Capture Overview

Decoded protocols were DNS, FTP, HTTP, and WebSocket over TCP/UDP.

Topology and Footprint

Observed ports: 21, 53, 80, 443, 35644, 51616–51622, 59216, 61756, 62078, 62797.
MAC vendors: Hewlett Packard, NETGEAR.

Geography

Content and File-Type Indicators

Observed MIME types:

• application/octet-stream
• application/x-dosexec
• application/zlib
• audio/x-mp4a-latm
• text/html
• text/plain

Content classifications included executable, compressed/binary, bitmap-like, audio, ALAN game data, Atari 68xxx / DOS executable indicators, and long ASCII text variants.

Notable HTTP Activity

91.92.243.152 — /dealer/agwofile.txt

A cleartext HTTP request retrieved:

GET /dealer/agwofile.txt HTTP/1.1

The server returned:

HTTP/1.1 200 OK

Relevant details:

The retrieved body is a large opaque text blob rather than ordinary readable text.

checkip.dyndns.org — public IP check

A cleartext HTTP exchange targeted checkip.dyndns.org:

GET / HTTP/1.1
Host: checkip.dyndns.org
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
Connection: Keep-Alive

The response was:

HTTP/1.1 200 OK

with a Current IP Check page showing:

• Current IP Address: 173.66.46.112

Credentials and Keystore Artifacts

• One masked credential was observed: oj********s6
• The keystore contains 14 total entries, dominated by TCP secrets, plus HTTP URI/URL artifacts and one certificate imported from packet #13
• FTP credentials for 188.127.239.250 recur in packets #5, #8, and #10
• Packet #4 contains HTTP observations for:
  • 91.92.243.152

Packet Capture Compacted Analysis

Executive Summary

The capture contains 2,021 packets across 11 streams, totaling 2.26 MB. Traffic is overwhelmingly unencrypted: 2,018 unencrypted packets versus 3 encrypted, with 0 undecodable packets. The decoded application protocols are DNS, FTP, HTTP, and WebSocket over TCP/UDP. There were no TCP retransmissions and 6 out-of-order segments. The average stream length was 183.73 packets (minimum 2, maximum 1,570).

The traffic is highly concentrated: 10.1.14.131 generated all 2,021 observed packets, while the principal remote endpoint accounted for 1,570 packets. Heatmap correlation covered 1,753 packets. Geographic resolution placed most activity in Irving, United States (1,421 hits) and New York, United States (260), with smaller footprints in Frankfurt am Main (20) and London (9).

Hosts and Traffic Distribution

The hostname associated with the primary remote traffic was a23-39-148-32.deploy.static.akamaitechnologies.com, corresponding to 23.39.148.32. The capture lists 16 ports: 21, 53, 80, 443, 35644, 51616–51622, 59216, 61756, 62078, and 62797. Observed MAC vendors were Hewlett Packard and NETGEAR.

Protocol and Content Findings

• FTP: Cleartext credential material was exposed from 188.127.239.250.
  • A username appeared in

Network Capture Compacted Analysis

Executive Summary

The 2,021-packet capture contains 11 streams and 2.26 MB of traffic, dominated by an internal Windows host communicating with an Akamai-hosted endpoint and several external systems. Traffic is overwhelmingly unencrypted: 2,018 unencrypted packets versus 3 encrypted packets. No packets were undecodable, no TCP retransmissions occurred, and 6 out-of-order segments were observed.

The most significant finding is an apparent credential-stealer artifact and associated HTTP transfer. A server returned a 359,771-byte text payload containing a “VIP Recovery” log from DESKTOP-WIN11PC, including Thunderbird IMAP/SMTP records and Edge Chromium entries for eBay, Amazon, Facebook, and LinkedIn. The artifact exposed a reused email username and password material, while the keystore separately records FTP credentials transmitted in cleartext.

Capture Profile

Observed network and transport protocols were TCP and UDP. Decoded application protocols were DNS, FTP, HTTP, and WebSocket. MIME types included:

• application/octet-stream

Network Capture Summary

Executive Overview

The capture contains 2,021 packets across 11 streams, totaling 2.26 MB. Traffic is overwhelmingly cleartext: 2,018 unencrypted packets versus 3 encrypted, with 0 undecodable packets, 0 TCP retransmissions, and 6 out-of-order segments. The principal communicating host is 10.1.14.131, which accounts for all 2,021 captured packets; the largest remote flow is associated with 23.39.148.32 at 1,570 packets.

The most significant finding is a successful cleartext HTTP retrieval of /dealer/agwofile.txt from 91.92.243.152. The response delivered a large opaque text payload that may represent staged data or a command-and-control artifact. This is supported by additional indicators including exposed FTP credentials, dynamic public-IP discovery, executable-like content classifications, and substantial traffic involving the primary remote host. The capture does not by itself establish execution or malicious purpose.

Host and Traffic Inventory

Six Internet hosts were identified in the capture. MAC vendors represented were Hewlett Packard and NETGEAR. The observed ports were 21, 53, 80, 443, 35644, 51616–51622, 59216, 61756, 62078, and 62797.

HTTP Payload Retrieval

A short HTTP request retrieved:

GET /dealer/agwofile.txt HTTP/1.1

The server returned:

HTTP/1.1 200 OK

with the following characteristics:

Network Capture Compacted Analysis

Executive Summary

The capture contains 2,021 packets across 11 streams, totaling 2.26 MB. Traffic is overwhelmingly cleartext: 2,018 unencrypted packets versus 3 encrypted, with 0 undecodable packets. The dominant activity is TCP-based and concentrated between the internal host 10.1.14.131 and external infrastructure, particularly 23.39.148.32. The traffic includes DNS, FTP, HTTP, and WebSocket, with exposed FTP credentials, an unusual HTTP file request, public-IP discovery, and a large Base64-like plaintext artifact requiring further investigation.

Notable capture-quality indicators:

• 0 TCP retransmissions
• 6 out-of-order segments
• Average stream length: 183.73 packets; minimum 2, maximum 1,570
• 1,753 heatmap packet hits
• 0 bookmarks
• MAC vendors observed: Hewlett Packard and NETGEAR

Endpoint and Traffic Overview

Other observed ports are 21, 53, 80, 443, 35644, 51616–51622, 59216, 61756, 62078, and 62797. The presence of FTP on port 21 and HTTP on port 80 is especially significant

Network Capture Summary

Executive Assessment

The capture contains 2,021 packets across 11 streams, totaling 2.26 MB. Traffic is overwhelmingly unencrypted: 2,018 unencrypted packets versus 3 encrypted, with 0 undecodable packets. The dominant activity is a large HTTP file retrieval from 91.92.243.152, accompanied by exposed FTP credentials, an external-IP discovery request, and several other Internet connections. The retrieved file appears to be a large encoded or obfuscated text blob and warrants malware/content analysis.

Notable indicators include:

• HTTP retrieval of /dealer/agwofile.txt, an unusual filename associated with a 359–360 KB encoded-looking payload.
• FTP username and password exposure involving 188.127.239.250; the later username is longer than the earlier one.
• A request to checkip.dyndns.org/ from 193.122.6.168, consistent with public-IP discovery or dynamic-address tracking.
• 6 out-of-order segments, but no TCP retransmissions.
• One masked credential recorded as oj********s6.

Capture and Traffic Profile

Observed protocols were TCP, UDP, DNS, FTP, HTTP, and WebSocket. MIME detection produced application/octet-stream, application/x-dosexec, application/zlib, audio/x-mp4a-latm, text/html, and text/plain. File/data classification also identified ASCII text variants, executable formats, a compact bitmap, AC-3 audio, an Alpha u-code object, Atari 68xxx and DOS executable signatures, ALAN game data, and other binary-looking content. These classifications should be treated as indicators for further inspection rather than proof that all corresponding file types were intentionally transferred.

