Skip to content

Latest commit

 

History

History
78 lines (73 loc) · 9.75 KB

RIG_Pattern.md

File metadata and controls

78 lines (73 loc) · 9.75 KB

RIG Pattern

2017-06-12

2017/06/12 13:00:25;46.229.220.31;80;46.229.220.31;199860;Stack Data Network LLC;/?Style&sessid=CeliA86EuKLBSOge03BeAKgxplY5fWlkX8P-miULSyx6Y0cKE-CW9UU4HupE&param=z3_QMvXcJwDQDoTJMvrESLtEMU_OFUKK2OH_783VCZz9JHT1vvHPRAP0tgW&Tech=3820
2017/06/12 13:05:16;83.166.241.159;80;83.166.241.159;24936;LLC Management Company Svyaz;/?Video&param=z3bQMvXcJwDQDoTFMvrESLtEMU_OH0KK2OH_783VCZr9JHT1vvHPRAP7tgW&sessid=CeluD9aAqL-BZPQK3hEPRcwNon4YOU1sT8firhkXQz0XKiMKE-CW9UU4HupE&Sport=3033
2017/06/12 13:05:16;83.166.241.159;80;83.166.241.159;24936;LLC Management Company Svyaz;/?Sport&param=wHvQMvXcJwDMFYbGMvrESKNbNknQA0KPxpH2_drRdZqxKGni2eb5UUSk6FiCEh3&sessid=h8KIvK-BTPwHmiEHVKldhzYpVW1oR_6qqikaDzhWbhZWK-UTYZwJ1z6LRVvQ42w&Sport=2056
2017/06/12 13:10:17;83.166.241.159;80;83.166.241.159;24936;LLC Management Company Svyaz;/?Travel&sessid=m3U8PMqe-RTOgLpi0TVKVNinIZVV1MR8vz_jUTTm0LNiMPQ_RbcUTp1u9CTUbI&param=wXfQMvXcJwDQDIbGMvrESLtBNknQA0KK2I32_dqyEoH9eWnihNzUSkr06B2aC&Video=2533
2017/06/12 13:10:18;83.166.241.159;80;83.166.241.159;24936;LLC Management Company Svyaz;/?Money&sessid=Cel-DoPMpKONSPQDhjBSFLwRgntxZVVwT_6-mh0PUmhXP1sWA-yW9UU4HupE&param=z3zQMvXcJwDQDoTEMvrESLtEMU_OG0KK2OH_783VCZv9JHT1vvHPRAP6tgW&Regions=5223
2017/06/12 13:15:19;83.166.241.159;80;83.166.241.159;24936;LLC Management Company Svyaz;/?Tech&sessid=m2FpPR-JLMGPAC0jxSGL1Rgn9tcBFwb9qGp3ULTnRGYhcTQ9R3ZUTp1u9CcUbI&param=wXzQMvXcJwDQDobGMvrESLtFNknQA0KK2I_2_dqyEoH9fWnihNzUSkrx6B2aC&Sport=2601
2017/06/12 13:15:20;83.166.241.159;80;83.166.241.159;24936;LLC Management Company Svyaz;/?Regions&param=z3zQMvXcJwDQDoTGMvrESLtEMU_OGkKK2OH_783VCZ39JHT1vvHPRAPwtgW&sessid=CelzYpPIoKrsFPle1iBfWeAxinogLUl9H9Kir3xDRmBXKgZ6D-iW9UU4HupE&Health=5153
2017/06/12 13:20:16;83.166.241.159;80;83.166.241.159;24936;LLC Management Company Svyaz;/?Travel&sessid=xfF5fOFZPAG3jEbVKgVnyN9cUVlGoa-mj0ndzkWa1JSF-RDeMwlNq6KlJLV_mhj2&param=w3bQMvXcJxjQFYbGMvzDSKNbNk_WHViPxoyG9MildZyqZGX_k7TDfF-qoVTcCgWR&Sport=3755
2017/06/12 13:20:16;83.166.241.159;80;83.166.241.159;24936;LLC Management Company Svyaz;/?Money&param=wXzQMvXcJwDQCobGMvrESLtMNknQA0KK2Iz2_dqyEoH9cmnihNzUSkrw6B2aC&sessid=m2F8PQqK7dXbgS3jUyDKAUznohYUwgbpK342EPUzELJ1J-D_BSKUTp1u9CXUbI&Health=4058
2017/06/12 13:25:17;83.166.241.159;80;83.166.241.159;24936;LLC Management Company Svyaz;/?Video&sessid=hofYpKrRVOlDmjxOJeFZhzo1fVFtB__qpiheDyBPIgMLW9RSMZg91z6LRVvQy2w&param=wHzQMvXcJwDGFYbGMvrET6NbNknQA0GPxpH2_drZdZqxKGni0-b5UUSk6FWCEh3&Money=4386
2017/06/12 13:25:17;83.166.241.159;80;83.166.241.159;24936;LLC Management Company Svyaz;/?Regions&param=znbQMvXcJwDQDorGMvrESLtEMU3QA0KK2OH_76qyEoH9JHT1vrTUSkrttgWC&sessid=eliDofV4JLVSOgbl20aBLVFnnIcLUA5Fo_-qhkLWzx_OhJaG_RW9UToBvdeW&Regions=4300
2017/06/12 13:30:19;83.166.241.159;80;83.166.241.159;24936;LLC Management Company Svyaz;/?Money&sessid=h9_UlK-FUNVK3hUKEKAY1nY0MB11G9PimjkfTnB_Og8OL-hyMZgt1z6LRVvQ52w&param=wHfQMvXcJwDJFYbGMvrESKNbNknQA06PxpH2_drTdZqxKGni1Ob5UUSk6F6CEh3&Travel=4874
2017/06/12 13:30:20;83.166.241.159;80;83.166.241.159;24936;LLC Management Company Svyaz;/?Money&param=znnQMvXcJwDQDoLGMvrESLtEMU3QA0KK2OH_76yyEoH9JHT1vrTUSkrttgWC&sessid=elmHp6IpKLJWNQbijxCHKVE0n4pYUghA8qiviUaDyBabhZOG_B29UToBvdeW&Sport=4474

