \"http://192.168.0.35/resources.html\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:36:55 -0500] \"GET /uploads/2/9/1/4/29147191/page-layouts-4078890_orig.jpg HTTP/1.1\" 200 265419 \"http://192.168.0.35/about.html\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.37 - - [12/Nov/2017:18:37:23 -0500] \"GET /consulting.html HTTP/1.1\" 200 7269 \"http://192.168.0.35/about.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:18:37:23 -0500] \"GET /files/main_styleaf0e.css?1509483497 HTTP/1.1\" 200 5022 \"http://192.168.0.35/consulting.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:18:37:23 -0500] \"GET /files/theme/mobile49c2.js?1490908488 HTTP/1.1\" 200 3414 \"http://192.168.0.35/consulting.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:18:37:23 -0500] \"GET /files/theme/custom49c2.js?1490908488 HTTP/1.1\" 200 1430 \"http://192.168.0.35/consulting.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:18:37:23 -0500] \"GET /files/theme/plugin49c2.js?1490908488 HTTP/1.1\" 200 19444 \"http://192.168.0.35/consulting.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:18:37:24 -0500] \"GET /_/cdn2.editmysite.com/images/editor/theme-background/stock/Colaboration.html HTTP/1.1\" 200 5011 \"http://192.168.0.35/consulting.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.11 - - [12/Nov/2017:18:37:27 -0500] \"GET /resources.html HTTP/1.1\" 200 7569 \"http://192.168.0.35/products.html\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.11 - - [12/Nov/2017:18:37:27 -0500] \"GET /uploads/2/9/1/4/29147191/identity_orig.png HTTP/1.1\" 200 47804 \"http://192.168.0.35/resources.html\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.11 - - [12/Nov/2017:18:37:27 -0500] \"GET /uploads/2/9/1/4/29147191/editor/078519-blue-jelly-icon-business-envelope5ca13.png?1492225862 HTTP/1.1\" 200 7769 \"http://192.168.0.35/resources.html\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.11 - - [12/Nov/2017:18:37:27 -0500] \"GET /uploads/2/9/1/4/29147191/428026.png HTTP/1.1\" 200 20174 \"http://192.168.0.35/resources.html\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.11 - - [12/Nov/2017:18:37:27 -0500] \"GET /uploads/2/9/1/4/29147191/principlesofcyber_orig.png HTTP/1.1\" 200 43725 \"http://192.168.0.35/resources.html\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.11 - - [12/Nov/2017:18:37:27 -0500] \"GET /uploads/2/9/1/4/29147191/principlesofencryption-nb_orig.png HTTP/1.1\" 200 45954 \"http://192.168.0.35/resources.html\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.11 - - [12/Nov/2017:18:37:27 -0500] \"GET /_/cdn2.editmysite.com/images/editor/theme-background/stock/Work-Outside.html HTTP/1.1\" 200 5011 \"http://192.168.0.35/resources.html\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.11 - - [12/Nov/2017:18:37:30 -0500] \"GET /uploads/2/9/1/4/29147191/principles_of_cyber.pdf HTTP/1.1\" 200 765194 \"http://192.168.0.35/resources.html\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.36 - - [12/Nov/2017:18:36:49 -0500] \"GET /uploads/2/9/1/4/29147191/protecting_your_identity.pdf HTTP/1.1\" 200 775341 \"http://192.168.0.35/resources.html\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:36:51 -0500] \"GET /uploads/2/9/1/4/29147191/principles_of_cyber.pdf HTTP/1.1\" 200 765194 \"http://192.168.0.35/resources.html\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:37:44 -0500] \"GET /_/cdn2.editmysite.com/images/editor/theme-background/stock/GW-bridge.html