Hosts and Significant Activity

Packet Capture Compacted Analysis

Executive Summary

The capture contains 2,021 packets across 11 streams, totaling 2.26 MB. Traffic is overwhelmingly unencrypted: 2,018 unencrypted packets versus 3 encrypted, with 0 undecodable packets. The capture contains no TCP retransmissions, but does include 6 out-of-order segments. Activity is concentrated between the internal host 10.1.14.131 and external services, especially the Akamai-associated endpoint 23.39.148.32, which accounts for 1,570 packets.

The most significant findings are:

• Cleartext FTP credential exposure involving 188.127.239.250.
• An unusual HTTP retrieval of /dealer/agwofile.txt from 91.92.243.152, returning approximately 359 KB of text-like, encoded content.
• The retrieved artifact begins with a UTF-8 BOM, ==, a long run of A characters, and additional encoded-looking alphanumeric data; it has medium entropy (4.91) and is primarily assessed as Base64-like.
• A dynamic-IP discovery request to checkip.dyndns.org/ from 193.122.6.168.
• One masked credential was detected: oj********s6.

Traffic and Protocol Profile

Observed network and application protocols are TCP, UDP, DNS, FTP, HTTP, and WebSocket. The six MIME types reported are:

• application/octet-stream
• application/x-dosexec
• application/zlib
• audio/x-mp4a-latm
• text/html
• text/plain

The capture generated 1,753 heatmap packet hits. Content classifiers also reported a mixture of ASCII text, very-long-line text, encoded or executable-looking formats, compressed data, audio-stream data, bitmap data, BIOS-logo data, DOS/COM executable signatures, and other legacy binary classifications. These classifications are indicators of content shape or file signatures rather than confirmed malware identifications.

Hosts and Traffic Concentration

Packet Capture Compacted Summary

Executive Assessment

The capture shows a predominantly cleartext transfer environment in which internal host 10.1.14.131 generated all 2,021 packets and communicated heavily with 23.39.148.32. The most significant event is a successful HTTP download of a 359,771-byte text/plain response containing a large ASCII/Base64-like payload rather than ordinary readable text. This is consistent with staged, encoded, or concealed content delivery over HTTP; the available evidence does not prove execution.

The payload’s unusual size, repeated encoded data, and capture-wide file signatures—including executable, compressed, bitmap, audio, and DOS/Unix-style classifications—warrant treating the transfer as potentially disguised binary or executable content.

Capture Scope and Quality

Decoded traffic included TCP, UDP, DNS, FTP, HTTP, and WebSocket. MAC-vendor data identified Hewlett Packard and NETGEAR devices.

Hosts and Traffic Concentration

The hostname associated with the Akamai endpoint was a23-39-148-32.deploy.static.akamaitechnologies.com.

Observed ports were:

21, 53, 80, 443, 35644, 51616–51622, 59216, 61756, 62078, and 62797.

Chronological Content Findings

1. An HTTP request retrieved:

   GET
   

Network Capture and Analysis Summary

Capture Overview

The capture contains 2,021 packets across 11 streams, totaling 2.26 MB. It is overwhelmingly unencrypted: 2,018 unencrypted packets versus 3 encrypted packets. All packets were decodable, with no undecodable packets. Stream sizes averaged 183.73 packets (minimum 2, maximum 1,570). There were no TCP retransmissions and 6 out-of-order segments; no bookmarks were present.

Observed network and application protocols include TCP, UDP, DNS, FTP, HTTP, and WebSocket. The capture contains 6 Internet hosts among 8 total hosts, using 16 ports:

• Service ports: 21, 53, 80, 443
• Ephemeral ports: 35644, 51616–51622, 59216, 61756, 62078, 62797

The two identified MAC vendors are Hewlett Packard and NETGEAR.

Hosts and Traffic Distribution

Geographic enrichment recorded:

• Irving, United States: 1,421 hits
• New York, United States: 260 hits
• Frankfurt am Main, Germany: 20 hits
• London, United Kingdom: 9 hits

The heatmap identified 1,753 packet hits, concentrated primarily in the United States.

Content and Data Types

The six observed MIME types are:

• application/octet-stream
• application/x-dosexec
• application/zlib
• audio/x-mp4a-latm
• text/html
• text/plain

Content classification produced a mixture of ordinary text and executable or binary signatures, including:

• Poskanzer compact bitmap
• 370 XA sysV pure executable - 5.2
• 370 sysV executable
• 370 sysV pure executable
• ALAN game data
• Atari 68xxx executable with relocation table
• Award BIOS Logo, 136 × 84
• DOS executable (COM) variants
• ATSC A/52 / AC-3 / Dolby Digital stream
• Alpha u-code object
• ASCII text, including escaped text and multiple very-long-line variants ranging from approximately **424

Packet Capture Summary

Executive Overview

The capture contains 2,021 packets across 11 streams, totaling 2.26 MB. Traffic is overwhelmingly unencrypted: 2,018 unencrypted packets versus 3 encrypted packets. All packets were decodable, with 0 undecodable packets, 0 TCP retransmissions, and 6 out-of-order segments. Stream lengths ranged from 2 to 1,570 packets, averaging 183.73 packets.

The primary endpoint is 10.1.14.131, which appears in all 2,021 packets. The largest remote conversation involved 23.39.148.32 and accounted for 1,570 packets. The capture includes DNS, FTP, HTTP, and WebSocket traffic over TCP and UDP, with exposed plaintext activity likely significant given the very low encrypted-packet count.

Hosts and Traffic Distribution

The capture reports 8 total hosts, including 6 Internet hosts. Detected MAC vendors are Hewlett Packard and NETGEAR.

Protocols, Ports, and Content

• Network and transport protocols: TCP and UDP
• Decoded application protocols: DNS, FTP, HTTP, and WebSocket
• Observed ports: 21, 53, 80, 443, 35644, 51616–51622, 59216, 61756, 62078, and 62797
• MIME types:
  application/octet-stream, application/x-dosexec, `

Packet Capture Compacted Analysis

Executive Summary

The capture contains 2,021 packets across 11 streams, totaling 2.26 MB. Traffic is overwhelmingly cleartext: 2,018 unencrypted packets versus 3 encrypted, with 0 undecodable packets, 0 TCP retransmissions, and 6 out-of-order segments. Stream lengths average 183.73 packets (minimum 2, maximum 1,570); no bookmarks are present.

Decoded protocols are DNS, FTP, HTTP, and WebSocket over TCP and UDP. The dominant activity is a large HTTP transfer of an encoded-looking text object. The capture includes 1,753 heatmap hits, and the observed transfer appears suitable for reconstruction because no retransmissions or undecodable packets were recorded.

Significant HTTP Transfer

The /dealer/agwofile.txt object is substantially larger than ordinary readable text and contains repetitive, Base64-like ASCII. It is more consistent with serialized, encoded, compressed, staged, or otherwise obfuscated content than with a normal text document. The direct-IP

Network Capture Summary

Executive Overview

The capture contains 2,021 packets across 11 streams, totaling 2.26 MB. Traffic is overwhelmingly unencrypted:

• 2,018 unencrypted packets
• 3 encrypted packets
• 0 undecodable packets
• 0 TCP retransmissions
• 6 out-of-order segments
• 0 bookmarks
• Stream length: 183.73 packets average, ranging from 2 to 1,570 packets

Observed network and application protocols include TCP, UDP, DNS, FTP, HTTP, and WebSocket. The capture contains 8 observed hosts, including 6 internet hosts, and 16 observed ports.

Principal Hosts and Traffic Distribution

Additional observed hosts are 10.1.14.2, 149.154.166.110, and 188.127.239.250.