2017-03-12 - Pattern switch

2017/03/12 18:15:20;rty.taffconstruction.com;80;5.200.53.22;48096;OOO IT-Grad;/?q=w37QMvXcJxnQFYbGMv3DSKNbNkfWHViPxouG9MildZeqZGX_k7fDfF-qoV7cCgWR&oq=xfAqKbIFbgvijkaDcwcwmthZUlsV9qiqhkKHzkSV1peFq0GLaQ4Q9qKlJLV_mhj2
2017/03/12 18:20:18;rty.taffconstruction.com;80;5.200.53.22;48096;OOO IT-Grad;/?oq=CelvQ_PV7L7RQPQvk30GFLwI0ztsLUl0R8quqh0LUyxDK1p6G-yW9UU4HupE&ct=border&que=border.118ut66.406p9g2a8&fix=border.118hb57.406p5u4c9&q=z3_QMvXcJwDQDoTDMvrESLtEMU_OG0KK2OH_783VCZf9JHT1vvHPRAPwtgW&biw=border.85fk114.406f7e9f8

More example : http://pastebin.com/raw/LPTJAMYp

2017-02-25 - Pattern switch

2017/02/25 18:50:37;1top.cpamarketingmedia.com;80;92.53.97.144;9123;TimeWeb Ltd.;/?oq=xfUpLLJVOgqyjUKIfgVjz4sPVFMVov-riEfVnESc0p6E_kbcNw9G-qKlJLd_mhj2&q=w3jQMvXcJxzQFYbGMv7DSKNbNknWHViPxoyG9MildZqqZGX_k7PDfF-qoV3cCgWR&word=mutilate&biw=blouse.96rg88.406a4p3i8&ct=blouse
2017/02/25 19:50:16;new.hjx4yz.xyz;80;92.53.127.252;9123;TimeWeb Ltd.;/?oq=elmD9_stKLQFOgGy3ECGKQdkz4ZfBFMToaH4hkbQnEXJ0sKFqRG9UToBvdeW&q=zn3QMvXcJwDQDoLGMvrESLtEMUbQA0KK2OH_76qyEoH9JHT1vrPUSkrttgWC