HTTP/1.1\" 200 5012 \"http://192.168.0.35/about.html\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:37:45 -0500] \"GET /_/cdn2.editmysite.com/images/editor/theme-background/stock/iPad.html HTTP/1.1\" 200 5011 \"http://192.168.0.35/contact.html\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.11 - - [12/Nov/2017:18:37:46 -0500] \"GET /risk.html HTTP/1.1\" 200 6606 \"http://192.168.0.35/products.html\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.11 - - [12/Nov/2017:18:37:46 -0500] \"GET /uploads/2/9/1/4/29147191/43527096c52.png?356 HTTP/1.1\" 200 55344 \"http://192.168.0.35/risk.html\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.11 - - [12/Nov/2017:18:37:46 -0500] \"GET /uploads/2/9/1/4/29147191/4418930_orig.png HTTP/1.1\" 200 174914 \"http://192.168.0.35/risk.html\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.11 - - [12/Nov/2017:18:37:46 -0500] \"GET /_/cdn2.editmysite.com/images/editor/theme-background/stock/Graph.html HTTP/1.1\" 200 5011 \"http://192.168.0.35/risk.html\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.36 - - [12/Nov/2017:18:37:47 -0500] \"GET /uploads/2/9/1/4/29147191/43527096c52.png?356 HTTP/1.1\" 200 55344 \"http://192.168.0.35/risk.html\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:38:00 -0500] \"GET /uploads/2/9/1/4/29147191/4418930_orig.png HTTP/1.1\" 200 174914 \"http://192.168.0.35/risk.html\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:38:31 -0500] \"GET /_/cdn2.editmysite.com/images/editor/theme-background/stock/Graph.html HTTP/1.1\" 200 5012 \"http://192.168.0.35/risk.html\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:38:32 -0500] \"GET /uploads/2/9/1/4/29147191/4174185_orig.png HTTP/1.1\" 200 99001 \"http://192.168.0.35/incident.html\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:38:49 -0500] \"GET /uploads/2/9/1/4/29147191/1888827_orig.png HTTP/1.1\" 200 59026 \"http://192.168.0.35/incident.html\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:39:01 -0500] \"GET /_/cdn2.editmysite.com/images/editor/theme-background/stock/Working.html HTTP/1.1\" 200 5012 \"http://192.168.0.35/incident.html\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:39:03 -0500] \"GET /uploads/2/9/1/4/29147191/601239_orig.png HTTP/1.1\" 200 111182 \"http://192.168.0.35/bcp.html\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:39:05 -0500] \"GET /uploads/2/9/1/4/29147191/4304070_orig.png HTTP/1.1\" 200 57268 \"http://192.168.0.35/bcp.html\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.36 - - [12/Nov/2017:18:39:07 -0500] \"GET /_/cdn2.editmysite.com/images/editor/theme-background/stock/Coffee.html HTTP/1.1\" 200 5012 \"http://192.168.0.35/bcp.html\" \"Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)\"\n192.168.0.37 - - [12/Nov/2017:18:41:56 -0500] \"GET /resources.html HTTP/1.1\" 200 7569 \"http://192.168.0.35/consulting.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:18:41:56 -0500] \"GET /files/main_styleaf0e.css?1509483497 HTTP/1.1\" 200 5022 \"http://192.168.0.35/resources.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:18:41:56 -0500] \"GET /uploads/2/9/1/4/29147191/identity_orig.png HTTP/1.1\" 200 47804 \"http://192.168.0.35/resources.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:18:41:56 -0500] \"GET /uploads/2/9/1/4/29147191/editor/078519-blue-jelly-icon-business-envelope5ca13.png?1492225862 HTTP/1.1\" 200 7769 \"http://192.168.0.35/resources.