The observed ports are:

21, 53, 80, 443, 35644, 51616–51622, 59216, 61756, 62078, and 62797.

The only resolved hostname was:

• a23-39-148-32.deploy.static.akamaitechnologies.com → 23.39.148.32

MAC-vendor identification observed Hewlett Packard and NETGEAR devices.

HTTP Activity

A visible HTTP exchange requested:

GET /dealer/agwofile.txt HTTP/1.1

The request was served by 91.92.243.152, which returned:

HTTP/1.1 200 OK

The response size was 359,771 bytes. The capture therefore contains a substantial cleartext HTTP payload retrieved from /dealer/agwofile.txt.

Available MIME types across the capture are:

• application/octet-stream
• application/x-dosexec
• application/zlib
• audio/x-mp4a-latm
• text/html
• text/plain

Content and File-Type Indicators

Content classification identified a broad and unusual mixture of binary and text formats, including:

• Poskanzer compact bitmap
• 370 XA SysV pure executable, 5.2 format
• 370 SysV executable
• 370 SysV pure executable
• **ALAN

PacketSnitch Summary

Capture at a Glance

This pcap contains 2,021 packets across 11 streams totaling 2.26 MB. Traffic is overwhelmingly unencrypted (2,018 unencrypted vs 3 encrypted), with 0 undecodable packets, 0 TCP retransmissions, and 6 out-of-order segments. The decoded protocol mix is DNS, FTP, HTTP, and WebSocket over TCP/UDP.

High-Level Traffic Profile

Top Talkers

Geographic Footprint

Seen Protocols and Content Types

• Network/transport: TCP, UDP
• Decoded protocols: DNS, FTP, HTTP, WebSocket
• MIME types observed: application/octet-stream, application/x-dosexec, application/zlib, audio/x-mp4a-latm, text/html, text/plain
• Notable capture classifications: executable formats, compressed data, bitmap/audio-like content, and multiple long-line ASCII payloads, indicating a mixed-content trace with several file-transfer or staged-content artifacts.

Notable HTTP Activity

A particularly important HTTP transaction involved 91.92.243.152:

• Request: GET /dealer/agwofile.txt HTTP/1.1
• Response: HTTP/1.1 200 OK
• Server banner: Apache/2.4.58 on Windows 64-bit, with OpenSSL/3.1.3 and PHP/8.0.30
• Content-Type: text/plain
• Body size: 359,771 bytes

The returned object is not ordinary readable text despite the plain-text label: it starts with a UTF-8 BOM followed by == and a very large encoded-looking payload. Conversion analysis of the same body found:

• Size / type: 359,771 bytes, text/plain; charset=utf-8
• Entropy: 4.91 (Medium)
• Data-type hints: Base64-encoded data (Medium), plus weaker signals for an alphanumeric identifier and integer content

This strongly suggests a downloaded staged payload or obfuscated blob rather than a normal text document.

Additional HTTP/host intel

A separate decoded HTML object titled “Current IP Check” exposed:

• Visible text: Current IP Address: 173.66.46.112
• Format: hex-decoded text/html; charset=utf-8
• Size: 105 bytes
• Entropy: 4.78 (Medium)

This looks like a standard IP-check page, likely used by a client or web lookup flow to reveal the apparent public address.

Credentials and Keystore Findings

The capture contains one unique credential pattern in the stats panel: oj********s6.

The keystore review adds more context:

• 14 total entries in session mode
• Dominated by TCP secrets, plus HTTP URI/URL artifacts and one certificate imported from packet #13
• FTP credentials recur for 188.127.239.250 across packets #5, #8, and #10, with username/password fields captured multiple times through overlapping decode paths
• Packet #4 contains two HTTP observations:
  • 91.92.243.152 requested /dealer/agwofile.txt
  • 193.122.6.168 requested http://checkip.dyndns.org/, with duplicated user-agent artifacts in the keystore

Analyst Takeaways

• The trace is dominated by a single heavy client (10.1.14.131) talking to a

PacketSnitch Summary

Executive Overview

This capture is a small, mostly cleartext session of 2,021 packets and 2.26 MB across 11 streams, with 6 Internet hosts and only 3 encrypted packets versus 2,018 unencrypted. The traffic is dominated by a single talker, 10.1.14.131 (the local endpoint, accounting for all 2,021 packets), and a major remote peer, 23.39.148.32 with 1,570 packets. The capture also shows 91.92.243.152 (295 packets), 104.21.67.152 (49), and 193.122.6.168 (40). There were 6 out-of-order segments but no retransmissions.

The visible protocol mix is DNS, FTP, HTTP, and WebSocket, with the capture spanning TCP and UDP. Geographic hits cluster in Irving, United States (1,421) and New York, United States (260), with smaller presence in Frankfurt am Main, Germany (20) and London, United Kingdom (9). The heatmap records 1,753 packet hits. MIME and decoded content show a mix of text/html, text/plain, application/octet-stream, application/x-dosexec, application/zlib, and audio/x-mp4a-latm, alongside numerous binary and executable classifications.

Key Findings

HTTP Activity: Public IP Check

A recurring HTTP conversation targets checkip.dyndns.org and is clearly consistent with public IP discovery / external address verification rather than normal browsing. The client issued:

• GET / HTTP/1.1
• Host: checkip.dyndns.org
• User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
• Connection: Keep-Alive

The response was:

• HTTP/1.1 200 OK
• Content-Type: text/html
• Content-Length: 105
• Cache-Control: no-cache
• Pragma: no-cache

The returned HTML page titled “Current IP Check” reported:

• Current IP Address: 173.66.46.112

This same IP-check content appears multiple times in the decoded stream, reinforcing that the host was repeatedly verifying its external address.

Credential and Keystore Artifacts

The keystore contains 14 total entries in session mode, dominated by TCP secrets, plus HTTP URI/URL artifacts and one certificate imported from packet #13.

Notable credential-related observations

• FTP credentials for 188.127.239.250 appear multiple times across packets #5, #8, and #10, with both username and password fields present and some duplication between auto-decoded and field-specific entries.
• The capture-level credential summary includes one unique credential masked as oj********s6.
• Duplicate labels/types are present for some secrets, especially HTTP user-agent and FTP fields, indicating the same values were surfaced via multiple decode paths rather than separate distinct secrets.

HTTP URI / Host Artifacts from Keystore Review

Two HTTP observations from packet #4 are especially relevant:

The 193.122.6.168 entry also carried a long user-agent string, duplicated in the keystore. This aligns with the repeated checkip behavior seen in the HTTP stream.

Traffic Characterization

The capture’s broader content suggests a mixed-purpose session involving:

• Cleartext web activity centered on IP checking.
• FTP credential exposure and associated file-transfer artifacts.
• Presence of multiple binary/object classifications, including:
  • **370

PacketSnitch Summary

Executive Overview

This capture is a small but information-dense session: 2,021 packets across 11 streams and 2.26 MB of traffic, with 1,018 unencrypted packets and only 3 encrypted packets. The visible traffic is dominated by HTTP, FTP, DNS, and WebSocket activity, with no undecodable packets and no retransmission noise; only 6 out-of-order segments were seen. The top talker is 10.1.14.131 (the local endpoint, accounting for all 2,021 packets), with external concentration on 23.39.148.32 (1,570 packets), 91.92.243.152 (295), 104.21.67.152 (49), and 193.122.6.168 (40). The geographic footprint is mostly Irving, United States (1,421 hits) and New York, United States (260 hits), with smaller presence in Frankfurt am Main, Germany and London, United Kingdom.