2017-02-24 - Pattern switch

2017/02/24 22:30:17;acc.dentalko.com;80;217.107.34.243;8342;JSC RTComm.RU;/?br_fl=4169&oq=h9KcsKLYGOADphBSBeVRjz4haVVlG8Kim30CBzRHIhJ-L9ByNNw11z6LRVvQ42w&tuif=5562&biw=educate.75bg110.406h2k9a1&q=wHbQMvXcJwDPFYbGMvrER6NbNknQA06PxpH2_drXdZqxKGni2eb5UUSk6F-CEh3&word=hawker&yus=educate.79ek73.406c3x9p0&ct=educate
2017/02/24 22:35:21;acc.dentalko.com;80;217.107.34.243;8342;JSC RTComm.RU;/?biw=throw.76wu58.406o1e8l8&q=wHfQMvXcJwDHFYbGMvrETqNbNknQA0-PxpH2_drTdZqxKGni1-b5UUSk6FWCEh3&oq=hofssfLEBOgbijxGBKVFgyYteAV4Q9_-ri0DRzx-YgMaL-RfeNQ51z6LRVvQy2w&word=approachable&ct=throw
2017/02/24 22:40:17;acc.dentalko.com;80;217.107.34.243;8342;JSC RTComm.RU;/?word=approachable&biw=educate.89oa115.406r5v7k2&q=wXbQMvXcJwDQC4bGMvrESLtDNknQA0KK2In2_dqyEoH9e2nihNzUSkry6B2aC&ct=educate&oq=m2D9PQpKLFZPgriiBHRLQc0lY9aVA5Bov-p20jQyB7Ig5PW-BfcUTp1u9CdUbI

October 2016

  • 2016-10-24 - RIG-v Pattern
  • 2016-11-01 - RIG standard is now using same pattern (Old pattern only in Empire Pack)

Landing

/?es_sm=136&aqs=chrome.101a90.406k1t8&oq=m2D8_d4KrADOQq0j0fVe1AwnIpYUwhC8Piui0SGzBCfiZTU9R3bUTp1u9CTUbI&ie=UTF-16&sourceid=chrome&q=wX_QMvXcJwDQDYbGMvrESLtGNknQA0KK2I32_dqyEoH9cmnihNzUSkr36B2aC
/?es_sm=100&oq=m3RpvEoJLRTaFDhiBSFe1Yyn4xUWg8SpK6ti0LRwR-a1JCK9B2OUTp1u9CdUbI&ie=UTF-16&aqs=yandex.123z92.406c2l0&sourceid=yandex&q=wXjQMvXcJwDQC4bGMvrESLtHNknQA0KK2I32_dqyEoH9fWnihNzUSkr36B2aC
/?sourceid=msie&q=wX_QMvXcJwDQCYbGMvrESLtENknQA0KK2Ir2_dqyEoH9e2nihNzUSkry6B2aC&oq=m3ZpvIuKrUFaQOyhEHRLQAwyIpcW1wQ8Pyv3UHWy0PPh5OF_haLUTp1u9CRUbI&ie=UTF-8&aqs=msie.74l104.406o3j2&es_sm=99
/?es_sm=121&sourceid=mozilla&ie=Windows-1251&q=w3bQMvXcJxzQFYbGMvnDSKNbNk3WHViPxoqG9MildZuqZGX_k7rDfF-qoV7cCgWR&aqs=mozilla.120h78.406e3c3&oq=xfZ5KecCbAS0j0PTfQQwn4dcAVlA8Kyp2EHVyUWcgp-L9BSFaQIUraKlJLJ_mhj2
/?sourceid=edge&oq=CelnX8PF5LecEPVK33xfTKAwwnYlcBA5G9KqqiROGwESV1cPR_SW9UU4HupE&aqs=edge.103f77.406p1q2&es_sm=97&q=z3nQMvXcJwDQDoTGMvrESLtEMU_OG0KK2OH_783VCZr9JHT1vvHPRAPytgW&ie=UTF-16
/?sourceid=yandex&ie=UTF-16&q=z3fQMvXcJwDQDoTJMvrESLtEMU_OHkKK2OH_783VCZf9JHT1vvHPRAP6tgW&aqs=yandex.129i102.406e3y9&es_sm=92&oq=CegmC_PEoLLBWaQPm3EeAegE1yIZaWlMb96ymjxfXyx-dgsOC-CW9UU4HupE
/?q=wXjQMvXcJwDQCobGMvrESLtCNknQA0KK2I32_dqyEoH9fGnihNzUSkr06B2aC&ie=UTF-8&oq=m2A8_olLLQCblXoi0aELVcyn9tbBg5B8PupiEiByUPJ1caL-BPfUTp1u9CUUbI&aqs=yandex.114w75.406f1v2&sourceid=yandex&es_sm=117
/?q=z3nQMvXcJwDQDoTAMvrESLtEMU_OFUKK2OH_783VCZ39JHT1vvHPRAP0tgW&oq=CelTS9vEsKbdYbAOz2UOHeQ0zyNtcBw4VoaGqjEPTwR7O1J6B9SW9UU4HupE&aqs=edge.122c70.406o4u7&sourceid=edge&es_sm=98&ie=Windows-1251

