DOE Letter and FOIA Release To CNBC

Page 1 of 4
Ticket TICK:51656
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
Block (b)(6),(b)(7)(C)
Single IP
Block
Completed
Medium
Norris, Jonathan (CONTR)
None
IRblocks@eia.gov
2011/01/19 11:11:12
2011/06/18 03:45:23
None
None
done
- 2011/06/18 03:45:23
Changed ticket Machine from "ma43969" to "Unassigned".
Machine "ma43969" was deleted.
Norris, Jonathan (CONTR) - 2011/02/02 12:36:51

Sent tickte # and previos emails
From: (b)(6),(b)(7)(C) [mailto(b)(6),(b)(7)(C)

Sent: Wednesday, February 02, 2011 12:26 PM
To: Norris, Jonathan (CONTR)
Subject: Blocked ip (b)(6),(b)(7)(C)
m]
Are we being blocked? And if so, would you tell me specifically why.
(b)(6),(b)(7)(C)
Sr. Analyst - Trader Support
Office: 7(b)(6),(b)(7)(C)
P. Cell: (b)(6),(b)(7)(C) 8
W. Cell (b)(6),(b)(7)(C)
Email:(b)(6),(b)(7)(C)
(b) (7)(A)
"Lead, Follow, or Get Out Of The Way..."

Thomas Paine
Email Disclaimer
The information contained in or attached to this email is intended only for the use of the addressee. If you are not the intended recipient of this email, or a person responsible
the intended recipient, you are strictly prohibited from disclosing, copying, distributing, or retaining this email or any part of it. It may contain information which is confiden
by legal, professional or other privilege under applicable law. If you have received this email in error, please notify us immediately by return email.
The views expressed in this email are not necessarily the views of (b)(6),(b)(7)(C) nor its North American subsidiaries, and the said companies and their respective directors, of
employees make no representation, nor accept any liability, regarding its accuracy or completeness, unless expressly stated to the co
Changed ticket Owner from "Luu, Quan (CONTR)" to "Norris, Jonathan (CONTR)".
From: (b)(6),(b)(7)(C)
[mailto:(b)(6),(b)(7)(C)
Sent: Friday, January 28, 2011 4:16 PM
Subject: Re: Blocked ip (b)(6),(b)(7)(C)
Hi Jonathan,
Thank you for this email. I will supply this information to you shortly.
Do you happen to know why this IP is blocked? Is it from to many downloads? Thank you.
Thanks,
(b)(6),(b)(7)(C) Network Engineer (b) (7)(A)
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C) Fax: (b)(6),(b)(7)(C) (b)(6),(b)(7)(C)
___________________________________________________________________________________________________________________________________________
Keeping People and Information Connected http://www.availability.sungard.com/
Think before you print
CONFIDENTIALITY: This e-mail (including any attachments) may contain confidential, proprietary and privileged information, and unauthorized disclosure or use is prohi
received this e-mail in error, please notify the sender and delete this e-mail from your system.
https://kbox/adminui/ticket.php?ID=51656
2/16/2012
Page 2 of 4
"Norris, Jonathan (CONTR)" <Jonathan.Norris@eia.gov>

01/28/2011 04:02 PM To (b)(6),(b)(7)(C)
cc
Subject Blocked ip (b)(6),(b)(7)(C)
Thank you for contacting the U.S. Energy Information Administration. We have created incident ticket #51656 to track your request.
We ask that you access the web site a reasonable number of times per second when attempting to download the files to avoid your traffic being categorized as a denial of serv
also ask that you limit the number of IP's accessing the web site. Many large organizations download the data once and redistribute the information internally. You may wan
option.
In order to process your unblock request we will need to have an official statement from your organization detailing how you will be modifying your download traffic and ho
abusive download attempts. This plan should include:
-(b) (7)(A) your organization will initiate downloads from.
-(b) (7)(A)
you plan to access the web site.
- What measures you put in place to prevent theattack from happening again.
Once you have submitted your statement, EIA will review your Unblock request.
The EIA privacy statement and security policy can be found here http://www.eia..gov/privacyweb.html .
Jonathan Norris
Chenega Government Consulting, LLC
Contractor to U.S. Energy Information Administration
1000 Independence Avenue, SW
Washington, DC 20585
From: Livingston, Marcus (CONTR)
Sent: Friday, January 28, 2011 3:12 PM
To: Norris, Jonathan (CONTR); DiMascio, Shannon (CONTR)
Subject: IP Address Blocked
(b)(6),(b)(7)(C) called from (b) (7)(A) and stated that someone from (b) (7)(A) was trying to view the eia.gov site but the IP was being blocked.
(b)(6),(b)(7)(C)
IP Address:(b)(6),(b)(7)(C)
Contact info:(b)(6),(b)(7)(C)
Marcus Livingston
Chenega Government Consulting, LLC, Contractor to U.S. Energy Information Administration
Please consider the environment before printing this e-mail
Luu, Quan (CONTR) - 2011/01/20 08:16:29
Added resolution text.

Changed ticket Status from "Requested" to "Completed".
Changed ticket Owner from "Bily, Glenn (CONTR)" to "Luu, Quan (CONTR)".
Changed ticket Owner from "Norris, Jonathan (CONTR)" to "Bily, Glenn (CONTR)".

Please Block (b)(6),(b)(7)(C)
Contacted POC sas.abuse@sungard.com
(b) (b) (7)(E)

- - [13/Jan/2011:(b) (7)(A) -0500] GET /ngs/app/js_timer.jsp HTTP/1.1 200 2152 http://ir.eia.gov/ngs/ngs.html Mozilla/4.0 (compatible; MSIE 7.0; Windows N
2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)
(b)(6),(b)(7)(C) - - [13/Jan/2011:(b) (7)(A) -0500] GET /ngs/app/js_timer.jsp HTTP/1.1 200 2152 http://ir.eia.gov/ngs/ngs.html Mozilla/4.0 (compatible; MSIE 7.0; Windows N
(b)(6),(b)(7)(C)
2/16/2012
Page 3 of 4
(b)(6),(b)(7)(C) - - [13/Jan/2011:(b) (7)(A) -0500] GET /ngs/ngs.html HTTP/1.1 503 1398 - Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET
.NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)
(b)(6),(b)(7)(C) - - [13/Jan/2011:(b) (7)(A) -0500] GET /ngs/ngs.html HTTP/1.1 503 1398 http://ir.eia.gov/ngs/ngs.html Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .
(b)(6),(b)(7)(C)
2.0.50727; InfoPath.1; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)
CLR 2.0.50727; .NET CLR 1.1.4322; InfoPath.1)
CLR 2.0.50727; .NET CLR 1.1.4322; InfoPath.1)
(b)(6),(b)(7)(C) - - [13/Jan/2011:(b) (7)(A) -0500] GET /ngs/ngs.html HTTP/1.1 503 1398 - Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727;
1.1.4322; InfoPath.1)
(b)(6),(b)(7)(C)
Ticket Created

Contacted POC sas.abuse@sungard.com
(b)(6),(b)(7)(C)
Jan/2011:(b) (7)(A) -0500] GET /ngs/app/js_timer.jsp HTTP/1.1 200 2152 http://ir.eia.gov/ngs/ngs.html Mozilla/4.0 (compatible; MSIE 7.0; Windows N
(b)(6),(b)(7)(C)
2/16/2012
Page 4 of 4
(b)(6),(b)(7)(C)
2/16/2012
Page 1 of 8
Ticket TICK:51747
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
Block (b)(6), (b)(7)(C)

Single IP
Block
Completed
Medium
Luu, Quan (CONTR)
None
IRblocks@eia.gov
2011/01/20 16:13:10
2011/06/18 03:45:23
None
None
done
Owners
Only:
- 2011/06/18 03:45:23
Changed ticket Machine from "ma43969" to

"Unassigned".
Luu, Quan (CONTR) - 2011/01/26 08:28:03

Changed ticket Owner from "Bily, Glenn (CONTR)" to
"Luu, Quan (CONTR)".
Changed ticket Owner from "Norris, Jonathan (CONTR)"

to "Bily, Glenn (CONTR)".
Changed ticket CC list from "" to "IRblocks@eia.gov".
Owners
Only:
Ticket Created
Please Block Ip (b)(6), (b)(7)(C)

Contacted POC abuse@internap.com -(b)
(7)(A)
(b) (7)(A)
(b)(6), (b)(7)(C)
- - [20/Jan/2011:(b) (7)(A) -0500]

GET /ngs/blackberry.txt HTTP/1.0 503 1405 - (b)(6), (b)(7)(C) - - [20/Jan/2011:(b) (7)(A) -0500]
GET /ngs/blackberry.txt HTTP/1.0 503 1405 - -
2/16/2012
Page 2 of 8
(b)(6), (b)(7)(C)
- - [20/Jan/2011:(b) (7)(A) -0500]

2/16/2012
Page 3 of 8
GET /ngs/blackberry.txt HTTP/1.0 503 1404 - - - [20/Jan/2011:(b) (7)(A) -0500]

GET /ngs/blackberry.txt HTTP/1.0 503 1404 - (b)(6), (b)(7)(C)
2/16/2012
Page 4 of 8
(b)(6), (b)(7)(C)
- - [20/Jan/2011:(b) (7)(A) -0500]

2/16/2012
Page 5 of 8

2/16/2012
Page 6 of 8
(b)(6), (b)(7)(C)
- - [20/Jan/2011:(b) (7)(A) -0500]

2/16/2012
Page 7 of 8

2/16/2012
Page 8 of 8
(b)(6), (b)(7)(C)
- - [20/Jan/2011:(b) (7)(A) -0500]

2/16/2012
Page 1 of 3
Ticket TICK:51749
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
Block (b)(6), (b)(7)(C)

Single IP
Block
Completed
Medium
Luu, Quan (CONTR)
None
IRblocks@eia.gov
2011/01/20 16:29:00
2011/06/18 03:45:23
None
None
done
- 2011/06/18 03:45:23
Owners
Only:
Luu, Quan (CONTR) - 2011/01/26 08:26:58

Changed ticket Owner from "Norris, Jonathan (CONTR)" to

"Bily, Glenn (CONTR)".
Owners
Only:
Ticket Created
Please block IP (b)(6), (b)(7)(C)

Contacted POC ops@scansafe.com
(b) (7)(A)
(b)(6), (b)(7)(C)
- - [20/Jan/2011:(b) (7)(A) -0500] GET /ngs/ngs.html

HTTP/1.0 200 15897 - Mozilla/4.0 (compatible; MSIE 7.0;
Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; MS-RTC LM 8;
.NET CLR 3.5.30729; .NET CLR 3.0.30618; .NET4.0C;
.NET4.0E)
(b)(6), (b)(7)(C) - - [20/Jan/2011:(b) (7)(A) -0500] GET /ngs/ngs.html
2/16/2012
Page 2 of 3

.NET4.0E)
.NET4.0E)
.NET4.0E)
.NET4.0E)
.NET4.0E)
Windows NT 6.0; GTB6.6; SLCC1; .NET CLR 2.0.50727; MSRTC LM 8; .NET CLR 3.5.30729; .NET CLR 3.0.30618)
.NET4.0E)
.NET4.0E)
.NET4.0E)
.NET4.0E)
Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727;
MS-RTC LM 8; .NET CLR 3.5.30729; .NET CLR 3.0.30618;
2/16/2012
Page 3 of 3
.NET4.0C; .NET4.0E)
.NET CLR 3.5.30729; .NET CLR 3.0.30618; MS-RTC LM 8;
.NET4.0C; .NET4.0E)
.NET4.0E)
HTTP/1.0 200 15897 http://ir.eia.gov/ngs/ngs.html Mozilla/4.0
(compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR
2.0.50727; MS-RTC LM 8; .NET CLR 3.5.30729; .NET CLR
3.0.30618; .NET4.0C; .NET4.0E)
(compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR
2.0.50727; MS-RTC LM 8; .NET CLR 3.5.30729; .NET CLR
3.0.30618; .NET4.0C; .NET4.0E)
(compatible; MSIE 7.0; Windows NT 6.0; WOW64; Trident/4.0;
SLCC1; .NET CLR 2.0.50727; .NET CLR 3.5.30729; MS-RTC
LM 8; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
(compatible; MSIE 7.0; Windows NT 6.0; WOW64; Trident/4.0;
SLCC1; .NET CLR 2.0.50727; .NET CLR 3.5.30729; MS-RTC
LM 8; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
(b)(6), (b)(7)(C)
2/16/2012
Page 1 of 9
Ticket TICK:52105
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
unBlock (b)(6), (b)(7)(C)

Single IP
Unblock
Completed
Medium
Luu, Quan (CONTR)
None
IRblocks@eia.gov
2011/01/28 12:44:05
2011/06/18 03:45:23
None
None
done
- 2011/06/18 03:45:23
Owners
Only:
Luu, Quan (CONTR) - 2011/02/09 08:36:58


Owners
Only:
Changed ticket Title from "Block (b)(6), (b)(7)(C) to

"unBlock (b)(6), (b)(7)(C)
From: (b)(6), (b)(7)(C)