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:18:41:56 -0500] \"GET /uploads/2/9/1/4/29147191/428026.png HTTP/1.1\" 200 20174 \"http://192.168.0.35/resources.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:18:41:56 -0500] \"GET /uploads/2/9/1/4/29147191/principlesofcyber_orig.png HTTP/1.1\" 200 43724 \"http://192.168.0.35/resources.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:18:41:56 -0500] \"GET /uploads/2/9/1/4/29147191/principlesofencryption-nb_orig.png HTTP/1.1\" 200 45953 \"http://192.168.0.35/resources.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:18:41:56 -0500] \"GET /files/theme/plugin49c2.js?1490908488 HTTP/1.1\" 200 19444 \"http://192.168.0.35/resources.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:18:41:56 -0500] \"GET /files/theme/mobile49c2.js?1490908488 HTTP/1.1\" 200 3413 \"http://192.168.0.35/resources.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:18:41:56 -0500] \"GET /files/theme/custom49c2.js?1490908488 HTTP/1.1\" 200 1429 \"http://192.168.0.35/resources.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:18:41:56 -0500] \"GET /_/cdn2.editmysite.com/images/editor/theme-background/stock/Work-Outside.html HTTP/1.1\" 200 5011 \"http://192.168.0.35/resources.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:18:42:01 -0500] \"GET /uploads/2/9/1/4/29147191/protecting_your_identity.pdf HTTP/1.1\" 200 775340 \"http://192.168.0.35/resources.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:19:25:10 -0500] \"GET /products.html HTTP/1.1\" 200 7158 \"http://192.168.0.35/resources.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:19:25:10 -0500] \"GET /files/main_styleaf0e.css?1509483497 HTTP/1.1\" 200 5022 \"http://192.168.0.35/products.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:19:25:10 -0500] \"GET /files/theme/mobile49c2.js?1490908488 HTTP/1.1\" 200 3414 \"http://192.168.0.35/products.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:19:25:10 -0500] \"GET /uploads/2/9/1/4/29147191/32981bd4c.png?161 HTTP/1.1\" 304 182 \"http://192.168.0.35/products.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:19:25:10 -0500] \"GET /uploads/2/9/1/4/29147191/99480889766.png?165 HTTP/1.1\" 304 182 \"http://192.168.0.35/products.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:19:25:10 -0500] \"GET /uploads/2/9/1/4/29147191/253922682aa.png?162 HTTP/1.1\" 304 182 \"http://192.168.0.35/products.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:19:25:10 -0500] \"GET /files/theme/plugin49c2.js?1490908488 HTTP/1.1\" 200 19444 \"http://192.168.0.35/products.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:19:25:10 -0500] \"GET /files/theme/custom49c2.js?1490908488 HTTP/1.1\" 200 1429 \"http://192.168.0.35/products.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:19:25:10 -0500] \"GET /_/cdn2.editmysite.com/images/editor/theme-background/stock/Working2.html HTTP/1.1\" 200 5011 \"http://192.168.0.35/products.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:19:25:14 -0500] \"GET /risk.html HTTP/1.1\" 200 6605 \"http://192.168.0.35/products.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:19:25:14 -0500] \"GET /files/main_styleaf0e.css?1509483497 HTTP/1.1\" 200 5022 \"http://192.168.0.35/risk.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:19:25:14 -0500] \"GET /uploads/2/9/1/4/29147191/43527096c52.png?356 HTTP/1.1\" 200 55344 \"http://192.168.0.35/risk.