The capture contains a notable mix of content types, including application/octet-stream, application/x-dosexec, application/zlib, audio/x-mp4a-latm, text/html, and text/plain, plus many data-classification hits indicating executable blobs, ASCII text variants, bitmap-like content, and audio/executable artifacts. A large portion of the visible traffic is also represented in the heatmap (1,753 packet hits). One masked credential was observed: oj****s6.

Key Hosts, Ports, and Infrastructure

Notable Traffic and Content

HTTP: file retrieval from 91.92.243.152

The clearest content-bearing transaction is an HTTP fetch to:

• GET /dealer/agwofile.txt HTTP/1.1
• Host: 91.92.243.152
• Response: HTTP/1.1 200 OK

The server identified itself as:

• Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30

Returned headers included:

• Date: Tue, 20 Jan 2026 04:47:33 GMT
• Last-Modified: Sun, 18 Jan 2026 18:53:49 GMT
• ETag: "57d5b-648ae18464b93"
• Content-Length: 359771
• Content-Type: text/plain
• Accept-Ranges: bytes
• Keep-Alive: timeout=5, max=100

The decoded body is sizable (360,168 bytes) and begins with a BOM plus a long ==AAAA... sequence. The workspace classified it as application/yaml with medium entropy (4.91) and type hints consistent with a Filename / File Path, Network Endpoint, and Time artifact.

HTTP: public IP check content

Another HTTP artifact surfaced as a small HTML page titled “Current IP Check” and containing:

• Current IP Address: 173.66.46.112

The content is only 105 bytes (text/html; charset=utf-8) with medium entropy (4.78). This is the only indicator surfaced from that page.

Credential and Keystore Findings

The session keystore contains 14 total entries, mostly TCP secrets, along with HTTP URI/URL artifacts and one certificate imported from packet #13. The most relevant credential activity is FTP-related:

• FTP credentials for 188.127.239.250 appear multiple times in packets #5, #8, and #10
• Both username and password fields were present
• Some entries are duplicated via different decode paths, indicating the same secret was captured more than once in alternate

PacketSnitch Summary

Executive overview

This capture is a small but information-rich session: 2021 packets, 11 streams, and 2.26 MB of mostly cleartext traffic (2018 unencrypted, only 3 encrypted). The traffic is centered on 10.1.14.131 and spans TCP/UDP with decoded DNS, FTP, HTTP, and WebSocket activity. No packet loss or retransmission issues stand out beyond 6 out-of-order segments.

The session appears to be a mixed browsing/file-transfer workflow with explicit credential exposure, an external IP check, and a large text download. The most important concrete artifacts are:

• HTTP fetch of /dealer/agwofile.txt from 91.92.243.152
• HTTP request to http://checkip.dyndns.org/ and a “Current IP Check” page revealing Current IP Address: 173.66.46.112
• Repeated FTP credential material tied to 188.127.239.250
• One masked credential in the keystore: oj********s6
• A certificate imported from packet #13

Capture-wide context

Protocol and content profile

• Network / transport: TCP, UDP
• Decoded protocols: DNS, FTP, HTTP, WebSocket
• MIME types observed: application/octet-stream, application/x-dosexec, application/zlib, audio/x-mp4a-latm, text/html, text/plain
• Data classifications include a broad mix of:
  • plain ASCII text, including very long-line variants
  • executable formats (370 sysV executable, DOS executable (COM), Atari 68xxx executable, application/x-dosexec)
  • compressed/binary material (application/zlib, compact bitmap, ALAN game data, etc.)

The capture therefore contains both human-readable web content and binary/executable-like payloads, suggesting mixed file movement rather than a single simple web page load.

Topology, talkers, and footprint

Top talkers

Observed hosts and ports

• Hosts: 10.1.14.131, 10.1.14.2, 104.21.67.152, 149.154.166.110, 188.127.239.250, 193.122.6.168, 23.39.148.32, 91.92.243.152
• Ports: 21, 53, 80, 443, 35644, 51616, 51617, 51618, 51619, 51620, 51621, 51622, 59216, 61756, 62078, 62797
• MAC vendors: Hewlett Packard, NETGEAR
• Hostnames: 23.39.148.32, a23-39-148-32.deploy.static.akamaitechnologies.com

Geographic footprint

The traffic footprint is mostly U.S.-based, with smaller presence in Germany and the U.K.

Notable HTTP activity

Two HTTP observations stand out:

1. 91.92.243.152 served /dealer/agwofile.txt
   • The decoded response is an HTTP/1.1 200 OK
   • Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
   • Content-Type: text/plain
   • Content-Length: 359771
   • Last-Modified: Sun, 18 Jan 2026 18:53:49 GMT
   • ETag: `"57d

PacketSnitch Summary

Capture at a Glance

This pcap is a small, mostly cleartext session with 2021 packets across 11 streams totaling 2.26 MB. Traffic is overwhelmingly unencrypted (2018 packets), with only 3 encrypted packets observed. There were no retransmissions, though 6 out-of-order segments were present. The capture spans 8 hosts, 16 ports, and a limited geographic footprint concentrated in the United States with some external activity reaching Germany and the United Kingdom.

Top traffic indicators

Notable Infrastructure and Geography

The capture includes local/private endpoint activity involving 10.1.14.131 and 10.1.14.2, plus several public hosts: 104.21.67.152, 149.154.166.110, 188.127.239.250, 193.122.6.168, 23.39.148.32, and 91.92.243.152. Observed hostnames include 23.39.148.32 and a23-39-148-32.deploy.static.akamaitechnologies.com, consistent with the large volume attributed to the Akamai-backed host.

Geo hits are concentrated in:

• Irving, United States — 1421
• New York, United States — 260
• Frankfurt am Main, Germany — 20
• London, United Kingdom — 9

Keychain / Credential Artifacts

The keystore review found 14 total entries, dominated by TCP secrets, with repeated duplicated labels from multiple decode paths. The most relevant recovered items are:

• FTP-related credentials for 188.127.239.250 appearing multiple times across packets #5, #8, and #10, with both username and password fields present.
• HTTP artifacts from packet #4:
  • 91.92.243.152 requested /dealer/agwofile.txt
  • 193.122.6.168 requested http://checkip.dyndns.org/
  • A long User-Agent string is associated with the 193.122.6.168 request
• One certificate was imported from packet #13

The capture-level credential summary also shows a masked secret pattern, oj********s6, indicating at least one recovered credential of interest.

Host-Centric Findings

91.92.243.152

This host is a single IPv4 public /32 at 91.92.243.152/32 with a one-address subnet (255.255.255.255). It resolved to New York, United States with coordinates 40.7503, -74.0014 and timezone America/New_York. In the traffic, it appears as a notable peer and in the keystore as the host that requested /dealer/agwofile.txt.

193.122.6.168

This host generated an HTTP request to http://checkip.dyndns.org/ and carried a long User-Agent artifact in the keystore. It is also among the observed public hosts contributing to the capture’s external footprint.

188.127.239.250

This host is the clear FTP-focused endpoint in the session, with repeated credential material recovered across multiple packets. The duplication suggests the same FTP authentication data was captured through more than one decode path rather than representing distinct logins.

23.39.148.32

This is the dominant external peer by packet count, tied to the Akamai hostname a23-39-148-32.deploy.static.akamaitechnologies.com and responsible for the largest single external traffic share in the capture.

Hash Enrichment

A threat-intel lookup was performed for the

PacketSnitch Compacted Network Summary

Capture at a Glance

This pcap contains 2,021 packets across 11 streams and 2.26 MB of traffic. The capture is overwhelmingly unencrypted (2,018 cleartext packets vs 3 encrypted), with 0 undecodable packets, 0 TCP retransmissions, and 6 out-of-order segments. The visible protocol stack is limited to TCP and UDP, with decoded activity spanning DNS, FTP, HTTP, and WebSocket.