Sent: Thursday, February 03, 2011 3:26 PM
To: 'Jonathan.Norris@eia.gov'
Subject: FW: (b)(6), (b)(7)(C)
Mr. Norris,
Here is a revised version of our statement:
- What measures you put in place to prevent theattack from
happening again.
We plan to try to avoid being categorized as an attack by
attempting to limit our requests per second to a number that is less
2/16/2012
Page 2 of 9
than
(b) (7)(A)
requests per second.
Please let me know what to tell my team in regards to when we

well be unblocked.
Thank you.
(b)(6), (b)(7)(C)
Chief Technology Officer
(b) (7)(A)
Office: (b)(6), (b)(7)(C)

Cell: (b)(6), (b)(7)(C)
From: (b)(6), (b)(7)(C)
To: 'Norris, Jonathan (CONTR)'
Subject: RE: (b)(6), (b)(7)(C)
Mr. Norris,
Thanks for taking time to explain the restrictions to me. I tried to
find the section about a robot process to reduce the number of hits
per second on that you that you sent
[http://www.eia.gov/privacyweb.html ] but the only mention of a
robot process that I was able to find describes how any robot that
excessively accesses EIA resources is prohibited. Am I looking at
the correct website or did you send a different link?
Thank you.
(b)(6), (b)(7)(C)
(b) (7)(A)
Office: (b)(6), (b)(7)(C)

Cell: (b)(6), (b)(7)(C)
From: (b)(6), (b)(7)(C)

Mr. Norris,
I dont mean to be a pest but my team is asking me when they will
be able to read the EIAs Weekly Natural Gas Storage Report
sections of the EIA website and I do not know what to tell them.
Please let me know.
2/16/2012
Page 3 of 9
Thanks
(b)(6), (b)(7)(C)
(b) (7)(A)
Office: (b)(6), (b)(7)(C)

Cell: (b)(6), (b)(7)(C)
From: (b)(6), (b)(7)(C)

Sent: Thursday, February 03, 2011 11:39 AM
Mr. Norris,
I apologize if I lead you to believe that I was asking for any
performance/tuning advice while accessing the EIAs system. I am
instead asking what threshold we will need to stay below so that
our legitimate business needs are not categorized as abusive attacks
against the EIA again by your detection systems. This block is
causing a disruption to our business.
(b)(6), (b)(7)(C)
(b) (7)(A)
Office: (b)(6), (b)(7)(C)

Cell: (b)(6), (b)(7)(C)
From: Norris, Jonathan (CONTR)
[mailto:Jonathan.Norris@eia.gov]
To: (b)(6), (b)(7)(C)
I cannot legally help you configure the performance of your system
to access our system. Reasonable as it would apply here would
mean how many times will you need to access and download the
same file.
Jonathan Norris
From: (b)(6), (b)(7)(C) [mailto:(b)(6), (b)(7)(C)(b)(6), (b)(7)(C)
2/16/2012
Page 4 of 9

Mr. Norris,
I understand and we will make every effort to lower our requests
per second and I expect my team to take my request seriously.
Since reasonable may have a different meaning to us than it does
to your protection systems, can you please let me know what
threshold to try to stay below?
Thank you.
(b)(6), (b)(7)(C)
(b) (7)(A)
Office: (b)(6), (b)(7)(C)

Cell: (b)(6), (b)(7)(C)
To: (b)(6), (b)(7)(C)
(b)(6),(b)(7)(C)
I am required to ask you to access the site a reasonable number of

times per second (b) (7)(E) is not reasonable. Can you
please lower your number to a more reasonable amount.
(b) (7)(A)
Jonathan Norris
From: (b)(6), (b)(7)(C) [mailto:(b)(6), (b)(7)(C)(b)(6), (b)(7)(C)
Jonathan,
(b) (7)(A)
has a team of analysts that depend

heavily on the timely delivery of data contained on the EIAs
website. Our use of the data is exactly in line with the intended
purposes of this tax funded government website. It is my
understanding that our browser inquiries last week were
categorized by your current protection systems rules as an abusive
attack and that we have been blocked from accessing the data that
we need from the EIAs website. Cogent, our internet bandwidth
2/16/2012
Page 5 of 9
provider, informed us that your group had a concern about the

traffic coming from our address but when I communicated to them
that we had legitimate reasons for accessing this data they
informed me that they closed the case. We were not informed by
Cogent or by Chenega Government Consulting, LLC that our
company would be blocked from the 10:30AM EST Weekly
Natural Gas Storage Report.
Please let this communication serve as an official communication
from our organization detailing how we will be modifying our
download traffic and how we hope to prevent your detection
systems from categorizing our traffic as abusive.
- List of IPs your organization will initiate downloads from.
We will access www.eia.doe.gov from IP address (b)(6), (b)(7)(C)
- How many times a second you plan to access the web site.
Our company accesses the data on the EIA website many times in a
given week but peak traffic occurs in the minutes approaching
10:30AM EST on Thursday mornings, just before the Weekly
Natural Gas Storage Report. (b) (7)(E)

happening again.
Clearly our inquiries have been misinterpreted as an attack. I have
already asked our team to use the lightweight blackberry version
of this report because it: 1.) reduces the total data requested from
the EIA servers and 2.) will be faster (less data takes less time to
get here). Going forward I will ask our team to allow the automatic
count-down/refresh script to process the update of the information
on the page instead of clicking on the refresh button.
Thank you for your concern about us and for what you are doing to
protect the EIA website and please let me know when we have
been unblocked.
(b)(6), (b)(7)(C)
(b) (7)(A)
Office: (b)(6), (b)(7)(C)

Cell: (b)(6), (b)(7)(C)

To: (b)(6), (b)(7)(C)
2/16/2012
Page 6 of 9
Subject: (b)(6), (b)(7)(C)

Thank you for contacting the U.S. Energy Information
Administration. We have created incident ticket #52105 to track
your request.
We ask that you access the web site a reasonable number of times
per second when attempting to download the files to avoid your
traffic being categorized as a denial of service attack. We also ask
that you limit the number of IP's accessing the web site. Many
large organizations download the data once and redistribute the
information internally. You may want to consider this option.
In order to process your unblock request we will need to have an
official statement from your organization detailing how you will be
modifying your download traffic and how you will prevent abusive
download attempts. This plan should include:
- (b) (7)(A) your organization will initiate downloads from.
- (b) (7)(A)
happening again.
Once you have submitted your statement, EIA will review your
Unblock request.
The EIA privacy statement and security policy can be found here
http://www.eia.gov/privacyweb.html .
Jonathan Norris
Changed ticket Status from "Completed" to "Requested".

Changed ticket Category from "Block" to "Unblock".
Changed ticket Owner from "Luu, Quan (CONTR)" to
"Norris, Jonathan (CONTR)".
Survey Satisfaction changed from "0" to empty

(b)(6), (b)(7)(C)(b)(6),(b)(7)(C)
Owners
Only:
Luu, Quan (CONTR) - 2011/02/02 08:28:02


2/16/2012
Page 7 of 9
Owners
Only:
Ticket Created
please block (b)(6), (b)(7)(C)

conatacted poc PSINet,
(b) (7)(E)
(b) (7)(A)
(b)(6), (b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
GET /ngs/app/js_timer.jsp HTTP/1.1 200 2149

http://ir.eia.gov/ngs/ngs.html Mozilla/4.0 (compatible; MSIE 8.0;
.NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0;
MDDR; .NET4.0C)
(b)(6), (b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR
2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media
Center PC 6.0; CMDTDF; .NET4.0C; .NET4.0E)
(b)(6), (b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
MDDR; .NET4.0C)
(b)(6), (b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
MDDR; .NET4.0C)
(b)(6), (b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
MDDR; .NET4.0C)
(b)(6), (b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
(b)(6), (b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
2/16/2012
Page 8 of 9
MDDR; .NET4.0C)
(b)(6), (b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]

(b)(6), (b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
MDDR; .NET4.0C)
(b)(6), (b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
MDDR; .NET4.0C)
(b)(6), (b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
(b)(6), (b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
MDDR; .NET4.0C)
MDDR; .NET4.0C)
2/16/2012
Page 9 of 9

MDDR; .NET4.0C)
MDDR; .NET4.0C)
2/16/2012
Page 1 of 26
Ticket TICK:52110
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
block (b)(6),(b)(7)(C)
Single IP
Block
Completed
Medium
Luu, Quan (CONTR)
None
IRblocks@eia.gov
2011/01/28 14:40:29
2011/02/02 08:28:30
None
None
done
Luu, Quan (CONTR) - 2011/02/02 08:28:30

Changed ticket Owner from "Bily, Glenn (CONTR)" to "Luu,
Quan (CONTR)".
Changed ticket Owner from "Norris, Jonathan (CONTR)" to "Bily,

Glenn (CONTR)".
Owners
Only:
Ticket Created
please block (b)(6),(b)(7)(C)

conacted psinet
(b) (7)(A)
) (7)(A)
(b)(6),(b)(7)(C)
- - [27/Jan/2011:(b) (7)(A) -0500]

Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
2/16/2012
Page 2 of 26

CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
2/16/2012
Page 3 of 26
CLR 3.0.4506.2152; .NET CLR 3.5.30729)

- - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500] GET /ngs/ngs.html
HTTP/1.1 503 1399
http://www.eia.doe.gov/oil_gas/natural_gas/info_glance/natural_gas.html
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR
1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR
3.5.30729)
HTTP/1.1 503 1399
3.5.30729)
HTTP/1.1 503 1399
3.5.30729)
HTTP/1.1 503 1399
3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C)
2/16/2012
Page 4 of 26

CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
HTTP/1.1 503 1399
3.5.30729)
2/16/2012
Page 5 of 26
HTTP/1.1 503 1399

3.5.30729)
HTTP/1.1 503 1399
3.5.30729)
HTTP/1.1 503 1399
3.5.30729)
HTTP/1.1 503 1399
3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
2/16/2012
Page 6 of 26

CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
HTTP/1.1 503 1399
3.5.30729)
HTTP/1.1 503 1399
2/16/2012
Page 7 of 26

3.5.30729)
HTTP/1.1 503 1399
3.5.30729)
HTTP/1.1 503 1399
3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
2/16/2012
Page 8 of 26

CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
HTTP/1.1 503 1399
3.5.30729)
HTTP/1.1 503 1399
3.5.30729)
HTTP/1.1 503 1399
3.5.30729)
HTTP/1.1 503 1399
2/16/2012
Page 9 of 26

3.5.30729)
HTTP/1.1 503 1399
3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
2/16/2012
Page 10 of 26

CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
HTTP/1.1 503 1399
3.5.30729)
HTTP/1.1 503 1399
3.5.30729)
HTTP/1.1 503 1399
3.5.30729)
HTTP/1.1 503 1399
3.5.30729)
2/16/2012
Page 11 of 26
(b)(6),(b)(7)(C)
- - [27/Jan/2011:(b) (7)(A) -0500]

CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
2/16/2012
Page 12 of 26

CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
HTTP/1.1 503 1399
3.5.30729)
HTTP/1.1 503 1399
3.5.30729)
HTTP/1.1 503 1399
3.5.30729)
HTTP/1.1 503 1399
3.5.30729)
HTTP/1.1 503 1399
3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
2/16/2012
Page 13 of 26

CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
2/16/2012
Page 14 of 26

CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
HTTP/1.1 503 1399
3.5.30729)
HTTP/1.1 503 1399
3.5.30729)
HTTP/1.1 503 1399
3.5.30729)
HTTP/1.1 503 1399
3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
2/16/2012
Page 15 of 26
(b)(6),(b)(7)(C)
- - [27/Jan/2011:(b) (7)(A) -0500]

CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
HTTP/1.1 503 1398
3.5.30729)
2/16/2012
Page 16 of 26
(b)(6),(b)(7)(C)

HTTP/1.1 503 1398
3.5.30729)
HTTP/1.1 503 1398
3.5.30729)
HTTP/1.1 503 1398
3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
2/16/2012
Page 17 of 26

CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
HTTP/1.1 503 1398
3.5.30729)
HTTP/1.1 503 1398
3.5.30729)
HTTP/1.1 503 1398
2/16/2012
Page 18 of 26
3.5.30729)
HTTP/1.1 503 1398
3.5.30729)
HTTP/1.1 503 1398
3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
2/16/2012
Page 19 of 26
(b)(6),(b)(7)(C)
- - [27/Jan/2011:(b) (7)(A) -0500]

CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
HTTP/1.1 503 1398
3.5.30729)
HTTP/1.1 503 1398
3.5.30729)
HTTP/1.1 503 1398
3.5.30729)
HTTP/1.1 503 1398
2/16/2012
Page 20 of 26

3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
2/16/2012
Page 21 of 26

CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
HTTP/1.1 503 1398
3.5.30729)
HTTP/1.1 503 1398
3.5.30729)
HTTP/1.1 503 1398
3.5.30729)
HTTP/1.1 503 1398
3.5.30729)
HTTP/1.1 503 1398
2/16/2012
Page 22 of 26
3.5.30729)
(b)(6),(b)(7)(C)
- - [27/Jan/2011:(b) (7)(A) -0500]

CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
2/16/2012
Page 23 of 26
(b)(6),(b)(7)(C)
- - [27/Jan/2011:(b) (7)(A) -0500]

CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
HTTP/1.1 503 1398
3.5.30729)
HTTP/1.1 503 1398
3.5.30729)
HTTP/1.1 503 1398
3.5.30729)
HTTP/1.1 503 1398
3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
2/16/2012
Page 24 of 26

CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
2/16/2012
Page 25 of 26

CLR 3.0.4506.2152; .NET CLR 3.5.30729)
HTTP/1.1 503 1398
3.5.30729)
HTTP/1.1 503 1398
3.5.30729)
HTTP/1.1 503 1398
3.5.30729)
HTTP/1.1 503 1398
3.5.30729)
HTTP/1.1 503 1398
3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
2/16/2012
Page 26 of 26
CLR 3.0.4506.2152; .NET CLR 3.5.30729)

- - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [27/Jan/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C)
2/16/2012
Page 1 of 3
Ticket TICK:52898
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
Block (b)(6),(b)(7)(C)
Single IP
Block
Completed
Medium
Luu, Quan (CONTR)
None
None
2011/02/17 15:57:47
2011/02/24 08:23:50
None
None
done
Luu, Quan (CONTR) - 2011/02/24 08:23:50


Owners
Only:
Ticket Created
(b) (7)(
(b) (7)(E)
(b) (7)(A)
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
GET /ngs/blackberry.txt HTTP/1.1 200 217 - Mozilla/4.0

(compatible; MSIE 7.0; Windows NT 5.1)
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
2/16/2012
Page 2 of 3
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]

(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
2/16/2012
Page 3 of 3
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]

(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
2/16/2012
Page 1 of 28
Ticket TICK:53020
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
Block (b)(6),(b)(7)(C)
Single IP
Block
Completed
Medium
Luu, Quan (CONTR)
None
IRblocks@eia.gov
2011/02/23 11:03:20
2011/05/25 08:46:34
None
None
done
Luu, Quan (CONTR) - 2011/05/25 08:46:34

Owners
Only:
From: (b)(6),(b)(7)(C)
[mailto:(b)(6),(b)(7)(C)
Sent: Friday, May 20, 2011 12:20 PM
To: Norris, Jonathan (CONTR); 'abuse@cv.net'
Cc: DiMascio, Shannon (CONTR); (b)(6),(b)(7)(C)
Subject: RE: Abuse from (b)(6),(b)(7)(C)
Also,
Here is our current rate limiting policy. Issue is if I turn it down
any less, the countdown on Thursday at 10:30am does not work or
the page does not display correctly.
(b)(6),(b)(7)(C)
From: (b)(6),(b)(7)(C)
To: 'Jonathan.Norris@eia.gov'; 'abuse@cv.net'
Cc: 'Shannon.DiMascio@eia.gov'
Subject: Re: Abuse from (b)(6),(b)(7)(C)
2/16/2012
Page 2 of 28
Is the block active now?
(b)(6),(b)(7)(C)
Platform Services Manager - Director
(b) (7)(A)
(b)(6),(b)(7)(C)
(b) (7)(A)
To: (b)(6),(b)(7)(C) ; abuse@cv.net <abuse@cv.net>
Cc: DiMascio, Shannon (CONTR) <Shannon.DiMascio@eia.gov>
This our policy, I cannot stop the block.
Jonathan Norris
From: (b)(6),(b)(7)(C)
[mailto(b)(6),(b)(7)(C)
Sent: Friday, May 20, 2011 11:26 AM
To: Norris, Jonathan (CONTR); abuse@cv.net
Johnathon,
I am going to enable more detailed logging on the Netscaler so I
can see where this traffic you are seeing is being generated from.
We are rate limiting so as you can imagine I am a bit surprised.
Can you please not block us at this point and let me try to
determine the root cause/user?
(b)(6),(b)(7)(C)
2/16/2012
Page 3 of 28
Sent: Thursday, May 19, 2011 3:48 PM
To: (b)(6),(b)(7)(C) abuse@cv.net
Ir.eia.gov.
Jonathan Norris
From: (b)(6),(b)(7)(C)
[mailto:(b)(6),(b)(7)(C)
Is that for ir.eia.gov or www.eia.gov?
(b)(6),(b)(7)(C)

To: (b)(6),(b)(7)(C) abuse@cv.net
No, but your are on our blacklist for now a second incident
Jonathan Norris
From: (b)(6),(b)(7)(C)
[mailto:(b)(6),(b)(7)(C)
That is very strange. Do you still see this behavior?
(b)(6),(b)(7)(C)
i J
(CONTR) 2011/05/19 15 47 46
2/16/2012
Page 4 of 28
Owners
Only:
Repeat offender
Caught by IPS
(b) (7)(A)
(b) (7)(E)
(b) (7)(E)
(b) (7)(A)
in 1 second
in 1 second
then
(b) (7)(A)
(b) (7)(E)
(b) (7)(E)
(b) (7)(A)
(b) (7)(A)
ran concurrently see below

Date/Time 2011-05-19 14:26:06 EDT
Tag Name (b) (7)(E)
Alert Name (b) (7)(E)
Severity Low
Observance Type Intrusion Detection
Combined Event Count
Cleared Flag false
Target IP Address 205.254.135.25
Target Object Name 80
Target Object Type Target Port
Target Service http
Source IP Address (b)(6),(b)(7)(C)
SourcePort Name 46426
Sensor IP Address (b) (7)(A)
Sensor Name IPSdot7
:adapter A
:event-type Attack
:(b) (7)(E)
:pam.tcp.connections.flood.opene 25
:Protocol Name TCP
:repeat-count
:target-ip-addr-end 205.254.135.25
:target-ip-addr-start 205.254.135.25
:total-proxied-connections 32
AdapterID A
AdapterMode Inline Protection
algorithm-id 2119027
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7
(b) (7)(E)
(b) (7)(E)
Date/Time 2011-05-19 14:26:06 EDT

Tag Name (b) (7)(E)
Alert Name T(b) (7)(E)
Severity Low
2/16/2012
Page 5 of 28
Combined Event Count 1

Cleared Flag false
Target Service http
Sensor Name IPSdot7
:adapter A
:event-type Attack
:(b) (7)(E)
:pam.(b) (7)(E)
:Protocol Name TCP
:repeat-count
:total-(b) (7)(E)
AdapterID A
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7
(b) (7)(E)
Date/Time 2011-05-19 14:26:06 EDT

Tag Name (b) (7)(E)
Severity Low
Cleared Flag false
Target Service http
SourcePort Name 0
Sensor Name IPSdot7
:adapter A
:coalescer-info Forwarded due to age
:end-time 2011-05-19 14:26:06
:event-type Attack
:opened
:pam.(b) (7)(E)
:Protocol Name TCP
:repeat-count
(b) (7)(E)
(b) (7)(E)
(b) (7)(E)
2/16/2012
Page 6 of 28
:start-time 2011-05-19 14:26:06

:total-proxied-connections
AdapterID A
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7
(b) (7)(E)


Owners
Only:
Changed ticket Title from "unBlock (b)(6),(b)(7)(C) 1" to

"Block (b)(6),(b)(7)(C) ".
Changed ticket Category from "Unblock" to "Block".
Changed ticket Owner from "Luu, Quan (CONTR)" to "Bily,
Glenn (CONTR)".
Repeat offender
Caught by IPS
(b) (7)(A)
(b) (7)(E)
(b) (7)(A)
(b) (7)(
(b) (7)(A)
opened connections in 1 second

(b) (7)(A)
(b) (7)(E) over

for a total of
concurrently see below
(b) (7)(A)
seconds the events ran
Date/Time 2011-05-19 14:26:06 EDT

Tag Name (b) (7)(E)
Severity Low
Cleared Flag false
Target Service http
(b) (7)(E)
2/16/2012
Page 7 of 28

Sensor Name IPSdot7
:adapter A
:event-type Attack
:opened 26
:pam.(b) (7)(E)
:Protocol Name TCP
:repeat-count 1
s
(b) (7)(E)
AdapterID A
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7
(b) (7)(A)
(b) (7)(A)
Date/Time 2011-05-19 14:26:06 EDT

Tag Name TCP_Connections_Open_Flood
Alert Name TCP_Connections_Open_Flood
Severity Low
Cleared Flag false
Target Service http
Sensor Name IPSdot7
:adapter A
:event-type Attack
:opened
:pam.(b) (7)(E)
:Protocol Name TCP
:repeat-count 1
AdapterID A
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
(b) (7)(A)
(b) (7)(A)
2/16/2012
Page 8 of 28
SensorName IPSdot7
Date/Time 2011-05-19 14:26:06 EDT
Tag Name (b) (7)(E)
Severity Low
Cleared Flag false
Target Service http
SourcePort Name 0
Sensor Name IPSdot7
:adapter A
:end-time 2011-05-19 14:26:06
:event-type Attack
:opened
:pam.(b) (7)(E)
:Protocol Name TCP
:repeat-count
:start-time 2011-05-19 14:26:06
AdapterID A
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7
(b) (7)(E)
(b) (7)(A)
(b) (7)(E)
(b) (7)(A)
Luu, Quan (CONTR) - 2011/03/17 07:48:56

Owners
Only:

From: (b)(6),(b)(7)(C)
[mailto:(b)(6),(b)(7)(C)
Sent: Wednesday, March 16, 2011 3:17 PM
2/16/2012
Page 9 of 28
Subject: RE: Unblock us

(b) (7)(A)
I limited our users to request (b) (7)(E) Therefore you will

never see more than requests (b) (7)(E) from (b)(6),(b)(7)(C)
Thank you!
(b) (7)(A)
(b)(6),(b)(7)(C)

To: (b)(6),(b)(7)(C)
We need to know how many time you will (b) (7)(E)
and from which IP address. As stated in the previous
messages.
(b) (7)(E)

Sent: Thursday, March 10, 2011 11:01 AM
To: (b)(6),(b)(7)(C)
Cc: (
Administration. We have created incident tickets #53020 and
#53586 to track your request.
(b) (7)(A)
ou plan to access the web site.
- What measures you put in place to prevent the attack from
happening again.
Unblock request.
2/16/2012
Page 10 of 28
Jonathan Norris
From: (b)(6),(b)(7)(C)
[mailto:(b)(6),(b)(7)(C)
Sent: Wednesday, March 16, 2011 10:45 AM
Thanks John. Forwarding these messages on still does not answer
my question however.
(b)(6),(b)(7)(C)

To: (b)(6),(b)(7)(C)
Subject: FW: Unblock us
Jonathan Norris
Sent: Friday, March 11, 2011 4:14 PM
To: '(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
Cc: (b)(6),(b)(7)(C) (b)(6),(b)(7)(C) (b)(6),(b)(7)(C)
2/16/2012
Page 11 of 28
Even thought you stating that you cannot be definitive, we need the
number of times you will access the site per second.
Jonathan Norris
Washington, DC 20585 (b)(6),(b)(7)(C)
From: (b)(6),(b)(7)(C) [mailto:
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
Cc: (b)(6),(b)(7)(C) (b)(6),(b)(7)(C) (b)(6),(b)(7)(C)
Jonathon,
Sorry to keep on about this but we havent heard anything back
from you and we still dont have access to the site or approval to
implement our new solution. Is there someone else we should be
approaching? Thanks again for any assistance you can provide us.
Im out on vacation next week so (b)(6),(b)(7)(C) (ccd) will be
point person.
(b)(6),(b)(7)(C)
Regards
(b)(6),(b)(7)(C)
From: (b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
Cc: (b)(6),(b)(7)(C) (b)(6),(b)(7)(C) (b)(6),(b)(7)(C)
Jonathon,
Just reaching out to understand where we currently stand.
Thanking you in advance for your assistance.
Best regards
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
Vice President Chief Technology Officer
(b) (7)(A)
(b)(6),(b)(7)(C)
2/16/2012
Page 12 of 28
(b) (7)(A)
From: (b)(6),(b)(7)(C)
Sent: Friday, March 11, 2011 9:07 AM
(b)(6),(b)(7)(C)
Cc: (b)(6),(b)(7)(C) (b)(6),(b)(7)(C) (b)(6),(b)(7)(C)
Jonathon,
After further discussions with the level 3 technical group at Citrix
last night, they confirmed that our proposed approach and
configuration will reduce our traffic hitting the EIA sites. The new
Proxy appliances also have detail monitoring and logging so that
we can fine tune any setting going forward.
Please let us know the next steps.
Best regards
(b)(6),(b)(7)(C)
From: (b)(6),(b)(7)(C)
Sent: Thursday, March 10, 2011 3:54 PM
(b)(6),(b)(7)(C)
Cc: (b)(6),(b)(7)(C) (b)(6),(b)(7)(C) (b)(6),(b)(7)(C)
Jonathon,
Updated configuration
1. When approved by you we will finalize the configuration of our
DNS for ir.eia.gov to point to an internal Proxy that has caching
enabled
2. All access from (b) (7)(A) will come from one of the following 3 IP
addresses:
a. (b)(6),(b)(7)(C) Primary
b. (b)(6),(b)(7)(C) backup
c. (b)(6),(b)(7)(C) Backup
While our Proxy (NetScaler) will be caching and the vendor
(Citrix) states that this will reduce the hits to your site we (b) (7)(A)
cannot definitively state at this point we can restrict the hits to
per second. Are we doing enough with the Proxy and the caching
to unblock the site or is there still more we need to do?
(b) (7)(A)
Regards
(b)(6),(b)(7)(C)
2/16/2012
Page 13 of 28
To: (b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
Cc: (b)(6),(b)(7)(C) (b)(6),(b)(7)(C) (b)(6),(b)(7)(C)
Thank you. Yes we require the IP address that your company will
use to access the site, and we will need you to expand on your
definition of (b) (7)(E)
Jonathan Norris
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
Cc: (b)(6),(b)(7)(C) (b)(6),(b)(7)(C) (b)(6),(b)(7)(C)
Jonathon,
Could you please review the following to see if this is appropriate?
1. We will configure our DNS for ir.eia.gov to point to an internal
Proxy that will allow caching
2. The proxy will limit the number of connection to 1 with a
constant connection
3. The Proxy would only request data from the site if requested by
a user at no more than 1 attempt per second.
I understand you will also require an IP Address to be associated
with this approach?
Regards
(b)(6),(b)(7)(C)