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:19:25:14 -0500] \"GET /files/theme/mobile49c2.js?1490908488 HTTP/1.1\" 200 3414 \"http://192.168.0.35/risk.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:19:25:14 -0500] \"GET /files/theme/custom49c2.js?1490908488 HTTP/1.1\" 200 1429 \"http://192.168.0.35/risk.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:19:25:14 -0500] \"GET /files/theme/plugin49c2.js?1490908488 HTTP/1.1\" 200 19444 \"http://192.168.0.35/risk.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:19:25:14 -0500] \"GET /uploads/2/9/1/4/29147191/4418930_orig.png HTTP/1.1\" 200 174913 \"http://192.168.0.35/risk.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:19:25:15 -0500] \"GET /_/cdn2.editmysite.com/images/editor/theme-background/stock/Graph.html HTTP/1.1\" 200 5011 \"http://192.168.0.35/risk.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:19:25:18 -0500] \"GET /contact.html HTTP/1.1\" 200 6975 \"http://192.168.0.35/risk.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:19:25:18 -0500] \"GET /files/main_styleaf0e.css?1509483497 HTTP/1.1\" 200 5022 \"http://192.168.0.35/contact.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:19:25:18 -0500] \"GET /files/theme/plugin49c2.js?1490908488 HTTP/1.1\" 200 19444 \"http://192.168.0.35/contact.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:19:25:18 -0500] \"GET /files/theme/mobile49c2.js?1490908488 HTTP/1.1\" 200 3413 \"http://192.168.0.35/contact.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:19:25:18 -0500] \"GET /files/theme/custom49c2.js?1490908488 HTTP/1.1\" 200 1429 \"http://192.168.0.35/contact.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:19:25:18 -0500] \"GET /_/cdn2.editmysite.com/images/editor/theme-background/stock/iPad.html HTTP/1.1\" 200 5011 \"http://192.168.0.35/contact.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:19:25:31 -0500] \"GET /request-quote.html HTTP/1.1\" 200 7326 \"http://192.168.0.35/contact.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:19:25:31 -0500] \"GET /files/main_styleaf0e.css?1509483497 HTTP/1.1\" 200 5022 \"http://192.168.0.35/request-quote.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:19:25:31 -0500] \"GET /files/theme/plugin49c2.js?1490908488 HTTP/1.1\" 200 19444 \"http://192.168.0.35/request-quote.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:19:25:31 -0500] \"GET /files/theme/mobile49c2.js?1490908488 HTTP/1.1\" 200 3414 \"http://192.168.0.35/request-quote.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:19:25:31 -0500] \"GET /files/theme/custom49c2.js?1490908488 HTTP/1.1\" 200 1429 \"http://192.168.0.35/request-quote.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:19:25:31 -0500] \"GET /_/cdn2.editmysite.com/images/editor/theme-background/stock/Colaboration.html HTTP/1.1\" 200 5011 \"http://192.168.0.35/request-quote.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:19:25:31 -0500] \"GET /files/theme/images/select-arrowaf0e.png?1509483497 HTTP/1.1\" 200 1385 \"http://192.168.0.35/files/main_styleaf0e.css?1509483497\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:19:25:45 -0500] \"GET /about.html HTTP/1.1\" 200 7042 \"http://192.168.0.35/request-quote.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:19:25:45 -0500] \"GET /files/main_styleaf0e.css?1509483497 HTTP/1.1\" 200 5022 \"http://192.168.0.35/about.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:19:25:45 -0500] \"GET /files/theme/mobile49c2.js?1490908488 HTTP/1.1\" 200 3414 \"http://192.168.0.35/about.