{"action":"created","issue":{"url":"https://api.github.com/repos/brad-accuvant/cuckoo-modified/issues/5","labels_url":"https://api.github.com/repos/brad-accuvant/cuckoo-modified/issues/5/labels{/name}","comments_url":"https://api.github.com/repos/brad-accuvant/cuckoo-modified/issues/5/comments","events_url":"https://api.github.com/repos/brad-accuvant/cuckoo-modified/issues/5/events","html_url":"https://github.com/brad-accuvant/cuckoo-modified/issues/5","id":59167075,"number":5,"title":"Getting Bogus IRC Traffic from Network Processing","user":{"login":"begosch","id":10855314,"avatar_url":"https://avatars.githubusercontent.com/u/10855314?v=3","gravatar_id":"","url":"https://api.github.com/users/begosch","html_url":"https://github.com/begosch","followers_url":"https://api.github.com/users/begosch/followers","following_url":"https://api.github.com/users/begosch/following{/other_user}","gists_url":"https://api.github.com/users/begosch/gists{/gist_id}","starred_url":"https://api.github.com/users/begosch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/begosch/subscriptions","organizations_url":"https://api.github.com/users/begosch/orgs","repos_url":"https://api.github.com/users/begosch/repos","events_url":"https://api.github.com/users/begosch/events{/privacy}","received_events_url":"https://api.github.com/users/begosch/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-02-27T00:11:33Z","updated_at":"2015-06-22T17:17:49Z","closed_at":null,"body":"Command : DIE\r\n\r\nParameter: \r\ny\\xa1.\\xf0\\xaa\\xee\\x9e\\x97Fy\\x03\\xf1kU\\x1e\\xea7\\x8d\\xa8\\xa4\\x03\\xba\\x88@h$\\x115\\xf2\\x17\\x8b3&\\x1c&\\xe7\\x15[0\\xf3\\x97\\x9c\\xe3@\\xbed!\\xde\\x1f\t\\xc6x\\xedp\\xf3?\\x1f#\\x06\\x87\\x8b\\xbb\\xc1\\xb4B6\\x13\\x82\\x86\\xea\\xf0\\xb8\\\\x90\\x81\\x91\\xb2\\x96v]\\xb5\\x92-(\\x1b\\xbe\\xaa\\x94\\xe9\\x04\\x19\\x98\\x0e@\\xa5\\x14\"\\xa0\\xac>\\x88\\x81O\\xcc\\xf3`\\x94 L!\\xdb\\x9c\\xf9c\\x11 \\x0f\\xd3\\xdf\\x99\\xfe1\\x90P\\xe6\\xb1\\x86\\x0b\\x1f4\\xdc\\xf7)\\xd5\\x00\\H\\xca\\x91?\\xbcB[\\xbd^m\\xa7\\xc4%\\xc6e\\x00?\\xc36/\\xb5%\\x10\\x92eq\\xb5\\x02\\xfc\\xac[\\xa3\\xab;B6}\\xd4\\x92\\xc3\\xca g\\x1cB\\x16\\xba\\xda\\xdc\\xc7\\xe9M\\x99\\xb0\\xbf+x\\xa9\\x10\\xe6!\\xeb\\xb6\\x8d\\xdf\\xfa\\xbc\\xf7?\\xbe&+!Z\\xebw\\xd6\\xe1\\xe1\\xa8\\xec\\xa6\\x95m\\xb0\\xc7\\x1b0K\\x07\\xdd{\r\n\r\nType: Client"},"comment":{"url":"https://api.github.com/repos/brad-accuvant/cuckoo-modified/issues/comments/114187047","html_url":"https://github.com/brad-accuvant/cuckoo-modified/issues/5#issuecomment-114187047","issue_url":"https://api.github.com/repos/brad-accuvant/cuckoo-modified/issues/5","id":114187047,"user":{"login":"KillerInstinct","id":6646507,"avatar_url":"https://avatars.githubusercontent.com/u/6646507?v=3","gravatar_id":"","url":"https://api.github.com/users/KillerInstinct","html_url":"https://github.com/KillerInstinct","followers_url":"https://api.github.com/users/KillerInstinct/followers","following_url":"https://api.github.com/users/KillerInstinct/following{/other_user}","gists_url":"https://api.github.com/users/KillerInstinct/gists{/gist_id}","starred_url":"https://api.github.com/users/KillerInstinct/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/KillerInstinct/subscriptions","organizations_url":"https://api.github.com/users/KillerInstinct/orgs","repos_url":"https://api.github.com/users/KillerInstinct/repos","events_url":"https://api.github.com/users/KillerInstinct/events{/privacy}","received_events_url":"https://api.github.com/users/KillerInstinct/received_events","type":"User","site_admin":false},"created_at":"2015-06-22T17:17:49Z","updated_at":"2015-06-22T17:17:49Z","body":"Updating this, the URL (defanged) causes bogus IRC traffic:\r\nhxxp://izvestia.ru/\r\n\r\nWill try and make the IRC parsing a bit more reliable. Seems theres no real 'parsing' and instead is just searching for keywords in TCP traffic and calling it IRC. Upstream bug."}}