To: (b)(6),(b)(7)(C)
Cc: (b)(6),(b)(7)(C) (b)(6),(b)(7)(C) (b)(6),(b)(7)(C)
If its taken care of by COB March 14, 2011 the you will make it in
time for the next release.
2/16/2012
Page 14 of 28
Jonathan Norris
(b)(6),(b)(7)(C)
Cc: (b)(6),(b)(7)(C) (b)(6),(b)(7)(C) (b)(6),(b)(7)(C)
Thank you Jonathon,
We are working on a plan and a statement for you. Once we have
one and you agree to the approach how long would it take to be
unblocked?
Regards
(b)(6),(b)(7)(C)

To: (b)(6),(b)(7)(C)
Cc: (
(b) (7)(A)
happening again.
Unblock request.
2/16/2012
Page 15 of 28
Jonathan Norris
From: (b)(6),(b)(7)(C)
[mailto:(b)(6),(b)(7)(C)(b)(6),(b)(7)(C)
Cc: (b)(6),(b)(7)(C)
Subject: Unblock us
(b)(6),(b)(7)(C)
Johnathan,
We are unable to reach www.ir.eia.gov from our companys
primary networks in (b) (7)(A) CT and (b) (7)(A) , TX.
I spoke to someone on your main number yesterday, and our
company has sent requests via email last week to unblock us on
your network.
We are coming from the IP addresses of : (b)(6),(b)(7)(C) &
(b)(6),(b)(7)(C)
How long will it take to unblock us from your network, and what
steps can we take to make sure doesnt happen again.
Thank you for your help,
(b)(6),(b)(7)(C)
CONFIDENTIALITY NOTICE: This electronic transmission

(including any files attached hereto) contains information that is or
may be legally privileged, confidential, and exempt from
disclosure. The information is intended only for the use of the
individual or entity named above. If the reader of this message is
not the intended recipient or any employee or agent responsible for
delivering the message to the intended recipient, you are hereby
notified that any disclosure, dissemination, copying, distribution,
or the taking of any action in reliance on the contents of this
electronic transmission is strictly prohibited. If you have received
this communication in error, please notify the sender immediately
and destroy the transmitted information. Thank you.
2/16/2012
Page 16 of 28




2/16/2012
Page 17 of 28




2/16/2012
Page 18 of 28


Owners
Only:
(b)(6),(b)(7)(C)

(b)(6),(b)(7)(C)
Cc: (b)(6),(b)(7)(C)
Jonathan,
I was hoping to speak with someone at the EIA who could assist us
long term in understanding why we are being blocked and we have
to do to correct the situation. Any help you could offer or pointing
me in the correct direction would be greatly appreciated.
Best regards,
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C) (b)(6),(b)(7)(C)
(b) (7)(A)
(b)(6),(b)(7)(C)
(b) (7)(A)
From: (b)(6),(b)(7)(C)
2/16/2012
Page 19 of 28

To: Jonathan.Norris@eia.gov
Cc: (b)(6),(b)(7)(C)
Subject: Unblock us
Johnathan,
primary networks in (b) (7)(A) CT and (b) (7)(A) TX.
your network.
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)

Owners
Only:
Changed ticket Title from "Block(b)(6),(b)(7)(C) " to

"unBlock (b)(6),(b)(7)(C) ".

To: '(b)(6),(b)(7)(C)
2/16/2012
Page 20 of 28
Cc: (b)(6),(b)(7)(C)
- (b) (7)(A)
happening again.
Unblock request.
Jonathan Norris
From: (b)(6),(b)(7)(C)
[mailto:(b)(6),(b)(7)(C)(b)(6),(b)(7)(C)
Cc: (b)(6),(b)(7)(C)
Subject: Unblock us
Johnathan,
your network.
(b)(6),(b)(7)(C)
2/16/2012
Page 21 of 28

(b)(6),(b)(7)(C)

Luu, Quan (CONTR) - 2011/02/24 08:24:37


Owners
Only:

Contact POC - Optimum Online (Cablevision Systems)
(b) (7)(A)
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
http://ir.eia.gov/ngs/ngs.html Mozilla/5.0 (Windows; U; Windows
NT 5.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
2/16/2012
Page 22 of 28

(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
2/16/2012
Page 23 of 28

(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
GET /ngs/ngs.html HTTP/1.1 503 1399
http://www.google.com/search?q=eia+gas+number&ie=utf8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefoxa Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.13)
Gecko/20101203 Firefox/3.6.13
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]

(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
2/16/2012
Page 24 of 28
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]

(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
2/16/2012
Page 25 of 28

3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
GET /wpsr/psw03.xls HTTP/1.1 200 60928 - Java/1.6.0_12
2/16/2012
Page 26 of 28
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]

Owners
Only:
Ticket Created

Contact POC - Optimum Online (Cablevision Systems)
(b) (7)(A)
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
2/16/2012
Page 27 of 28

(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
2/16/2012
Page 28 of 28

(b)(6),(b)(7)(C) - - [17/Feb/2011:(b) (7)(A) -0500]
2/16/2012
Page 1 of 3
Ticket TICK:53104
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
Block (b)(6), (b)(7)(C)

Single IP
Block
Completed
Medium
Luu, Quan (CONTR)
None
IRblocks@eia.gov
2011/02/24 11:39:17
2011/03/02 08:52:52
None
None
done
Luu, Quan (CONTR) - 2011/03/02 08:52:52


Owners
Only:
Ticket Created
Please Block (b)(6), (b)(7)(C)

POC interserver.net & trouble-free.net
(b) (7)(E) (b) (7)(A)
(b)(6), (b)(7)(C)
- - [24/Feb/2011:(b) (7)(A) -0500]

GET /ngs/blackberry.txt HTTP/1.1 200 216 - (b)(6), (b)(7)(C) - - [24/Feb/2011:(b) (7)(A) -0500]
2/16/2012
Page 2 of 3
(b)(6), (b)(7)(C)
- - [24/Feb/2011:(b) (7)(A) -0500]

2/16/2012
Page 3 of 3
GET /ngs/blackberry.txt HTTP/1.1 200 216 - - - [24/Feb/2011:(b) (7)(A) -0500]

2/16/2012
Page 1 of 1
Ticket TICK:53105
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
Block (b)(6), (b)(7)(C)

Range of IPs
Block
Completed
High
Bily, Glenn (CONTR)
None
IRblocks@eia.gov
2011/02/24 11:52:07
2011/02/24 16:18:18
None
None
Bily, Glenn (CONTR) - 2011/02/24 16:18:18

Changed ticket Priority from "Medium" to "High".

Owners
Only:
3925 response 27.107.221.12 1318 eiainfos.eia.doe.gov

GET /ngs/eiabanner.gif send-file
Owners
Only:
Ticket Created
Please Block (b)(6), (b)(7)(C)
(b) (7)(E)
(b) (7)(A)
at time of load. no connections

successfully got to the IR box but this is an attack on the Ir box.
2/16/2012
Page 1 of 4
Ticket TICK:53346
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
Block IP Range (b)(6),(b)(7)(C)

Range of IPs
Block
Completed
Medium
Luu, Quan (CONTR)
None
IRblocks@eia.gov
2011/03/02 12:37:44
2011/10/07 03:45:44
None
None
done
Owners
Only:
- 2011/10/07 03:45:44
Changed ticket Machine from "A46663" to "Unassigned".
Machine "A46663" was deleted.
Luu, Quan (CONTR) - 2011/03/09 08:27:06


Owners
Only:
Added attachment 'load03032011.txt'

Changed ticket Title from "Block (b)(6),(b)(7)(C) " to
"Block IP Range (b)(6),(b)(7)(C) ".
Changed ticket Impact from "Single IP" to "Range of
IPs".

Repeat offender (b) (7)(A) (b)
(b) (7)(E)
(7)(E)
at time of release
2/16/2012
Page 2 of 4
Attachment: load03032011.txt (77.43 KB)
Luu, Quan (CONTR) - 2011/03/03 08:07:56


Owners
Only:

POC is (b) (7)(A)
(b)(6),(b)(7)(C) - - [02/Mar/2011:(b) (7)(A) -0500]
GET /wpsr/table1.csv HTTP/1.1 200 5835 - (b)(6),(b)(7)(C) - - [02/Mar/2011:(b) (7)(A) -0500]
GET /wpsr/table1.csv HTTP/1.1 200 5835 - -
2/16/2012
Page 3 of 4
(b)(6),(b)(7)(C) - - [02/Mar/2011:(b) (7)(A) -0500]


"Block (b)(6),(b)(7)(C) ".
Owners
Only:
Ticket Created

POC is (b) (7)(A)
(b)(6),(b)(7)(C) - - [02/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 4 of 4
(b)(6),(b)(7)(C) - - [02/Mar/2011:(b) (7)(A) -0500]

2/16/2012
Page 1 of 24
Ticket TICK:53409
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
Block (b)(6),(b)(7)(C)
Single IP
Block
Completed
Medium
Luu, Quan (CONTR)
None
IRblocks@eia.gov
2011/03/03 12:14:37
2011/10/07 03:45:44
None
None
done
Owners
Only:
- 2011/10/07 03:45:44
Luu, Quan (CONTR) - 2011/03/09 08:30:16

Owners
Only:
Please block (b)(6),(b)(7)(C)

over
(b) (7)(A)
(b) (7)(E)
) (7)(A)
during time of load
POC (b)(6),(b)(7)(C)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]

Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727;
.NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C;
.NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
2/16/2012
Page 2 of 24
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]

2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
.NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
.NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 3 of 24

2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
GET /ngs/ngs.html HTTP/1.1 503 1399 - Mozilla/4.0 (compatible;
MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322;
.NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR
3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
2/16/2012
Page 4 of 24
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]

2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
2/16/2012
Page 5 of 24
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]

3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
.NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
.NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 6 of 24
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;

.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
.NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
2/16/2012
Page 7 of 24
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]

2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
.NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
.NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 8 of 24

2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
.NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
2/16/2012
Page 9 of 24
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]

2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
.NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
.NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
.NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 10 of 24

3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
.NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
.NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 11 of 24

.NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
2/16/2012
Page 12 of 24
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]

2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
.NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
.NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
2/16/2012
Page 13 of 24
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]

.NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
.NET4.0E)
2/16/2012
Page 14 of 24
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]

.NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
.NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
.NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
2/16/2012
Page 15 of 24
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]

2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
.NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
.NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
2/16/2012
Page 16 of 24
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]

3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
2/16/2012
Page 17 of 24
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]

3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
.NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
.NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
.NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 18 of 24

Windows NT 5.1; Trident/4.0; GTB6; .NET CLR 1.1.4322; .NET
CLR 2.0.50727; InfoPath.1; .NET CLR 3.0.04506.30; .NET CLR
3.0.04506.648; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.0.04506.648; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.0.04506.648; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB6; .NET CLR
1.1.4322; .NET CLR 2.0.50727; InfoPath.1; .NET CLR
3.0.04506.30; .NET CLR 3.0.04506.648; .NET CLR
3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 19 of 24

3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
.NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
.NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.0.04506.648; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 20 of 24

.NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.0.04506.648; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB6; .NET CLR
3.0.04506.30; .NET CLR 3.0.04506.648; .NET CLR
3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
GET /ngs/eia_980footer.js HTTP/1.1 200 1282
3.0.04506.648; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 21 of 24

2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
GET /ngs/eia_980header.js HTTP/1.1 200 2197
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.0.04506.648; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
GET /ngs/ngs.html HTTP/1.1 200 15739 - Mozilla/4.0
(compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR
1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET
CLR 3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
CLR 3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB6;
.NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.1; .NET
CLR 3.0.04506.30; .NET CLR 3.0.04506.648; .NET CLR
3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E)
2/16/2012
Page 22 of 24
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]

(compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB0.0;
.NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.1; .NET
CLR 3.0.04506.30; .NET CLR 3.0.04506.648; .NET CLR
3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322;
3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
GET /ngs/oilgas_pub.css HTTP/1.1 200 11981
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.0.04506.648; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)

Owners
Only:
Ticket Created
Please block (b)(6),(b)(7)(C)

over
(b) (7)(A)
(b) (7)(A)
hits a sec
syn requests during time of load
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 23 of 24

.NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
.NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 24 of 24

.NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.5.30729; .NET4.0C; .NET4.0E)
2/16/2012
Page 1 of 37
Ticket TICK:53453
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
unBlock (b)(6),(b)(7)(C)
Single IP
Unblock
Completed
Medium
Luu, Quan (CONTR)
(b)(6),(b)(7)(C)
None
(b)(6),(b)(7)(C)
2011/03/04 10:21:13
2011/10/07 03:45:44
None
None
done
Owners
Only:
- 2011/10/07 03:45:44
Luu, Quan (CONTR) - 2011/03/16 08:36:03

Owners
Only:
Added attachment 'US Energy Information

Administration.doc'
(b)(6),(b)(7)(C)
Changed ticket Title from "Block (b)(6),(b)(7)(C)
" to
(b)(6),(b)(7)(C)
"unBlock (b)(6),(b)(7)(C)
".
Changed ticket Owner from "Luu, Quan (CONTR)" to "Bily,
Glenn (CONTR)".
(b)(6),(b)(7)(C)
From: (b)(6),(b)(7)(C)
[mailto:(b)(6),(b)(7)(C)
Sent: Tuesday, March 15, 2011 9:56 AM
Subject: RE: Abuse From (b)(6),(b)(7)(C) - Urgent Please Reply
Jonathan,
Many thanks,
2/16/2012
Page 2 of 37
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
Commodities & Energy Global Service Manager
(b) (7)(A)
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
________________________________________
[mailto:(b)(6),(b)(7)(C)
Sent: 15 March 2011 13:53
To: (b)(6),(b)(7)(C) M. (M ST CandE)
Cc: iSecurity; (b)(6),(b)(7)(C) (M RTT); (b)(6),(b)(7)(C) (M Cont ST);
(b)(6),(b)(7)(C) (M Cont NT); (b)(6),(b)(
(M ST CandE);
(b)(6),(b)(7)(C) (M ST CandE); (b)(6),(b)(7)(C) (M Cont ST);
(b)(6),(b)(7)(C) (M ST CandE)
Thank you for your response. Your unblock request has been
approved and will be processed by C.O.B. today. I suggest you test
before the Wednesday release.
Jonathan Norris
From: (b)(6),(b)(7)(C)
[mailto:(b)(6),(b)(7)(C)
Sent: Tuesday, March 15, 2011 7:34 AM
Cc: (b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)

Importance: High
Jonathan,
Please find attached an official response from (b) (7)(A)
apologising for the issue that occurred last week and detailing the
2/16/2012
Page 3 of 37
changes that have since been made in the way that we will access
your data.
Grateful if you can confirm that this provides the level of detail
and assurances that you need in order to be able to unblock our IP
address so that we can retrieve the Wednesday EIA updates
tomorrow.
Regards,
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
(b) (7)(A)
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
________________________________________
Sent: 09 March 2011 19:30
To: (b)(6),(b)(7)(C) M. (M ST CandE)
(b)(6),(b)(7)(C) (M Cont NT); (b)(6),(b)(7)(C) (M ST CandE);
(b)(6),(b)(7)(C) (M ST CandE)
(b)(6),(b)(7)(C)
You message did not address how you plan to access the data
during the release and the number of times. I highlighted the items
from the previous meessage. You can reach me at 2022876069 if
you need clarification
Jonathan Norris
From: (b)(6),(b)(7)(C)
[mailto:(b)(6),(b)(7)(C)
Cc: (b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
2/16/2012
Page 4 of 37
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)

Importance: High
Jonathan,
Please can you confirm, reply to the below as we experienced
delays on our service today due to our access being blocked.
Regards,
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
(b) (7)(A)
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
________________________________________
From: (b)(6),(b)(7)(C) M. (M ST CandE)
Sent: 09 March 2011 11:31
(b)(6),(b)(7)(C) (M Cont NT); (b)(6),(b)(
(M ST CandE);
(b)(6),(b)(7)(C) (M ST CandE); (b)(6),(b)(7)(C) M. (M ST
CandE)
Subject: RE: Abuse From (b)(6),(b)(7)(C) (Resent with image)
Importance: High
Jonathan,
Thank you for your email below. I can confirm that the following
steps have been put into place effective from today.
Please can you confirm that any requests from us are now
unblocked in preparation for the EIA updates today.
IP address:(b)(6),(b)(7)(C)
2. We have modified the grabbing window from contiguous
(b) (7)(E)
(b) (7)(A)
(b) (7)(A)
(b) (7)(A)
) (7)(A)
(b) (7)
below;
2/16/2012
Page 5 of 37
3. The future visiting plan is our prevention method. The diagram

below may better describe: We are changing the grabbing window
from the gray bar to the green bar.
Regards,
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
(b) (7)(A)
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
________________________________________
Sent: 07 March 2011 16:34
To: (b)(6),(b)(7)(C) (M RTT)
(b)(6),(b)(7)(C)
Cc: i
Subject: RE: Abuse From (b)(6),(b)(7)(C)
your request. I can tell you that the activity occurred on March 3
2011 between 10am and 11am, please look over your logs.
- (b) (7)(A)
happening again.
Unblock request.
2/16/2012
Page 6 of 37
Jonathan Norris
From: (b)(6),(b)(7)(C)
[mailto:(b)(6),(b)(7)(C)
Sent: Monday, March 07, 2011 11:25 AM
Cc: (b)(6),(b)(7)(C)
Hi Jonathan,
Thank you for contacting bringing this to our attention. Could you
please provide further details about the nature of the traffic youre
seeing if available?
Were investigating this under reference IM0000678500.
Best regards
________________________________________
(b)(6),(b)(7)(C)
[CISSP, CCSK, CEH, CVSE, MCITP:EA]

Principal Security Analyst
(b) (7)(A)
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
(b) (7)(A)

To: (b)(6),(b)(7)(C)
Subject: Abuse From
Hello
We are receiving malicious traffic from a host registered to your
domain: (b)(6),(b)(7)(C) this traffic is targeting ir.eia.gov.
Please investigate and remediate.
Jonathan Norris
2/16/2012
Page 7 of 37
This e-mail is for the sole use of the intended recipient and
contains information that may be privileged and/or confidential. If
you are not an intended recipient, please notify the sender by return
e-mail and delete this e-mail and any attachments. Certain required
legal entity disclosures can be accessed on our website.
This email was sent to you by (b) (7)(A)
the global news
and information company.
Any views expressed in this message are those of the individual
sender, except where the sender specifically states them to be the
views of (b) (7)(A)
the global news
and information company. Any views expressed in this message
are those of the individual sender, except where the sender
specifically states them to be the views of (b) (7)(A)
the global news
and information company. Any views expressed in this message
are those of the individual sender, except where the sender
specifically states them to be the views of (b) (7)(A)
Attachment: US Energy Information Administration.doc
(76.00 KB)
Luu, Quan (CONTR) - 2011/03/09 08:31:28


Owners
Only:
From: (b)(6),(b)(7)(C)
[mailto:(b)(6),(b)(7)(C)
To: Norris, Jonathan (CONTR);
(b)(6),(b)(7)(C)

Jonathan,
2/16/2012
Page 8 of 37
We have registered the issue internally, and it is under

investigation.
Regards,
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
Data Center Lan Development Manager
(b) (7)(A)
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
(b) (7)(A)
Owners
Only:

To: '(b)(6),(b)(7)(C)
Cc: (b)(6),(b)(7)(C)
7)(C)
Subject: RE: Abuse From
your request. I can tell you that the activity occurred on March 3
2011 between 10am and 11am, please look over your logs.
- (b) (7)(A)
happening again.
Unblock request.
Jonathan Norris
2/16/2012
Page 9 of 37

From: (b)(6),(b)(7)(C)
[mailto:(b)(6),(b)(7)(C)
Cc: (b)(6),(b)(7)(C)
Hi Jonathan,
Thank you for contacting bringing this to our attention. Could you
please provide further details about the nature of the traffic youre
seeing if available?
Were investigating this under reference IM0000678500.
Best regards
________________________________________
(b)(6),(b)(7)(C)
[CISSP, CCSK, CEH, CVSE, MCITP:EA]

Principal Security Analyst
(b) (7)(A)
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
(b) (7)(A)

To: (b)(6),(b)(7)(C)
Subject: Abuse From (b)(6),(b)(7)(C)
Hello
domain: (b)(6),(b)(7)(C) this traffic is targeting ir.eia.gov.
Jonathan Norris
2/16/2012
Page 10 of 37
This e-mail is for the sole use of the intended recipient and
contains information that may be privileged and/or confidential. If
you are not an intended recipient, please notify the sender by return
e-mail and delete this e-mail and any attachments. Certain required
legal entity disclosures can be accessed on our website.
Owners
Only:
contacted '(b)(6),(b)(7)(C)
'(b)(6),(b)(7)(C)
Added attachment (b)
Owners
Only:
(7)(A)
Capture of synfloods only during the time of the load release, time
windo is just under 4 mins
Attachment: (b)
(7)(A) (8.37 MB)
Changed ticket Title from "Block (b)(6),(b)(7)(C) Rueters" to

"Block (b)(6),(b)(7)(C) Reuters".
Owners
Only:
From: Higgs, Don

To: DiMascio, Shannon (CONTR); Norris, Jonathan (CONTR)
Cc: Mencias, Alvin (CONTR); Gallagher, Bronwyn
Subject: RE: WNGSR Load Incident
Per our conversation, please proceed with our standard means of
dealing with this type of activity, which entails notifying the entity
that they have been blocked and to work with us to assist in
remediating this in future releases.
Don
From: DiMascio, Shannon (CONTR)
To: Higgs, Don; Norris, Jonathan (CONTR)
Cc: Mencias, Alvin (CONTR); Gallagher, Bronwyn
Subject: RE: WNGSR Load Incident
That is fair.
However I want to point out that (b) (7)(A) excessive behavior
yesterday was not the result of multiple IPs accessing the data but
2/16/2012
Page 11 of 37
(b) (7)(A)
in fact a single IP that hit us for over

right at 10:30. To be
clear these connections were NOT all GET requests but actual
SYN Flooding where they sent us traffic and opened connections
without actually requesting data they were just taking up
available download slots.
Shannon DiMascio
shannon.dimascio@eia.gov
202-586-7523
Owners
Only:
Ticket Created
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
GET /wpsr/table6.csv HTTP/1.1 200 5231 - Mozilla/4.0

(compatible; MSIE 6.0; Windows NT 5.1; SV1)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
GET /wpsr/table5a.csv HTTP/1.1 200 3963 - Mozilla/4.0
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
MSIE 6.0; Windows NT 5.1; SV1)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 12 of 37

(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 13 of 37

(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 14 of 37

(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 15 of 37

(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 16 of 37

(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 17 of 37

(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 18 of 37

(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 19 of 37

(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 20 of 37

(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 21 of 37

(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 22 of 37

(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 23 of 37

(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 24 of 37

(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 25 of 37

(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
MSIE 6.0; Windows NT 5.1; SV1)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 26 of 37

(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 27 of 37

(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 28 of 37

(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 29 of 37

(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 30 of 37

(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 31 of 37

(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 32 of 37

(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 33 of 37

(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 34 of 37

(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 35 of 37

(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 36 of 37

(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 37 of 37

(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 1 of 9
Ticket TICK:53510
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
Survey
Satisfaction:
Single IP
Unblock
Completed
Medium
Luu, Quan (CONTR)
None
IRblocks@eia.gov
2011/03/07 10:11:24
2011/10/07 03:45:44
None
None
done
5
Owners
Only:
- 2011/10/07 03:45:44
Survey Satisfaction changed from "0" to "5"
Luu, Quan (CONTR) - 2011/03/17 07:47:40


Owners
Only:
From: (b)(6),(b)(7)(C)
Cc: (b)(6),(b)(7)(C)
Subject: RE: IEA NG Storage Report Website blocked
Jonathan,
As discussed, (b) (7)(A) will limit access to
second for accessing the reports.
(b) (7)(A)
times per
2/16/2012
Page 2 of 9
We need to have the blocks removed for ngs and wpsr

Actions to control access and provide longer term fix are outlined
below.
(b)(6),(b)(7)(C)
From: (b)(6),(b)(7)(C) (b)(6),(b)(7)(C)

To: (b)(6),(b)(7)(C) (b)(6),(b)(7)(C)
'Jonathan.Norris@eia.gov'
Cc: (b)(6),(b)(7)(C)
Jonathan,
Just confirmed that we are now internally blocking all access to the
NGS report and will open access for the IP addresses after you
confirm that you are unblocked on your side. Please let us know
ASAP so we can do some testing and then work on getting fixed
IP addresses to staff who need to have access.
Thanks
David DeVoucalla
Infrastructure Demand Manager
(b) (7)(A)
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
From: (b)(6),(b)(7)(C) (b)(6),(b)(7)(C)

To: (b)(6),(b)(7)(C) (b)(6),(b)(7)(C)
'Jonathan.Norris@eia.gov'
Cc: (b)(6),(b)(7)(C)
Jonathan,
(b)(6),(b)(7)(C)
I just visited with

and he should have the proxy settings
changed in the next hour to block all traffic from us except the
addresses that will be permitted. This will ensure that automated
polling by several of the staff will not have an impact. Hope to
speak with you soon.
(b)(6),(b)(7)(C)
2/16/2012
Page 3 of 9
From: (b)(6),(b)(7)(C) (b)(6),(b)(7)(C)