Key capture-wide indicators

Topology and Traffic Footprint

Traffic is centered on 10.1.14.131, which accounts for the full 2,021 packets in the capture view, with the most visible external endpoints being 23.39.148.32 (1,570 packets), 91.92.243.152 (295 packets), 104.21.67.152 (49 packets), and 193.122.6.168 (40 packets). The capture spans 8 hosts, 16 ports, and 2 MAC vendors (Hewlett Packard and NETGEAR).

Geographically, the traffic footprint is concentrated in Irving, United States (1,421 hits) and New York, United States (260 hits), with smaller presence in Frankfurt am Main, Germany (20) and London, United Kingdom (9).

Notable Artifacts and Data Types

The capture surfaced a broad set of payload classifications, including:

• ASCII text variants, including very long-line and escape-sequence forms
• application/octet-stream, application/x-dosexec, and application/zlib
• audio/x-mp4a-latm
• assorted binary signatures such as executable formats, bitmap-like data, and media-related content

This mix suggests the session included both ordinary control traffic and substantial file or payload transfer content.

Credential and Secret Material

A single unique credential was observed and masked as oj********s6. In the keystore, the session held 14 total entries, dominated by TCP secrets, plus several HTTP URI/URL artifacts and one certificate imported from packet #13.

The credential/secret material is concentrated in a few packets:

• Packet #4 contained dense HTTP artifacts:
  • 91.92.243.152 requested /dealer/agwofile.txt
  • 193.122.6.168 requested http://checkip.dyndns.org/
  • a long user-agent string was also captured for that HTTP activity
• Packets #5, #8, and #10 contain repeated FTP credentials for 188.127.239.250, with both username and password fields present and some duplication across decode paths

Several keystore items were duplicated under different labels, indicating the same content was extracted through multiple parsers rather than representing distinct secrets.

Host Intelligence: 91.92.243.152

The most complete threat-intel enrichment applies to 91.92.243.152, a public IPv4 single host (/32) and global unicast address. It sits in 91.92.243.0/24 within the parent range 91.92.240.0 - 91.92.243.255, with WHOIS ownership under OMEGATECH (ISP: lir-tr-mgn-1-MNT, net type ASSIGNED PA) via rdap.db.ripe.net. Registration timestamps show the block was registered 2025-09-12T13:45:38Z and updated 2026-01-21T12:55:37Z.

Host details

PacketSnitch Compacted Network Summary

Executive Overview

The capture is a small, mostly cleartext session set: 2021 packets, 11 streams, 2.26 MB total, with only 3 encrypted packets and 2018 unencrypted. Traffic is concentrated around 10.1.14.131 and a few external hosts, with the bulk of packet volume and heatmap activity centered on 23.39.148.32. The capture contains DNS, FTP, HTTP, and WebSocket activity, spans 6 internet hosts, and shows 6 TCP out-of-order segments but no retransmissions. Geographic hits are clustered in Irving, United States and New York, United States, with smaller presence in Frankfurt am Main, Germany and London, United Kingdom.

Key Host and Infrastructure Notes

The target IP appears clean in available intel sources, and no additional usable VirusTotal enrichment surfaced.

Traffic Composition

The capture’s protocol mix is centered on standard application services:

• HTTP is the most visible application-level activity in the provided stream.
• FTP and DNS are present elsewhere in the capture.
• WebSocket traffic also appears in the decoded protocol set, suggesting at least one interactive or application-driven channel.

The MIME and content-classification footprint shows a wide variety of data types, including:

• text/plain
• text/html
• application/octet-stream
• application/x-dosexec
• application/zlib
• audio/x-mp4a-latm

The data-classification list also includes numerous executable and media-like signatures, such as DOS/370 executable formats, ALAN game data, AC-3 audio, bitmap content, and long ASCII payloads, indicating the capture contains mixed content and transferred blobs rather than a single simple web page.

Top Talkers and Visibility

Additional observed hosts include 10.1.14.2, 149.154.166.110, and 188.127.239.250. The capture also references hostnames for Akamai-delivered infrastructure, including a23-39-148-32.deploy.static.akamaitechnologies.com.

Notable HTTP Retrieval

A clear HTTP transaction targets 91.92.243.152:

• Request: GET /dealer/agwfile.txt
• Response: 200 OK
• Server banner: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30
• Response headers:
  • Content-Type: text/plain
  • Content-Length: 359771
  • Last-Modified: Sun, 18 Jan 2026 18:53:49 GMT
  • ETag: "57d5b-648ae18464b93"

The returned body is a very large text blob rather than a normal short web page, which is more consistent with a bulk data fetch, generated configuration, or some form of transfer payload. No clearly readable credentials, upload indicators, or additional filenames were surfaced in that stream.

Geographic and Network Footprint

The visible footprint is therefore mostly U.S.-centric, with a smaller international presence.

Summary Assessment

• The capture is predominantly unencrypted and operationally simple at the transport layer.

PacketSnitch Compact Traffic Summary

Capture Overview

• 2,021 packets across 11 streams carrying 2.26 MB.
• Traffic is overwhelmingly cleartext: 2,018 unencrypted packets, 3 encrypted, 0 undecodable, 0 TCP retransmissions, and 6 out-of-order segments.
• The capture spans 8 observed hosts and 6 internet hosts, with 10.1.14.131 as the capture anchor and 23.39.148.32 as the main external peer.
• Heatmap activity is concentrated at 1,753 packet hits.
• One masked credential was present: oj********s6.

Host, Reach, and Geography

Protocol and Content Profile

• Decoded protocols: DNS, FTP, HTTP, WebSocket.
• MIME types: application/octet-stream, application/x-dosexec, application/zlib, audio/x-mp4a-latm, text/html, text/plain.
• Content classes include DOS and 370 executables, compact bitmap (Poskanzer), ALAN game data, Alpha u-code object, Atari 68xxx executable, Award BIOS Logo, AC-3 audio, and several long-form ASCII text variants.
• The traffic profile fits mixed web delivery plus binary/object retrieval rather than a single-purpose application flow.

Notable External Host: 91.92.243.152

• WHOIS/RIPE data identifies 91.92.243.152 as OMEGATECH (NetName), lir-tr-mgn-1-MNT, ASSIGNED PA, with block 91.92.243.0/24 inside 91.92.240.0 - 91.92.243.255; registration 2025-09-12T13:45:38Z, update 2026-01-21T12:55:37Z.
• The host is a public IPv4 /32 in New York, United States (10001, America/New_York, 40.7503, -74.0014), and Shodan shows ports 22 and 80 open with CPEs for Linux kernel, OpenSSH 9.2p1, nginx 1.22.1, and Debian Linux.
• Shodan tags it eol-product and lists CVE-2025-23419 and CVE-2023-44487; IPSUM rates it A Clean with 0 threat-intel hits, and it is not a Tor exit node.

HTTP Content

• A clear HTTP request was observed: GET /dealer/agwofile.txt HTTP/1.1 to Host: 91.92.243.152 with Connection: Keep-Alive.
• The associated decoded workspace content was application/octet-stream (14,018 bytes, entropy 7.93) and referenced reallyfreegeoip.org, Google Trust Services / GTS Root R4, WE1, GlobalSign Root CA, and certificate/CRL URLs including http://o.pki.goog/s/we1/nMM0, http://i.pki.goog/we1.crt, http://c.pki.goog/we1/08QUUo4RO8M.crl, http://i.pki.goog/r4.crt, and http://c.pki.goog/r4.crl.