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:19:25:45 -0500] \"GET /files/theme/custom49c2.js?1490908488 HTTP/1.1\" 200 1430 \"http://192.168.0.35/about.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:19:25:45 -0500] \"GET /files/theme/plugin49c2.js?1490908488 HTTP/1.1\" 200 19444 \"http://192.168.0.35/about.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:19:25:46 -0500] \"GET /_/cdn2.editmysite.com/images/editor/theme-background/stock/GW-bridge.html HTTP/1.1\" 200 5011 \"http://192.168.0.35/about.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:19:26:04 -0500] \"GET /consulting.html HTTP/1.1\" 200 7269 \"http://192.168.0.35/about.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:19:26:04 -0500] \"GET /files/main_styleaf0e.css?1509483497 HTTP/1.1\" 200 5022 \"http://192.168.0.35/consulting.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:19:26:04 -0500] \"GET /files/theme/mobile49c2.js?1490908488 HTTP/1.1\" 200 3414 \"http://192.168.0.35/consulting.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:19:26:04 -0500] \"GET /files/theme/plugin49c2.js?1490908488 HTTP/1.1\" 200 19444 \"http://192.168.0.35/consulting.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.37 - - [12/Nov/2017:19:26:04 -0500] \"GET /files/theme/custom49c2.js?1490908488 HTTP/1.1\" 200 1430 \"http://192.168.0.35/consulting.html\" \"Mozilla/5.0 (Windows NT 5.1; rv:43.0) Gecko/20100101 Firefox/43.0\"\n192.168.0.11 - - [12/Nov/2017:19:26:09 -0500] \"GET /resources.html HTTP/1.1\" 200 7569 \"http://192.168.0.35/risk.html\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.11 - - [12/Nov/2017:19:26:09 -0500] \"GET /files/main_styleaf0e.css?1509483497 HTTP/1.1\" 200 5022 \"http://192.168.0.35/resources.html\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n192.168.0.11 - - [12/Nov/2017:19:26:09 -0500] \"GET /_/cdn2.editmysite.com/images/editor/theme-background/stock/Work-Outside.html HTTP/1.1\" 200 5011 \"http://192.168.0.35/resources.html\" \"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0\"\n"
},
{
"path": "ch07/countem.awk",
"content": "# Cybersecurity Ops with bash\n# countem.awk\n#\n# Description: \n# Count the number of instances of an item using awk\n#\n# Usage:\n# countem.awk < inputfile\n#\n\nawk '{ cnt[$1]++ }\nEND { for (id in cnt) {\n printf \"%d %s\\n\", cnt[id], id\n }\n }'\n"
},
{
"path": "ch07/countem.sh",
"content": "#!/bin/bash -\n#\n# Cybersecurity Ops with bash\n# countem.sh\n#\n# Description: \n# Count the number of instances of an item using bash\n#\n# Usage:\n# countem.sh < inputfile\n#\n\ndeclare -A cnt # assoc. array # <1>\nwhile read id xtra # <2>\ndo\n let cnt[$id]++ # <3>\ndone\n# now display what we counted\n# for each key in the (key, value) assoc. array\nfor id in \"${!cnt[@]}\" # <4>\ndo \n\tprintf '%s %d\\n' \"$id\" \"${cnt[$id]}\" # <5>\ndone\n"
},
{
"path": "ch07/histogram.sh",
"content": "#!/bin/bash -\n#\n# Cybersecurity Ops with bash\n# histogram.sh\n#\n# Description: \n# Generate a horizontal bar chart of specified data\n#\n# Usage: ./histogram.sh\n# input format: label value\n#\n\nfunction pr_bar () # <1>\n{\n local -i i raw maxraw scaled # <2>\n raw=$1\n maxraw=$2\n ((scaled=(MAXBAR*raw)/maxraw)) # <3>\n # min size guarantee\n ((raw > 0 && scaled == 0)) && scaled=1\t\t\t\t# <4>\n\n for((i=0; i\ndeclare -i MAXBAR max\nmax=0\nMAXBAR=50\t# how large the largest bar should be\n\nwhile read labl val\ndo\n let RA[$labl]=$val\t\t\t\t\t# <6>\n # keep the largest value; for scaling\n (( val > max )) && max=$val\ndone\n\n# scale and print it\nfor labl in \"${!RA[@]}\"\t\t\t\t\t# <7>\ndo\n printf '%-20.20s ' \"$labl\"\n pr_bar ${RA[$labl]} $max\t\t\t\t# <8>\ndone\n"