Sent: Tuesday, March 15, 2011 5:22 PM
Cc: (b)(6),(b)(7)(C)
Subject: IEA NG Storage Report Website blocked
Jonathan,
I am writing to update you on our progress toward resolution of
the problem where we are hitting the website too frequently.
ACTIONS
1) (b)(6),(b)(7)(C) is implementing a policy on our proxy server to limit
the number of staff who can query the website to addresses. We
need to have the block removed on our address (b)(6),(b)(7)(C) or
(b)(6),(b)(7)(C) to enable these staff to access the site prior by
Wednesday evening so that they can get the data on Thursday
morning.
(b) (7)(A)
(b)(6),(b)(7)(C)
2) Our scripting team is working on an automated pull of the data

to one machine so that it can be the internal source for getting this
data going forward. The scripting team will be testing their work
on Thursday. Depending on the results, they may need a few
weeks to get the programming completed.
We believe that the short-term step of internally limiting access to
the report will mitigate risk of over-querying. We believe that the
scripting work is the longer term solution to addressing this
problem and are actively working on getting this in place.
I would like to visit with you to ensure you have the confidence
you need to proceed with unblocking access. I will be in meetings
but will step out to call you back if you send me a phone number
where I can reach you.
Thanks,
(b)(6),(b)(7)(C)
(b) (7)(A)
(b)(6),(b)(7)(C)
2/16/2012
Page 4 of 9
-----Original Message----From: (b)(6),(b)(7)(C) (b)(6),(b)(7)(C)

Cc: (b)(6),(b)(7)(C)
Subject: FW: Website blocked
Jonathan
While we work to make internal adjustments to avoid issues in the
future, please advise on the following points...
1) What is the threshold used to define "reasonable number of
times per second"?
2) What was the threshold that was observed coming from
((b)(6),(b)(7)(C)
(b) (7)(A)
We will need some time to sort the download and internal posting
of the file for reference.
Regards,
(b)(6),(b)(7)(C)
(b) (7)(A)
(b)(6),(b)(7)(C)
-----Original Message----From: (b)(6),(b)(7)(C)

To: (b)(6),(b)(7)(C) (b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
Subject: Fw: Website blocked

(b)(6),(b)(7)(C)
Could you respond?

Thanks,
(b)(6),(b)(7)(C)
----- Original Message ----From: Norris, Jonathan (CONTR)
2/16/2012
Page 5 of 9
To: (b)(6),(b)(7)(C)
Subject: RE: Website blocked
Administration. We
have created incident ticket #53510 to track your request.
per
second when attempting to download the files to avoid your traffic
being
categorized as a denial of service attack. We also ask that you limit
the number of IP's accessing the web site. Many large
organizations
download the data once and redistribute the information internally.
You
may want to consider this option.
official statement from your organization detailing how you will
be
modifying your download traffic and how you will prevent
abusive
(b) (7)(A)
happening
again.
Unblock
request.
Jonathan Norris
2/16/2012
Page 6 of 9
Subject: Website blocked

Jonathan:
My users in (b) (7)(A) with (b) (7)(A) are being blocked getting
to
ir.eia.gov/ngs/ngs.html. We should be coming from (b)(6),(b)(7)(C)
or
.
Can you unblock these addresses, and prevent us from being
blocked in
the future?
(b)(6),(b)(7)(C)
Thanks,
(b)(6),(b)(7)(C)
AT&T Network Administrator for (b)

email: (b)(6),(b)(7)(C)
(7)(A)
(b)(6),(b)(7)(C)
This message and any attachments to it may contain confidential

information and proprietary information of AT&T. If you are not
the
intended recipient, be aware that any disclosure, copying,
distribution
or use of the contents of this email without permission from
AT&T is
prohibited. If you have received this e-mail in error, please email
me
to report the error and then immediately delete this message from
your
system

"unBlock (b)(6),(b)(7)(C) ".
Owners
Only:


2/16/2012
Page 7 of 9
Jonathan:
My users in Houston with (b) (7)(A) are being blocked getting
to
ir.eia.gov/ngs/ngs.html. We should be coming from (b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
blocked in
the future?
Thanks,
(b)(6),(b)(7)(C)
AT&T Network Administrator (b)
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
(7)(A)

information and proprietary information of AT&T. If you are not
the
distribution
or use of the contents of this email without permission from
AT&T is
me
your
system
Luu, Quan (CONTR) - 2011/03/09 08:29:46


Owners
Only:
Ticket Created
2/16/2012
Page 8 of 9
(b) (7)(A)
requests during the load with out completing the

handshake.
Conacted SW Bell
-----Original Message----From: Bily, Glenn (CONTR)

To: DiMascio, Shannon (CONTR); Narayanan, Prashanth
(CONTR)
Cc: Peterson, Marshall (CONTR); Collins, Christian (CONTR);
Subject: RE: ir load issue
These IPs stand out:
(b)(6),(b)(7)(C) -- (b)
(b)(6),(b)(7)(C) -- (b)
(7)(A)
(7)(A)
(b)(6),(b)(7)(C) -- (b) (7)(A)
(b)(6),(b)(7)(C) (b) (7)(A)
-(b)(6),(b)(7)(C) (b) (7)(A)
-(b)(6),(b)(7)(C) -- (b) (7)(A)
(b)(6),(b)(7)(C) -- (b)
(7)(A)
Glenn Bily
-----Original Message----From: DiMascio, Shannon (CONTR)
To: Narayanan, Prashanth (CONTR)
Norris, Jonathan (CONTR); Bily, Glenn (CONTR); Mencias,
Alvin (CONTR)
Is there a list of IPs associated aside from the ones listed on the top
talkers?
Shannon DiMascio
2/16/2012
Page 9 of 9

202-586-7523
-----Original Message----From: Narayanan, Prashanth (CONTR)
To: Mencias, Alvin (CONTR)
Cc: DiMascio, Shannon (CONTR); Peterson, Marshall (CONTR);
Collins, Christian (CONTR); Norris, Jonathan (CONTR); Bily,
Glenn (CONTR)
Subject: FW: ir load issue
AJ,
It appears this was a SYN attack. Christian and I are analyzing the
pcap now.
thanks
Cc: Norris, Jonathan (CONTR)
Subject: ir load issue
(b) (7)(A)
The issue was probably some sort of SYN attack:

Mar 3 (b) (7)(A) ir kernel: Out of socket memory
Mar 3 (b) (7)(A) ir kernel: (b) (7)(E)
(b) (7)(A)
Glenn Bily
2/16/2012
Page 1 of 3
Ticket TICK:53533
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
Block IP Range (b) (7)(A)

Range of IPs
Block
Completed
Medium
Luu, Quan (CONTR)
None
IRblocks@eia.gov
2011/03/07 15:28:10
2011/03/09 08:28:40
None
None
done
Luu, Quan (CONTR) - 2011/03/09 08:28:40

Changed ticket Impact from "Single IP" to "Range of IPs".

Owners
Only:

To: DiMascio, Shannon (CONTR); Narayanan, Prashanth
(CONTR)
These IPs stand out:
(b)(6),(b)(7)(C)
2/16/2012
Page 2 of 3
(b)(6),(b)(7)(C)
Glenn Bily
-----Original Message----From: DiMascio, Shannon (CONTR)
Norris, Jonathan (CONTR); Bily, Glenn (CONTR); Mencias,
Alvin (CONTR)
Is there a list of IPs associated aside from the ones listed on the
top talkers?
Shannon DiMascio
202-586-7523
To: Mencias, Alvin (CONTR)
Cc: DiMascio, Shannon (CONTR); Peterson, Marshall
(CONTR); Collins, Christian (CONTR); Norris, Jonathan
(CONTR); Bily, Glenn (CONTR)
Subject: FW: ir load issue
AJ,
(b) (7)(A)
It appears this was a
attack. Christian and I are analyzing
the pcap now.
thanks
Cc: Norris, Jonathan (CONTR)
2/16/2012
Page 3 of 3
Subject: ir load issue

The issue was probably some sort of
(b) (7)(A)
attack:
Mar 3(b) (7)(A) ir kernel: Out of socket memory

Mar 3 (b) (7)(A) 4 ir kernel: (b) (7)(E)
Mar 3(b) (7)(A) ir kernel: (b) (7)(E)
Glenn Bily
Ticket Created
Added attachment '(b)
Owners
Only:
(7)(A)
Please Block IP Range (b) (7)(A)

if this range is too wide then block (b)
(7)(A)
(b) (7)(A) IP have attacked the load relase 3 weeks in a row

jumping IPs and IP ranges
syn attack on last release- 527
Attachment: (b)
(7)(A)
(204.63 KB)
2/16/2012
Page 1 of 1
Ticket TICK:53560
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
Block IP Range (b)(6),(b)(7)(C)

Single IP
Block
Completed
Medium
Luu, Quan (CONTR)
None
None
2011/03/08 10:59:14
2011/03/09 08:26:24
None
None
done
Luu, Quan (CONTR) - 2011/03/09 08:26:24


Changed ticket Owner from "Norris, Jonathan

(CONTR)" to "Luu, Quan (CONTR)".
Owners
Only:
Repeat offender
Owners
Only:
Ticket Created
Added attachment 'load03032011.txt'
Please Block Range (b)(6),(b)(7)(C)

POC Carpathia Hosting
Exceeded
over
(b) (7)(A)
(b) (7)(A)(b) (7)(E)
c(b) (7)(E) at time of IR release along with

a second.
Attachment: load03032011.txt (77.43 KB)
2/16/2012
Page 1 of 25
Ticket TICK:53586
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
Single IP
Unblock
Completed
Medium
Luu, Quan (CONTR)
None
IRblocks@eia.gov
2011/03/08 14:55:46
2011/06/18 03:45:23
None
None
done
Owners
Only:
- 2011/06/18 03:45:23
Luu, Quan (CONTR) - 2011/03/17 07:48:27

Owners
Only:

From: (b)(6),(b)(7)(C)
[mailto:(b)(6),(b)(7)(C)(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
I limited our users to request per second. Therefore you will

never see more than requests per second from b)(6),(b)(7)(C)
Thank you!
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
2/16/2012
Page 2 of 25

To: (b)(6),(b)(7)(C)
We need to know how many time you will access the site per
second and from which IP address. As stated in the previous
messages.
To: (b)(6),(b)(7)(C)
Cc: (
-(b) (7)(A) s your organization will initiate downloads from.
-(b) (7)(A)
happening again.
Unblock request.
Jonathan Norris
2/16/2012
Page 3 of 25
From: (b)(6),(b)(7)(C)
[mailto:(b)(6),(b)(7)(C)(b)(6),(b)(7)(C)
Thanks John. Forwarding these messages on still does not answer
my question however.
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
To: (b)(6),(b)(7)(C)
Subject: FW: Unblock us
Jonathan Norris
To: '(b)(6),(b)(7)(C)
Cc:(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)

Even thought you stating that you cannot be definitive, we need the
number of times you will access the site per second.
Jonathan Norris
From: (b)(6),(b)(7)(C) [mailto:(b)(6),(b)(7)(C)(b)(6),(b)(7)(C)
Cc: (b)(6),(b)(7)(C)
2/16/2012
Page 4 of 25
(b)(6),(b)(7)(C)

Jonathon,
Sorry to keep on about this but we havent heard anything back
from you and we still dont have access to the site or approval to
implement our new solution. Is there someone else we should be
approaching? Thanks again for any assistance you can provide us.
Im out on vacation next week so (b)(6),(b)(7)(C) (ccd) will be
s point person.
(b) (7)(A)
Regards
(b)(6),(b)(7)(C)
From: (b)(6),(b)(7)(C)
Cc: (b)(6),(b)(7)(C) (b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)

Jonathon,
Just reaching out to understand where we currently stand.
Thanking you in advance for your assistance.
Best regards
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
(b) (7)(A)
(b)(6),(b)(7)(C)
(
(b) (7)(A)
From: (b)(6),(b)(7)(C)
Cc: (b)(6),(b)(7)(C) (b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)

Jonathon,
2/16/2012
Page 5 of 25
After further discussions with the level 3 technical group at (b) (7)(A)
last night, they confirmed that our proposed approach and
configuration will reduce our traffic hitting the EIA sites. The new
Proxy appliances also have detail monitoring and logging so that
we can fine tune any setting going forward.
Please let us know the next steps.
Best regards
(b)(6),(b)(7)(C)
From: (b)(6),(b)(7)(C)
Cc: (b)(6),(b)(7)(C) (b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)

Jonathon,
Updated configuration
1. When approved by you we will finalize the configuration of our
DNS for ir.eia.gov to point to an internal Proxy that has caching
enabled
2. All access from (b) (7)(A) will come from one of the following 3 IP
addresses:
(b) (7)(A)
c. (b)(6),(b)(7)(C) Backup
While our Proxy (NetScaler) will be caching and the vendor
(b)(6),(b)(7)(C)
) states that this will reduce the hits to your site we
cannot definitively state at this point we can restrict the hits to one
per second. Are we doing enough with the Proxy and the caching
to unblock the site or is there still more we need to do?
(b) (7)(A)
Regards
(b)(6),(b)(7)(C)