Packet Summary

• Capture profile: 2021 packets, 11 streams, 2.26 MB, 6 internet hosts; traffic is overwhelmingly cleartext TCP/UDP with only 3 encrypted packets and 6 out-of-order segments.
• Protocol mix and content: DNS, FTP, HTTP, and WebSocket are present; visible content spans plain text, HTML, octet-stream, zlib, MP4 audio, and multiple executable/binary classifications, with 1753 heatmap hits.
• Top activity: 10.1.14.131 is the primary local endpoint, while 23.39.148.32 (hostname a23-39-148-32.deploy.static.akamaitechnologies.com) is the main external peer by packet volume; other observed peers include 91.92.243.152, 104.21.67.152, 149.154.166.110, 188.127.239.250, and 193.122.6.168.
• Geographic footprint and identity clues: traffic hits cluster in Irving, United States, then New York, Frankfurt am Main, and London; one masked credential appears: oj********s6.

Notable Events

Analyst Takeaways

• The session looks like a reconnaissance-plus-transfer workflow: public-IP verification, FTP use, and a large HTTP retrieval occurred in the same mostly unencrypted capture.
• The large plain-text response and binary/executable classifications suggest staged or obfuscated payload movement rather than normal web content.
• The capture has no retransmissions and only light TCP reordering, so the observed application data is likely reliable enough for follow-on content review.

Compact Network Summary

Capture-wide picture

• 2,021 packets / 11 streams / 2.26 MB with 6 Internet hosts and 1,753 heatmap hits.
• Traffic is overwhelmingly cleartext: 2,018 unencrypted vs 3 encrypted packets; 0 undecodable, 0 retransmissions, and 6 out-of-order segments.
• Decoded protocols were DNS, FTP, HTTP, and WebSocket over TCP/UDP.
• The capture contains 1 masked credential: oj********s6.

Key activity

• HTTP to checkip.dyndns.org: 10.1.14.131 repeatedly issued GET / with a legacy Mozilla/4.0 (MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) user agent and received HTTP/1.1 200 OK pages titled “Current IP Check” showing 173.66.46.112.
• HTTP file fetch: 10.1.14.131 requested /dealer/agwofile.txt from 91.92.243.152 and received a large text/plain 200 OK response from Apache/PHP on Windows with ETag "57d5b-648ae18464b93".
• Encrypted-material blob: a 14,018-byte high-entropy payload surfaced TLS handshake / certificate content, including reallyfreegeoip.org, Google Trust Services, WE1, GTS Root R4, DOWNGRD, and PKI URLs under o.pki.goog, i.pki.goog/we1.crt, and c.pki.goog.

Hosts and footprint

• Top talkers were 10.1.14.131 (2021 packets), 23.39.148.32 (1570), 91.92.243.152 (295), 104.21.67.152 (49), and 193.122.6.168 (40).
• Observed hosts: 10.1.14.131, 10.1.14.2, 104.21.67.152, 149.154.166.110, 188.127.239.250, 193.122.6.168, 23.39.148.32, 91.92.243.152.
• Geographic hits were concentrated in Irving, United States (1421) and New York, United States (260), with smaller presence in Frankfurt am Main (20) and London (9).
• Exposed ports included 21, 53, 80, 443 and several high ports: 35644, 51616–51622, 59216, 61756, 62078, 62797.

Content and file-type signals

• MIME types observed: application/octet-stream, application/x-dosexec, application/zlib, audio/x-mp4a-latm, text/html, text/plain.
• Data-classification hints include multiple executable and compressed/bitmap formats, plus long-line ASCII text and media-related markers, suggesting mixed staged content rather than a single benign file type.

Packet Summary

High-level capture view

• 2,021 packets across 11 streams and 2.26 MB of traffic.
• 8 hosts were observed, with 6 internet hosts.
• Traffic was overwhelmingly unencrypted: 2,018 unencrypted packets vs 3 encrypted.
• Network behavior was clean from a reliability standpoint: 0 retransmissions, 6 out-of-order segments, 0 undecodable packets.

Traffic and protocol observations

• Core protocol activity spans TCP, UDP, DNS, FTP, HTTP, and WebSocket.
• The most visible external endpoint is 23.39.148.32 (1570 packets), followed by 91.92.243.152 (295), 104.21.67.152 (49), and 193.122.6.168 (40).
• Geographic hits cluster in Irving, United States (1421) and New York, United States (260), with smaller presence in Frankfurt am Main and London.
• MIME/content types include application/octet-stream, application/x-dosexec, application/zlib, audio/x-mp4a-latm, text/html, and text/plain.
• The capture contains 1,753 heatmap packet hits and one masked credential: oj****s6.

Decoded content and notable artifacts

• FTP, SMB, and SSH decode views exposed no usable protocol payloads; the attempts surfaced only decode failures.
• TELNET decoding did yield content from traffic involving 104.21.67.152 and 10.1.14.131:
  • Telnet negotiation options seen: DO Option 28 and WONT Option 253.
  • One decoded packet contained certificate-fetch URLs: http://i.pki.goog/r4.crt and http://c.pki.goog/r/r4.cr....
• The capture also includes a wide range of decoded file/content classifications, notably executable formats, ASCII text variants, bitmap data, audio, and game-data artifacts, indicating mixed application content traversing the session set.

Packet Capture Summary

High-level picture

• The capture contains 2021 packets across 11 streams and 2.26 MB of traffic.
• Traffic is overwhelmingly unencrypted: 2018 unencrypted vs 3 encrypted packets.
• There are 6 internet hosts, 0 undecodable packets, 0 TCP retransmissions, and 6 out-of-order segments.
• The traffic spans TCP and UDP only, with decoded activity in DNS, FTP, HTTP, and WebSocket.

Key endpoints and geography

Decoded activity

• A protobuf decode over 25 packets surfaced one usable record: Packet 9 from 104.21.67.152$9 contained field 821 (len=42, hex beginning c7 a8 15 bf e2 40 4d 08 39 09 23 e8 7a c8 b3 02 20 19 41 a7 b8 c3 5e ed …), field 2 (fixed32=907d60d4), and field 45544 (len=3, 01 00 04).
• Other decode views on the same 25-packet set did not yield usable content.
• The capture also includes varied payload classifications such as ASCII text, application/octet-stream, application/x-dosexec, application/zlib, audio/x-mp4a-latm, and several binary/executable formats.

Notable artifacts

Analyst takeaways

• The session is dominated by a single internal host talking to a small set of internet services, especially 23.39.148.32 and 104.21.67.152.
• The traffic profile is mostly cleartext and includes file- and web-oriented protocols, with one sparse protobuf structure discovered in the 25-packet decode sample.

Compact Capture Summary

• Traffic shape: 2,021 packets across 11 streams and 2.26 MB, mostly unencrypted (2,018 packets) with 6 out-of-order segments and no retransmissions or undecodable packets.
• Protocol mix: TCP/UDP carrying DNS, FTP, HTTP, and WebSocket; visible content includes text, binaries, executables, audio, and bitmap-like payloads.
• Top endpoints and footprint: 10.1.14.131 is the local top talker, while 23.39.148.32 dominates peer traffic; other active hosts include 91.92.243.152, 104.21.67.152, and 193.122.6.168. Geolocation hits cluster in Irving, US and New York, US, with smaller activity in Frankfurt am Main and London.
• Surface indicators: Ports in use include 21, 53, 80, 443, and several ephemeral ports; hostnames observed include a23-39-148-32.deploy.static.akamaitechnologies.com, and one masked credential appears as oj********s6.

