my job stores internet usage records in a database, some of the data is pretty cryptic but for the most part we just ignore this and do reports directly from this data and give them directly to the departments. However I've been asked to investigate some specific records and try to give a more meaningful description of the general activity that was going on (was the user using yahoo messenger, just browsing emails, etc).
many of the records share a general uri format:
http://*ip number*/*action code*/*some kind of identification gibberish*/*index number*
from what I seen, the action code is either send, idle, open, or close
so for example: (these are listed as a uri field, NOT url)
http://68.142.251.50/send/2OSmQt969gMmGO7V/27
http://68.142.251.50/send/2OSmQt969gMmGO7V/4
http://68.142.251.50/idle/2OSmQt969gMmGO7V/6
http://209.73.191.52/open/1
Most of these IPs resolve to the yimg.com domain which ofcouse is a yahoo domain, some dont resolve but still have that general uri format so im guess its still an yimg.domain. So for example:
Name:
dxsflod003.bcst.cdn.dxs.yimg.comAddress: 68.142.251.50
Simply putting these uri in a browser does nothing.
other fields of these records:
clientprocess: Shockwave Flash
mimetype: application/x-fcs
From this information does anyone have any good guesses of what kind of activity is occurring? My best guess is maybe its just some yahoo page that keeps refreshing and loading various images.
Thank you