Flash

/?oq=D86YqL-FUNAu0jxCALlRhmItcAAsUpqmr3UnQzxWVg8GKqxy9Zg9C-5elV7R8jg&ie=Windows-1251&q=zn7QMvXcJwDQDoXGMvrESLtEMUnQA0KK2OH_76yyEoH9JHT1vrXUSkrttgWCelq&sourceid=edge&aqs=edge.106w109.406c6t8&es_sm=126
/?es_sm=109&ie=Windows-1252&sourceid=mozilla&q=w37QMvXcJx_QFYbGMv3DSKNbNk7WHViPxoeG9MildZmqZGX_k7vDfF-qoVXcCgWRxfs&aqs=mozilla.70j116.406y4v8&oq=tfrdZOwTi2BaAKgBknN0OUVMR__yv3UDSyhOYiJGL-0GKaQxN_KKdELU821rFjLVTJg
/?ie=UTF-16&aqs=yandex.101x67.406q9z1&es_sm=116&sourceid=yandex&q=znnQMvXcJwDQDorGMvrESLtEMUnQA0KK2OH_76uyEoH9JHT1vrHUSkrttgWCelv&oq=ZpvAqKucEPQGyiRTWflQ1mI1UVFkUoqj9jUPXnEWbhJCB-xa9aQ5E_ZClV7Z8jg
/?aqs=edge.128u86.406j0s9&q=znbQMvXcJwDQDoPGMvrESLtEMU3QA0KK2OH_76qyEoH9JHT1vrXUSkrttgWCelS&oq=F8aZ_fOdSOwuyixSDcgQyz41aV11F96n9jkHXwB-diJ_Trxa9ZQJM9pClV7d8jg&sourceid=edge&ie=Windows-1251&es_sm=101
/?q=z3bQMvXcJwDQDoTHMvrESLtEMU_OFUKK2OH_783VCZv9JHT1vvHPRAP0tgWCel&oq=nX8PF5K-cEPVK33xfTKAAwnYlcBA5G9KquiROGwESV1cPR_CWMaQNG_aLWU7lt&es_sm=106&ie=Windows-1252&sourceid=msie&aqs=msie.115o77.406z2i5
/?oq=FpvIkL7dSO1fhhULReQVgyNpVWl0b_qGui0TUnxSeiZaA_EGNUQJD9pCdFYF4nws&sourceid=edge&ie=UTF-16&q=wX7QMvXcJwDQDIbGMvrESLtMNknQA0KK2I32_dqyEoH9fWnihNzUSkr26B2aCm2&es_sm=108&aqs=edge.91x97.406x6w5
/?oq=A8_slLLQCblXoikaELVcyn9taBg5B8PupiEKByUPJ1caL_hPfUQlD_ZuUFIF4nws&q=wXrQMvXcJwDQAobGMvrESLtDNknQA0KK2Ir2_dqyEoH9f2nihNzUSkr16B2aCm2&ie=UTF-16&aqs=chrome.124m87.406q2m1&es_sm=128&sourceid=chrome
/?oq=PAtLrBROAuwiUXSLwNmnokPBg8Sov2uiBfdyxSaiZ-Kr0GEYgJ195GVHbA66B6ymQ&sourceid=mozilla&es_sm=143&aqs=mozilla.109l110.406g1n6&q=wHnQMvXcJwDOFYbGMvrERqNbNknQA0aPxpH2_drXdZqxKGni1-b5UUSk6FmCEh3h_&ie=Windows-1251