Notable Decode Findings

• MessagePack view: The decoder exposed 25 MSGPACK-labeled packets, mostly binary payloads interpreted as likely int values with first byte 0x17 and occasional 0x16; packet sizes shown ranged from 101 to 1,061 bytes. The visible sources were 104.21.67.152 and 10.1.14.131, with packet labels such as $48, $46, $44, $42, and lower-numbered siblings.
• Protobuf view: Only one packet from 104.21.67.152 yielded usable protobuf fields: field 821 (wire 2, 42 bytes), field 2 (fixed32=907d60d4), and field 45544 (wire 2, 3 bytes 01 00 04).
• Interpretation: The decoded 0x17 03 01 ...-style payloads suggest TLS-like encrypted application data being misclassified by the codec view, while the protobuf hit indicates at least one structured blob embedded in traffic from 104.21.67.152.

Compact Network Analysis Summary

• Capture profile: 2,021 packets across 11 streams and 2.26 MB, with 6 Internet hosts and 0 undecodable packets. Traffic was overwhelmingly cleartext: 2,018 unencrypted vs 3 encrypted packets, with 6 out-of-order segments and no retransmissions.
• Protocol mix and content: TCP/UDP traffic decoded to DNS, FTP, HTTP, and WebSocket. The payload mix includes text, executable, bitmap, audio, and compressed/object data, with MIME types spanning application/octet-stream, application/x-dosexec, application/zlib, audio/x-mp4a-latm, text/html, and text/plain.
• Endpoints and geography: Top activity centered on 10.1.14.131 and 23.39.148.32 (hostname a23-39-148-32.deploy.static.akamaitechnologies.com), with additional hosts 91.92.243.152, 104.21.67.152, 193.122.6.168, and 149.154.166.110. Heatmap hits were concentrated in Irving, US, then New York, US, with smaller activity in Frankfurt am Main and London.
• Decoded application data: The Decodes workspace surfaced 25 BER-decoded packets, including repeated structures from 104.21.67.152 and 10.1.14.131 beginning with universal tag 0x17 and values such as 01 04 20 and 01 00 20; one 104.21.67.152 packet had 15 BER nodes and another 10.1.14.131 packet included a constructed context-specific 0xAB. The MSGPACK view also reported 25 packets, with several 0x17 and 0x16 first-byte records, while the BSON and LDAP views produced no usable decoded content.
• Credentials and services: One masked credential was present: oj********s6. Exposed ports included 21, 53, 80, 443, and several high ephemeral ports.

PacketSnitch Summary

Capture Overview

• 2021 packets across 11 streams, totaling 2.26 MB.
• Traffic is almost entirely unencrypted: 2018 unencrypted vs 3 encrypted packets.
• No packet loss indicators beyond 6 out-of-order segments; no retransmissions.
• The pcap spans 8 hosts, 16 ports, 2 MAC vendors, and 4 geographic hits.

Main Traffic Picture

• Top talkers are 10.1.14.131 and 23.39.148.32, with secondary activity from 91.92.243.152, 104.21.67.152, and 193.122.6.168.
• Geographic hits cluster in Irving, United States and New York, United States, with smaller presence in Frankfurt am Main and London.
• Heatmap hits: 1753.

Protocol and Content Findings

• Observed protocols include DNS, FTP, HTTP, and WebSocket over TCP/UDP.
• MIME/content types span application/octet-stream, application/x-dosexec, application/zlib, audio/x-mp4a-latm, text/html, and text/plain.
• Data classifications indicate mixed binary and text material, including executable-like blobs, compressed content, bitmap data, audio, and long-line ASCII text.

Decoded DNS Activity

• 25 DNS packets were decoded, centered on repeated QUERY messages with Message ID 0x1703.
• DNS flags are consistent across the visible records: RD set; AA, TC, RA, AD, CD, and Z clear.
• Returned rcodes include NoError, NotImp, FormErr, and ServFail.
• Several records triggered Resource-record count too large; truncating walk., indicating oversized DNS structures in the capture.
• Visible DNS sources are 104.21.67.152 and 10.1.14.131.

Other Decode Views

• SMPP decoding was attempted on 25 packets but yielded no usable decoded fields.
• DER decoding surfaced 25 packets, with visible structured blobs from 104.21.67.152 and 10.1.14.131; the entries include short tagged values such as 0x17 plus larger context/application/private elements.

Credentials

• One unique credential was observed: oj********s6.

PacketSnitch Summary

Capture Overview

• Traffic scale: 2,021 packets across 11 streams and 2.26 MB.
• Endpoint mix: 6 Internet hosts, 8 observed hosts total; traffic is overwhelmingly cleartext with only 3 encrypted packets.
• Quality signals: 0 undecodable packets, 0 TCP retransmissions, and 6 out-of-order TCP segments.
• Top talkers: 10.1.14.131 was the capture-side anchor; the dominant peer was 23.39.148.32 with 1,570 packets, followed by 91.92.243.152 with 295.
• Geography: hits cluster in Irving, United States and New York, United States, with smaller presence in Frankfurt am Main, Germany and London, United Kingdom.
• Protocols and content: TCP/UDP with decoded DNS, FTP, HTTP, WebSocket; MIME evidence included text/html, text/plain, application/octet-stream, application/x-dosexec, application/zlib, and audio/x-mp4a-latm.
• Credential artifact: one masked credential surfaced: oj********s6.

Key Activity

• Name-resolution chatter: 25 packets were decoded as LLMNR and another 25 as NBNS. Both used transaction/message ID 0x1703 with RD set, and both showed repeated mixed response codes rather than a single stable outcome.
• Browse/datagram noise: 25 packets were also processed as NBDGM, but the visible results were decode failures only, so no substantive payload was surfaced.
• SNMP sweep: 25 packets were processed as SNMP, though the usable preview did not surface payload details.
• ISO8583 application traffic: 25 packets were decoded as ISO8583. The clearest messages were MTI 0100 Authorization Request frames from 10.1.14.131, including packet 46 with a rich field set and notable values such as Field 37 08DED82E9EA818DEFC5C6DD3, Field 38 4F4B555E8A83, Field 39 026A, Field 41 E1D3343E54E0C114, and Field 42 BBB6B304B556DD7E41CCC3A87DB06C.

Notable Hosts

Analyst Takeaways

• The pcap is dominated by cleartext application and name-resolution traffic, not encrypted sessions.
• The most concrete application data is ISO8583 payment-style request traffic from 10.1.14.131.
• The recurring 0x1703 LLMNR/NBNS activity and the repeated response-code variation suggest unstable or noisy local name-resolution behavior.

Compact Traffic Summary

• Capture scope: 2,021 packets / 11 streams / 2.26 MB, with 6 internet hosts and 0 undecodable packets; traffic is overwhelmingly cleartext (2,018 unencrypted vs 3 encrypted) and shows 6 TCP out-of-order segments, no retransmissions.
• Protocol mix: TCP and UDP with decoded DNS, FTP, HTTP, and WebSocket; MIME/content evidence includes application/octet-stream, application/x-dosexec, application/zlib, audio/x-mp4a-latm, text/html, and text/plain.
• Geography and topology: heatmap hits concentrated in Irving, US (1421) and New York, US (260), with smaller presence in Frankfurt am Main, Germany (20) and London, UK (9); visible hosts include 10.1.14.131, 10.1.14.2, 104.21.67.152, 149.154.166.110, 188.127.239.250, 193.122.6.168, 23.39.148.32, and 91.92.243.152.
• Key credential: one masked credential was observed: oj********s6.

Notable decoded activity

Traffic context

• 23.39.148.32 is the dominant peer by packet count at 1,570, followed by 91.92.243.152 (295), 104.21.67.152 (49), and 193.122.6.168 (40).
• Ports in use span 21, 53, 80, 443 plus several high ports (35644, 51616–51622, 59216, 61756, 62078, 62797), consistent with mixed service and client-side sessions.