To: (b)(6),(b)(7)(C)
Cc: (b)(6),(b)(7)(C) (b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)

Thank you. Yes we require the IP address that your company will
use to access the site, and we will need you to expand on your
definition of 1 Constant Connection.
2/16/2012
Page 6 of 25
Jonathan Norris
(b)(6),(b)(7)(C)
Cc: (b)(6),(b)(7)(C) (b)(6),(b)(7)(C)
Jonathon,
Could you please review the following to see if this is appropriate?
1. We will configure our DNS for ir.eia.gov to point to an internal
Proxy that will allow caching
2. The proxy will limit the number of connection to with a
constant connection
3. The Proxy would only request data from the site if requested by
a user at no more than (b) (7)(A)
(b) (7)(A)
I understand you will also require an IP Address to be associated

with this approach?
Regards
(b)(6),(b)(7)(C)

To: (b)(6),(b)(7)(C)
Cc: (b)(6),(b)(7)(C) (b)(6),(b)(7)(C)
If its taken care of by COB March 14, 2011 the you will make it in
time for the next release.
Jonathan Norris
Cc: (b)(6),(b)(7)(C) (b)(6),(b)(7)(C)
Thank you Jonathon,
2/16/2012
Page 7 of 25
We are working on a plan and a statement for you. Once we have

one and you agree to the approach how long would it take to be
unblocked?
Regards
(b)(6),(b)(7)(C)

To: (b)(6),(b)(7)(C)
Cc: (b)(6),(b)(7)(C)
(b) (7)(A) your organization will initiate downloads from.
(b) (7)(A)
happening again.
Unblock request.
Jonathan Norris
From: (b)(6),(b)(7)(C)
[mailto(b)(6),(b)(7)(C)
]
Cc: (b)(6),(b)(7)(C)
2/16/2012
Page 8 of 25
Subject: Unblock us
Johnathan,
your network.
(b)(6),(b)(7)(C) .
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)


2/16/2012
Page 9 of 25



2/16/2012
Page 10 of 25




2/16/2012
Page 11 of 25

Owners
Only:
Changed ticket Title from "Block (b)(6),(b)(7)(C) to

Jonathan,
I was hoping to speak with someone at the EIA who could assist us
long term in understanding why we are being blocked and we have
to do to correct the situation. Any help you could offer or pointing
me in the correct direction would be greatly appreciated.
Best regards,
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
(b) (7)(A)
(b)(6),(b)(7)(C)
(
From: (b)(6),(b)(7)(C)
Cc: (b)(6),(b)(7)(C)
Subject: Unblock us
Johnathan,
your network.
(b)(6),(b)(7)(C) .
2/16/2012
Page 12 of 25
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)

Owners
Only:


To: '(b)(6),(b)(7)(C)
Cc: (b
2/16/2012
Page 13 of 25

- (b) (7)(A)
happening again.
Unblock request.
Jonathan Norris
From: (b)(6),(b)(7)(C)
[mailto:(b)(6),(b)(7)(C)(b)(6),(b)(7)(C)
Cc: (b)(6),(b)(7)(C)
Subject: Unblock us
Johnathan,
We are unable to reach www.ir.eia.gov
from our companys
(b) (7)(A)
(b)(6),(b)(7)(C)
C)
primary networks in
CT and
, TX.
your network.
(b)(6),(b)(7)(C) 1.
(b) (7)(A)
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)

2/16/2012
Page 14 of 25

Luu, Quan (CONTR) - 2011/03/09 08:30:44


Owners
Only:
Ticket Created
(b)(6),(b)(7)(C)
Over
(b) (7)(A)
(b) (7)(E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]

3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
NT 5.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko)
Chrome/9.0.597.107 Safari/534.13
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
NT 5.1; en-US; rv:1.9.2.14) Gecko/20110218 Firefox/3.6.14 (.NET
CLR 3.5.30729)
2/16/2012
Page 15 of 25
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]

3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; 3P_UAMG
1.0.20.0; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
Chrome/9.0.597.107 Safari/534.13
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; 3P_UAMG 1.0.20.0; .NET CLR 3.0.4506.2152; .NET
CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
GET /ngs/ngs.html HTTP/1.1 200 15739 - Mozilla/5.0 (Windows;
U; Windows NT 5.1; en-US) AppleWebKit/534.13 (KHTML, like
Gecko) Chrome/9.0.597.107 Safari/534.13
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
U; Windows NT 5.1; en-US; rv:1.9.2.14) Gecko/20110218
Firefox/3.6.14 (.NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 16 of 25
Chrome/9.0.597.107 Safari/534.13
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]

1.0.20.0; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
Chrome/9.0.597.107 Safari/534.13
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
Chrome/9.0.597.107 Safari/534.13
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR
2.0.50727; InfoPath.1)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
Firefox/3.6.14 ( .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 17 of 25
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]

2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
Firefox/3.6.14 (.NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
( .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
( .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 18 of 25
CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]

3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
GET /ngs/eiabanner.gif HTTP/1.1 200 20100
3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500] GET /ngs/ngs.gif
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(Windows; U; Windows NT 5.1; en-US; rv:1.9.2.14)
Gecko/20110218 Firefox/3.6.14 ( .NET CLR 3.5.30729)
Gecko/20110218 Firefox/3.6.14 (.NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET
CLR 1.1.4322)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(compatible; MSIE 6.0; Windows NT 5.1; SV1; GTB6.6; .NET
CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET CLR 1.1.4322; .NET4.0C; MS-RTC LM 8)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 19 of 25
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;

.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
( .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
GET /ngs/search_button.gif HTTP/1.1 200 1370
CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
Windows NT 5.1; SV1; GTB6.6; .NET CLR 2.0.50727; .NET
CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; MS-RTC LM 8)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 20 of 25

1.0.20.0; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
Chrome/9.0.597.107 Safari/534.13
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
Chrome/9.0.597.107 Safari/534.13
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.0.4506.2152; .NET CLR 3.5.30729)
CLR 1.1.4322; .NET4.0C; .NET4.0E)
2/16/2012
Page 21 of 25
(Windows; U; Windows NT 5.1; en-US) AppleWebKit/534.13

(KHTML, like Gecko) Chrome/9.0.597.107 Safari/534.13
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
Chrome/9.0.597.107 Safari/534.13
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 22 of 25
3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]

3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
Chrome/9.0.597.107 Safari/534.13
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
Chrome/9.0.597.107 Safari/534.13
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
2/16/2012
Page 23 of 25

.NET CLR 1.1.4322; .NET4.0C; MS-RTC LM 8)
CLR 1.1.4322)
2.0.50727; 3P_UAMG 1.0.20.0; .NET CLR 3.0.4506.2152; .NET
CLR 3.5.30729)
Gecko/20110218 Firefox/3.6.14 (.NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
http://www.google.com/search?sourceid=chrome&ie=UTF8&q=eia+weekly+storage Mozilla/5.0 (Windows; U; Windows NT
5.1; en-US) AppleWebKit/534.13 (KHTML, like Gecko)
Chrome/9.0.597.107 Safari/534.13
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
Chrome/9.0.597.107 Safari/534.13
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.0.4506.2152; .NET CLR 3.5.30729)
2/16/2012
Page 24 of 25
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]

1.0.20.0; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
Chrome/9.0.597.107 Safari/534.13
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
Chrome/9.0.597.107 Safari/534.13
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
1.0.20.0; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
Chrome/9.0.597.107 Safari/534.13
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
( .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
Chrome/9.0.597.107 Safari/534.13
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
Chrome/9.0.597.107 Safari/534.13
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 25 of 25

3.0.4506.2152; .NET CLR 3.5.30729)
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
3.0.4506.2152; .NET CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
CLR 3.5.30729)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
( .NET CLR 3.5.30729)
2/16/2012
Page 1 of 4
Ticket TICK:53592
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
Block (b)(6),(b)(7)(C)
Single IP
Block
Completed
Medium
Luu, Quan (CONTR)
None
IRblocks@eia.gov
2011/03/08 16:45:06
2011/10/07 03:45:44
None
None
done
- 2011/10/07 03:45:44
Owners
Only:
Luu, Quan (CONTR) - 2011/03/09 08:29:12


Owners
Only:
Ticket Created
(b) (7)(A)
(b) (7)(A)
over
hits a second
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]

2/16/2012
Page 2 of 4
.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]

.NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
MSIE 7.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR
2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30618; MS-RTC
LM 8; .NET4.0C; .NET4.0E)
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 3 of 4
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]

(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 4 of 4
(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]

(b)(6),(b)(7)(C) - - [03/Mar/2011:(b) (7)(A) -0500]
2/16/2012
Page 1 of 2
Ticket TICK:54091
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
unblock (b)(6),(b)(7)(C)
Single IP
Unblock
Requested
Medium
None
IRblocks@eia.gov
2011/03/22 09:44:27
2011/10/07 03:45:44
None
None
None
- 2011/10/07 03:45:44
Owners
Only:
Owners
Only:
Ticket Created
From: (b)(6),(b)(7)(C) [mailto:]

Sent: Monday, March 21, 2011 3:35 PM
To: Gallagher, Bronwyn
Subject: Blockked IP Address...
Hi Bronwyn,
I believe our IP is blocked from viewing your website http://ir.eia.gov . Is there
anything we can do to get our IP Address unblocked? Our IP Address is
(b)(6),(b)(7)(C) It probably got blocked because you saw several connections from
this IP. It is our firewall IP and we have over 300 users that will connect through this
IP many times a day. If you can help or lead me in the right direction, I would
appreciate it. Thank you in advance.
(b)(6),(b)(7)(C)
Network Engineer
(b) (7)(A)
2/16/2012
Page 2 of 2
(b) (7)(A)
(b) (7)(A)
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
(b) (7)(A)
________________________________________
*********************************************************************
This e-mail may contain information that is confidential, privileged or otherwise
protected from disclosure. If you are not an intended recipient of this e-mail, do not
duplicate or redistribute it by any means. Please delete it and any attachments and
notify the sender that you have received it in error. Unless specifically indicated, this email is not an offer to buy or sell or a solicitation to buy or sell any commodities,
financial risk management products, or other physical or financial product or service,
an official confirmation of any transaction, or an official statement of EDF Trading
Limited, EDF Trading Markets Limited, EDF Trading North America, LLC, or any of
the EDF Group family of companies. Any views or opinions presented are solely those
of the author and do not necessarily represent those of the foregoing entities. EDF
Trading Markets Limited is authorised and regulated by the Financial Services
Authority. VAT number: GB 735 5479 07. EDF Trading Markets Limited and EDF
Trading North America, LLC are members of the EDF Group of companies. EDF
Trading Markets Limited maintains its registered office at 80 Victoria Street, 3rd
Floor, Cardinal Place, London, SW1E 5JL. A Company registered in England No.
4255974. EDF Trading North America, LLC is headquartered in the United States at
4700 W. Sam Houston Pkwy., Suite 250, Houston, TX 77041
*********************************************************************
______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email
______________________________________________________________________
2/16/2012
Page 1 of 13
Ticket TICK:54517
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
Single IP
Unblock
Completed
Medium
Luu, Quan (CONTR)
None
IRblocks@eia.gov
2011/04/05 15:52:28
2011/05/18 07:57:25
None
None
done
Norris, Jonathan (CONTR) - 2011/05/18 07:57:25 (via

email)
Owners
Only:
I will be out of the office until Tuesday May 11, 2011. Please
contact User Services at 586-8959 for any assistance.
Luu, Quan (CONTR) - 2011/05/18 07:57:22
Updated resolution text.