Payload

/?aqs=yandex.118x103.406x5x6&oq=_XoPQvJOFUNFbj2EXVKgVhmI8PA11C96yo3UTTyh-f1p_U_iWKZwtE-qLIVLg4&ie=Windows-1252&q=z3_QMvXcJwDQDoTGMvrESLtEMU_OFEKK2OH_783VCZ79JHT1vvHPRAPytgWCeg&es_sm=106&sourceid=yandex
/?es_sm=122&aqs=yandex.72h87.406n5e4&ie=Windows-1252&sourceid=yandex&oq=fMlfrFXOgK02UXTfwEwyosMBlsX_q-tiUeAyEWfgpDXrhKJZgJG-aKcHbUy6AC1zA&q=w3zQMvXcJxzQFYbGMvvDSKNbNkbWHViPxoiG9MildZ6qZGX_k7rDfF-qoVncCgWRx
/?oq=fp5KecCbAG0j0PTfQUwn4dcAVhA8Kyp2EHVyUWcgpGL9BSFaQ4UraKcHbky6AC1zA&ie=Windows-1252&es_sm=114&sourceid=edge&aqs=edge.127l117.406d1y7&q=w3_QMvXcJxbQFYbGMv_DSKNbNkjWHViPxoyG9MildZuqZGX_k7PDfF-qoV3cCgWRx
/?q=z3bQMvXcJwDQDoTAMvrESLtEMU_OHkKK2OH_783VCZr9JHT1vvHPRAPxtgWCel&sourceid=mozilla&ie=Windows-1251&oq=nX8PF5L-cEPVK33xfTKAAwnYlcBA5G9KqpiROGwESV1cPR9CWOaQ9A_qLIVLM4&es_sm=113&aqs=mozilla.69p58.406e7h9
/?ie=UTF-16&sourceid=edge&es_sm=111&oq=2FpvskL7dSO1fhj0LReQVgyNpZWl0b_qGui0PUnxSeiZaA-kGNUQNM9qKRSfE4&q=wXrQMvXcJwDQCYbGMvrESLtBNknQA0KK2Ij2_dqyEoH9eGnihNzUSkr76B2aCm&aqs=edge.129s85.406y3j6
/?es_sm=106&oq=8K7pROwGz3hOJeARlytwOUV9Go_38iUeHzhDIgJPXqEDcaAxDraKcHLQ72FrFkrJUcw&aqs=yandex.113u116.406m3h2&ie=Windows-1252&q=w3nQMvXcJxnQFYbGMvLDSKNbNkbWHViPxoyG9MildZ6qZGX_k7bDfF-qoVTcCgWRxfB&sourceid=yandex
/?es_sm=141&sourceid=edge&oq=kLrFSPADkhRSAKQ01molfAFhHoqj72kHTnx6egpOE9R3fNQtM_KKQELE52lrFkrZUcw&ie=UTF-8&q=w3bQMvXcJxbQFYbGMvjDSKNbNk3WHViPxouG9MildZ2qZGX_k7bDfF-qoVrcCgWRxfc&aqs=edge.84f92.406s6k7