Compact Network Summary

• Capture scope: 2,021 packets across 11 streams, 2.26 MB total, with 6 internet hosts and 3 encrypted packets; the trace is overwhelmingly cleartext, with 0 undecodable packets, 0 retransmissions, and 6 out-of-order segments.
• Protocol mix and content: TCP/UDP traffic decodes to DNS, FTP, HTTP, and WebSocket, while the payload mix includes web objects, executables, audio, text, and bitmap-like data; MIME types observed were application/octet-stream, application/x-dosexec, application/zlib, audio/x-mp4a-latm, text/html, and text/plain.
• Infrastructure and footprint: Top talkers are 10.1.14.131 and 23.39.148.32 (Akamai hostname a23-39-148-32.deploy.static.akamaitechnologies.com), with additional activity from 91.92.243.152, 104.21.67.152, and 193.122.6.168; observed ports include 21, 53, 80, 443 and high ports 35644, 51616-51622, 59216, 61756, 62078, 62797.
• Geography and credentials: Heatmap hits cluster in Irving, United States, then New York, United States, with smaller hits in Frankfurt am Main and London; one masked credential appears in the capture: oj********s6.

Notable decoded activity

• Repeated decode targets: Multiple decoders were applied to the same 25-packet set involving 10.1.14.131 and 104.21.67.152; BitTorrent failed to yield usable content, while WEBP, GIF, SNMP, DHCPv6, and LLMNR views surfaced content from the same traffic.
• LLMNR behavior: The LLMNR decode shows Message ID 0x1703, Standard Query, RD set, and AA/TC/RA/Z/AD/CD clear; visible replies include Success, RCODE4, Server Failure, and Unspecified Error, with repeated truncation warnings for oversized resource-record walks.
• DHCPv6/lease-query artifacts: The DHCPv6 decode is dominated by STARTTLS and ACTIVE-LEASEQUERY; several entries carry Transaction ID: 0x030100, and one long option value includes certificate-like material plus the string realalyfreegeoip.org.
• Web image traffic: WEBP and GIF decodes both show 25 packets, predominantly between 104.21.67.152 and 10.1.14.131, with packet sizes ranging from 62 bytes up to 1,344 bytes.
• Traffic composition clue: The presence of executable classifications, web image decodes, and cleartext DNS/FTP/HTTP/WebSocket suggests mixed application traffic with content transfer and protocol masquerading within the same short capture window.

Compact Network Summary

• Capture scope: 2,021 packets across 11 streams and 2.26 MB; 6 Internet hosts; 3 encrypted vs 2,018 unencrypted packets; 0 retransmissions and 6 out-of-order segments.
• Protocols and content: TCP/UDP traffic decoded as DNS, FTP, HTTP, WebSocket; payload classes ranged from text and compressed data to executables, media, bitmap-like content, and ALAN/game-related binaries. MIME types observed were application/octet-stream, application/x-dosexec, application/zlib, audio/x-mp4a-latm, text/html, and text/plain.
• Top activity and footprint: 10.1.14.131 accounted for the full 2,021-packet capture view; major external talkers were 23.39.148.32 (1,570), 91.92.243.152 (295), 104.21.67.152 (49), and 193.122.6.168 (40). Heatmap hits totaled 1,753, concentrated in Irving, United States (1,421) and New York, United States (260), with smaller presence in Frankfurt am Main (20) and London (9).
• LLMNR activity: 25 packets decoded as LLMNR, shown newest-first, with Message ID 0x1703, Standard Query, RD set, and AA/TC/RA/Z/AD/CD clear; visible Rcode values were RCODE4, Success, and Server Failure, and the walk warned: Resource-record count too large; truncating walk. The preview surfaced 10.1.14.131 and 104.21.67.152.
• Surface details: Hosts present were 10.1.14.2, 10.1.14.131, 104.21.67.152, 149.154.166.110, 188.127.239.250, 193.122.6.168, 23.39.148.32, and 91.92.243.152; ports included 21, 53, 80, 443, 35644, 51616-51622, 59216, 61756, 62078, and 62797. MAC vendors were Hewlett Packard and NETGEAR, hostnames included 23.39.148.32 and a23-39-148-32.deploy.static.akamaitechnologies.com, and one masked credential appeared: oj********s6.

Compact Network Summary

• Capture scope: 2,021 packets across 11 streams, 2.26 MB total, with 6 internet hosts and 8 observed hosts overall. The capture was overwhelmingly cleartext: 2,018 unencrypted packets vs 3 encrypted, with 6 out-of-order segments and no retransmissions.
• Protocols and content: TCP/UDP carried DNS, FTP, HTTP, and WebSocket traffic. The payload mix included application/octet-stream, application/x-dosexec, application/zlib, audio/x-mp4a-latm, text/html, text/plain, plus multiple executable/text classifications and a compact bitmap format. One masked credential surfaced: oj********s6.

Traffic and endpoints

Notable host context

• 104.21.67.152 is a public IPv4 /32 global-unicast host with a single usable address, class A default context, and binary form 01101000 00010101 01000011 10011000.
• WHOIS maps 104.21.67.152 to Cloudflare, Inc. (CLOUDFLARENET) under 104.16.0.0/12, direct allocation, registered 2014-03-28T11:30:55-04:00 and updated 2024-09-04T06:51:26-04:00.
• Shodan tags it as cdn with CPE cpe:/a:cloudflare:cloudflare; listed ports are 80, 443, 2052, 2053, 2082, 2083, 2086, 2087, 2095, 2096, 8080, 8443, 8880, with no hostnames or vulns reported and GeoIP location fields unavailable.

Decoded activity

• A decoder view surfaced 25 LLMNR packets, including Query message ID 0x1703 with RD set and AA/TC/RA/Z/AD/CD clear; the decode showed both RCODE4 and Success and repeatedly hit a record-count truncation condition.

Compact Network Summary

Traffic profile

• 2,021 packets across 11 streams and 2.26 MB.
• Mostly cleartext: 2,018 unencrypted packets, 3 encrypted packets, 0 undecodable packets, 0 TCP retransmissions, and 6 out-of-order segments.
• Only 6 internet hosts were seen, with 8 total observed hosts and 2 MAC vendors: Hewlett Packard and NETGEAR.

Protocols, content, and capture artifacts

• Decoded traffic included DNS, FTP, HTTP, and WebSocket over TCP/UDP.
• MIME types surfaced application/octet-stream, application/x-dosexec, application/zlib, audio/x-mp4a-latm, text/html, and text/plain.
• Payload classifications were heavily mixed, spanning text, executables, audio, compressed data, bitmap/media artifacts, and multiple legacy binary formats.
• The capture produced 1,753 heatmap packet hits.
• One masked credential was present: oj********s6.

Hosts and activity

• Ports seen: 21, 53, 80, 443, 35644, 51616–51622, 59216, 61756, 62078, 62797.
• Geographic hits concentrated in Irving, United States (1,421) and New York, United States (260), with smaller activity in Frankfurt am Main (20) and London (9).

Notable endpoint detail: 104.21.67.152

• Public IPv4 /32, single-host subnet with mask 255.255.255.255.
• WHOIS maps it to Cloudflare, Inc. (CLOUDFLARENET) within 104.16.0.0/12, registered 2014-03-28 and updated 2024-09-04.
• Shodan exposure includes ports 80, 443, 2052, 2053, 2082, 2083, 2086, 2087, 2095, 2096, 8080, 8443, and 8880, with cdn tag and CPE cpe:/a:cloudflare:cloudflare.
• GeoIP resolved without usable location detail.
• Threat intel is clean: IPsum shows A Clean with 0 hits; Tor status is negative.
• Decoded binary content tied to this endpoint included a 14,018-byte application/octet-stream sample with high entropy (7.93) and TLS/certificate strings referencing reallyfreegeoip.org, Google Trust Services, GTS Root R4, and pki.goog / c.pki.goog / i.pki.goog.