},
{
"path": "ch07/histogram_plain.sh",
"content": "#!/bin/bash -\n#\n# Cybersecurity Ops with bash\n# histogram_plain.sh\n#\n# Description: \n# Generate a horizontal bar chart of specified data without\n# using associative arrays, good for older versions of bash\n#\n# Usage: ./histogram_plain.sh\n# input format: label value\n#\n\ndeclare -a RA_key RA_val # <1>\ndeclare -i max ndx\nmax=0\nmaxbar=50 # how large the largest bar should be\n\nndx=0\nwhile read labl val\ndo\n RA_key[$ndx]=$labl # <2>\n RA_value[$ndx]=$val\n # keep the largest value; for scaling\n (( val > max )) && max=$val \n let ndx++\ndone\n\n# scale and print it\nfor ((j=0; j\ndo\n printf \"%-20.20s \" ${RA_key[$j]}\n pr_bar ${RA_value[$j]} $max\ndone\n"
},
{
"path": "ch07/pagereq.awk",
"content": "# Cybersecurity Ops with bash\n# pagereq.awk\n#\n# Description: \n# Count the number of page requests for a given IP address using awk\n#\n# Usage:\n# pagereq < inputfile\n# IP address to search for\n#\n\n# count the number of page requests from an address ($1)\nawk -v page=\"$1\" '{ if ($1==page) {cnt[$7]+=1 } } # <1>\nEND { for (id in cnt) { # <2>\n printf \"%8d %s\\n\", cnt[id], id\n }\n}'\n"
},
{
"path": "ch07/pagereq.sh",
"content": "# Cybersecurity Ops with bash\n# pagereq.sh\n#\n# Description: \n# Count the number of page requests for a given IP address using bash\n#\n# Usage:\n# pagereq < inputfile\n# IP address to search for\n#\n\ndeclare -A cnt # <1>\nwhile read addr d1 d2 datim gmtoff getr page therest\ndo\n if [[ $1 == $addr ]] ; then let cnt[$page]+=1 ; fi\ndone\nfor id in ${!cnt[@]} # <2>\ndo\n printf \"%8d %s\\n\" ${cnt[$id]} $id\ndone\n"
},
{
"path": "ch07/summer.sh",
"content": "#!/bin/bash -\n#\n# Cybersecurity Ops with bash\n# summer.sh\n#\n# Description: \n# Sum the total of field 2 values for each unique field 1\n#\n# Usage: ./summer.sh\n# input format: \n#\n\ndeclare -A cnt # assoc. array\nwhile read id count\ndo\n let cnt[$id]+=$count\ndone\nfor id in \"${!cnt[@]}\"\ndo\n printf \"%-15s %8d\\n\" \"${id}\" \"${cnt[${id}]}\" #<1>\ndone\n"
},
{
"path": "ch07/useragents.sh",
"content": "#!/bin/bash -\n#\n# Cybersecurity Ops with bash\n# useragents.sh\n#\n# Description: \n# Read through a log looking for unknown user agents\n#\n# Usage: ./useragents.sh < \n# Apache access log\n#\n\n\n# mismatch - search through the array of known names\n# returns 1 (false) if it finds a match\n# returns 0 (true) if there is no match\nfunction mismatch () # <1>\n{\n local -i i # <2>\n for ((i=0; i<$KNSIZE; i++))\n do\n [[ \"$1\" =~ .*${KNOWN[$i]}.* ]] && return 1 # <3>\n done\n return 0\n}\n\n# read up the known ones\nreadarray -t KNOWN < \"useragents.txt\" # <4>\nKNSIZE=${#KNOWN[@]} # <5>\n\n# preprocess logfile (stdin) to pick out ipaddr and user agent \nawk -F'\"' '{print $1, $6}' | \\\nwhile read ipaddr dash1 dash2 dtstamp delta useragent # <6>\ndo\n if mismatch \"$useragent\"\n then\n echo \"anomaly: $ipaddr $useragent\"\n fi\ndone\n"
},
{
"path": "ch07/useragents.txt",
"content": "Firefox\nChrome\nSafari\nEdge\n"
},
{
"path": "ch08/livebar.sh",
"content": "#!/bin/bash -\n#\n# Cybersecurity Ops with bash\n# livebar.sh\n#\n# Description: \n# Creates a rolling horizontal bar chart of live data\n#\n# Usage:\n#