Owners
Only:
From: (b)(6),(b)(7)(C)
Sent: Monday, May 16, 2011 3:41 PM
To: Dean Zarras; Norris, Jonathan (CONTR)
Subject: Re: Web site Access
Jonathan,
Im just following up on web site access. Can you please tell me
what I need to do to expedite getting my users access to the site?
Thank You,
2/16/2012
Page 2 of 13
- (b)(6),(b)(7)(C)
(b) (7)(A)
On 5/12/11 8:18 AM, "(b)(6),(b)(7)(C) <mmills@sescollc.com>
wrote:
Jonathan,
My users are still reporting no access to the web site. Can you
provide an ETA on getting them unblocked or let me know if we
need to undertake additional steps?
Thank You,
(b)(6),(b)(7)(C)
(b) (7)(A)
On 4/27/11 5:16 PM, "(b)(6),(b)(7)(C)
wrote:
Hi Jonathan,
(b)(6),(b)(7)(C)
works with me and informed me of the problem

described below. We understand and respect your need to ensure
the reliability of your data infrastructure.
As per your request below, here is the requested information:

This is the block of IPs that we use for all of
(b) (7)(A)
our data requests from a variety of sources. Exactly which one is
used for this query can vary over time.
-How many times a second you plan to access the web site.
(b) (7)(A)
If it is acceptable, we would like to access the web site
per
second.
-What measures you put in place to prevent the attack from
happening again.
We had given some employees a means for accessing the web site
as fast as (b) (7)(A) per second for a brief second window. This has
been eliminated and replaced with a maximum of (b) (7)(A) per second
in a(b) (7)(A
In addition, we are going delegate a
single person for access to the data to ensure that not more than
one person is trying to access data at the same time.
(b) (7)(A)
Thank you for your prompt attention to this manner. We are

hopeful this revised plan will meet your requirements. Please let us
know either way.
2/16/2012
Page 3 of 13
Sincerely,
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
Chief Technology Officer / Chief Architect
(b) (7)(A)
(b)(6),(b)(7)(C)
------ Forwarded Message

From: "Norris, Jonathan (CONTR)" <Jonathan.Norris@eia.gov>
Date: Wed, 27 Apr 2011 15:03:10 -0500
To: (b)(6),(b)(7)(C)
Subject: RE: Web site Access
your request.
be modifying your download traffic and how you will prevent
-(b) (7)(A)
happening again.
Unblock request.
Jonathan Norris
2/16/2012
Page 4 of 13
From: (b)(6),(b)(7)(C)
Sent: Wednesday, April 27, 2011 4:00 PM
Subject: Web site Access
Were (b)(6),(b)(7)(C)
having problems reaching your
web site from the IP address range (b) (7)(A)
Is there
something that can be done to enable access for these IP
addresses?
Thank You,
(b)(6),(b)(7)(C)
(b) (7)(A)
------ End of Forwarded Message
Bily, Glenn (CONTR) - 2011/04/07 08:33:30


Owners
Only:
Ticket Created
(b) (7)(A)
(b) (7)(A)
(b) (7)(A)
(b) (7)(A)
(b) (7)(A)
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]

(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
2/16/2012
Page 5 of 13
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]

(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
2/16/2012
Page 6 of 13

Firefox/3.6.16
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
Firefox/3.6.16
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
Firefox/3.6.16
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
Firefox/3.6.16
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
Firefox/3.6.16
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
Firefox/3.6.16
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
Firefox/3.6.16
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
2/16/2012
Page 7 of 13

(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
2/16/2012
Page 8 of 13
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]

(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
Firefox/3.6.16
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
Firefox/3.6.16
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
Firefox/3.6.16
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
Firefox/3.6.16
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
Firefox/3.6.16
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
Firefox/3.6.16
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]

(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
2/16/2012
Page 9 of 13

(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
2/16/2012
Page 10 of 13
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]

Firefox/3.6.16
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
Firefox/3.6.16
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
Firefox/3.6.16
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
Firefox/3.6.16
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
Firefox/3.6.16
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]

(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
2/16/2012
Page 11 of 13

(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
Firefox/3.6.16
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
Firefox/3.6.16
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
Firefox/3.6.16
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
Firefox/3.6.16
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
2/16/2012
Page 12 of 13

Firefox/3.6.16
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
Firefox/3.6.16
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
2/16/2012
Page 13 of 13
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]

(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
Firefox/3.6.16
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
Firefox/3.6.16
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
Firefox/3.6.16
(b)(6),(b)(7)(C) - - [31/Mar/2011:(b) (7)(A) -0400]
Firefox/3.6.16
2/16/2012
Page 1 of 6
Ticket TICK:54885
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
Block (b)(6),(b)(7)(C)
Single IP
Block
Completed
Medium
Luu, Quan (CONTR)
None
IRblocks@eia.gov
2011/04/18 12:53:21
2011/04/20 08:50:15
None
None
done
Luu, Quan (CONTR) - 2011/04/20 08:50:15

Owners
Only:
(b)(6),(b)(7)(C)
(b) (7)(A)
(b) (7)(A)
(b)(6),(b)(7)(C)
- - [14/Apr/2011:(b) (7)(A) -0400] GET /ngs/app/js_timer.jsp HTTP/1.1 200

2153 http://ir.eia.gov/ngs/ngs.html Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US)
AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.224 Safari/534.10
(b)(6),(b)(7)(C) - - [14/Apr/2011:(b) (7)(A) -0400] GET /ngs/app/js_timer.jsp HTTP/1.1 200
2/16/2012
Page 2 of 6
(b)(6),(b)(7)(C)

(b)(6),(b)(7)(C) - - [14/Apr/2011:(b) (7)(A) -0400] GET /ngs/ngs.html HTTP/1.1 503 1399
http://www.google.com/search?
hl=en&source=hp&biw=1280&bih=963&q=natural+gas+storage&aq=f&aqi=g10&aql=&oq=
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/534.10 (KHTML, like
2/16/2012
Page 3 of 6

- - [14/Apr/2011:(b) (7)(A) -0400] GET /ngs/ngs.html HTTP/1.1 503 1399
(b)(6),(b)(7)(C)
2/16/2012
Page 4 of 6

Owners
Only:
Ticket Created
(b)(6),(b)(7)(C)
(b) (7)(A)
hits a second
(b)(6),(b)(7)(C)

2/16/2012
Page 5 of 6
(b)(6),(b)(7)(C)

2/16/2012
Page 6 of 6

- - [14/Apr/2011:(b) (7)(A) -0400] GET /ngs/ngs.html HTTP/1.1 503 1399
(b)(6),(b)(7)(C)
2/16/2012
Page 1 of 16
Ticket TICK:54893
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
unBlock Oklahoma Gas web crawler (b)(6),(b)(7)(C)

Single IP
Block
Completed
Medium
Narayanan, Prashanth (CONTR)
Netscaler
None
None
2011/04/18 14:59:48
2011/08/02 16:27:05
Rollins, Gregory (CONTR)
None
None
remove complete..
Rollins, Gregory (CONTR) - 2011/08/02 16:27:05 (via

email)
Owners
Only:
I will be out of the office until Wednesday. Please contact User

Services at 6-8959 for any assistance.
Narayanan, Prashanth (CONTR) - 2011/08/02 16:27:03

"Narayanan, Prashanth (CONTR)".
Changed Asset from "4/18/2011" to "Netscaler".
Changed ticket Queue from Change Control to Block List.

Changed ticket Status from "Closed" to "Requested".
Changed ticket Survey Satisfaction from "0" to "".
Changed ticket Survey Comments from "" to "".
Changed ticket Impact from "1 person can't work" to "Single
IP".
Changed ticket Category from "Network::DNS" to "Block".
Changed ticket Owner from "Narayanan, Prashanth
(CONTR)" to "Norris, Jonathan (CONTR)".
Owners
Only:
Changed ticket Title from "Block Oklahoma Gas web

crawler" to "unBlock Oklahoma Gas web crawler
(b)(6),(b)(7)(C) ".
From: (b)(6),(b)(7)(C) [(b)(6),(b)(7)(C)

Sent: Tuesday, June 07, 2011 4:17 PM
2/16/2012
Page 2 of 16

Subject: OGE Official Response to Incident Ticket #54472
Hi Jonathan,
OGE is requesting to remove the current block on the EIA site. As
a response to the incident related to ticket #54472, OGE has
the analysis tool offline to avoid our network traffic from being
categorized as a denial of service attack. Taking the tool offline
should bring back our hit rate back to normal prior to the incident
related to ticket #54472. Considering that OGE requires access to
the EIA site to download/upload required filings, we are estimating
that the peak hit rate will be at approximately 75 hits per second.
Additionally, although OGE have many users who requires to
access the EIA site, all of OGE outbound traffic will be coming
from 167.161.101.101.
I appreciate your assistance in resolving this matter. If you have
any questions, please feel free to contact me at (b)(6),(b)(7)(C) or
reply by email.
Thank you,
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
Information Security
OGE Energy Corp.
Phone/Voice Mail (b)(6),(b)(7)(C)
Nothing great has been and nothing great can be accomplished
without passion. G.W.F. Hegel
This e-mail (including attachments) is covered by the Electronic
Communications Privacy Act, 18 U.S.C., Sections 2510-2521. It is
intended for the individual or entity to which it is addressed. This
communication is confidential and may contain information that is
proprietary, privileged or otherwise legally exempt from
disclosure. If you are not the addressee, you are not authorized to
read, print, retain, copy or disseminate this message or any part
thereof. If you have received this message in error please notify the
sender immediately by e-mail and delete all copies of this message

Sent: Wednesday, May 18, 2011 10:14 AM
To: (b)(6),(b)(7)(C)
Subject: RE: email address
2/16/2012
Page 3 of 16
your request.
happening again.
Unblock request.
Jonathan Norris
From: (b)(6),(b)(7)(C) (b)(6),(b)(7)(C)
Subject: email address
(b)(6),(b)(7)(C)
(b) (7)(A)
Phone/Voice Mail (b)(6),(b)(7)(C)

2/16/2012
Page 4 of 16


email)
Owners
Only:
Owners
Only:
I will be out of the office for today (Wed. 5/18). Please contact
User Services at 6-8959 for any assistance.
4 calls from four different people this morning that claim to be the
latest point of contact for this case. I forwarded the history of them
to sellee evon the most recent security POC
To: '(b)(6),(b)(7)(C)
Subject: FW: Reference to case 54472
Jonathan Norris
From: (b)(6),(b)(7)(C) [(b)(6),(b)(7)(C)
]
(b)(b),(b)(7)(C) (b)(6),(b)(7)(C)
Cc: (b)(6),(b)(7)(C)
Subject: RE: Reference to case 54472
Mr. Norris
Since Im now working with our network group, Im going to try
to work with them to place some governance around the use of
webcrawler utilities
As of right now, our mitigating strategy will be to educate this
particular user about the impact of running this kind of software on
our network, and be very clear that we expect him to NOT run the
software again. We intend to disable his network switch port if it
occurs again.
Additionally, we intend to research why our rate limiting did not
function properly, and see what we can do to correct it.
(b)(6),(b)(7)(C)
I believe Matt and

provided you our IP address before, but just
to re-iterate, the external NAT IP of our firewall is
(b)(6),(b)(7)(C)
2/16/2012
Page 5 of 16
If you would please remove the block, we would appreciate it.

Additionally, prior to blocking us again, we would request that you
contact us so we can observe the problem while its occurring.
Please feel free to call me directly at (b)(6),(b)(7)(C) , or email me
at (b) (7)(A)
Thank you.
(b)(6),(b)(7)(C)
Lead Network Security Architect
(b) (7)(A)
Sent: Wednesday, May 04, 2011 12:27 PM
To: (b)(6),(b)(7)(C)
Subject: RE: Reference to case 54472
your request.
In order to process your unblock we will need to have an official
statement from your organization detailing how you will be
happening again.
Unblock request.
http://www.eia.doe.gov/privacyweb.html.
Jonathan Norris
From: (b)(6),(b)(7)(C) [(b)(6),(b)(7)(C)
Sent: Wednesday, May 04, 2011 1:17 PM
2/16/2012
Page 6 of 16
Subject: Reference to case 54472

Mr. Norris Please forward me the details of the incident in
question so that I can work with our network team to ensure we
have mitigating controls in place.
Thanks!
(b)(6),(b)(7)(C)
Lead Network Security Architect

OGE Energy Corp.
o ((b)(6),(b)(7)(C)
m (b)(6),(b)(7)(C)
please consider the environment before printing this e-mail
Owners
Only:
-----Original Message----From: Norris, Jonathan (CONTR)

To: '(b)(6),(b)(7)(C)
Subject: FW: Blocked OG+E ip address
Jonathan Norris
Sent: Wednesday, April 27, 2011 4:24 PM
Cc: (b)(6),(b)(7)(C)
Subject: RE: Blocked OG+E ip address
Jonathan,
I talked to the person within our company who is responsible for
running the program that caused the (malicious trafic). He had
talked to the firewall support people that he was able to contact
with the DOE, and they told him it was ok to run it again. He told
me he talked to them and I was under the impression you were
involved. Partly my fault. We have an understanding now that he
will not run it again and we have a meeting with him tomorrow to
look at his software and analyse how to configure it to not be
offensive. Until then it WILL not be run.
I appreciate your call to explain what you were seeing. We would
do the same thing to incoming traffic. OG+E would like to be
2/16/2012
Page 7 of 16
unblocked so we can continue to access data to and from your

EIA.COM site.
Thanks for your help
(b)(6),(b)(7)(C)
OG+E
--- On Tue, 4/26/11, Norris, Jonathan (CONTR)

<Jonathan.Norris@eia.gov> wrote:
> From: Norris, Jonathan (CONTR) <Jonathan.Norris@eia.gov>
(b)(6),(b)(7)(C)
> Subject: RE: Blocked OG+E ip
> Date: Tuesday, April 26, 2011, 1:15 PM
> Yes you violated the policy again and
> also did not follow the agreed
> statement you sent below
>
> Jonathan Norris
> Chenega Government Consulting, LLC
> Contractor to U.S. Energy Information Administration
> 1000 Independence Avenue, SW
> Washington, DC 20585
>
> -----Original Message----> From: (b)(6),(b)(7)(C)
>
> Sent: Tuesday, April 26, 2011 2:13 PM
> To: Norris, Jonathan (CONTR)
> Subject: Re: Blocked OG+E ip address
>
> It appears we are blocked again. No notification this time.
> Can you
> contact me please?
> (b)(6),(b)(7)(C)
> OG+E
>
> Sent from
iPhone
>
> On Apr 6, 2011, at 8:30 AM, "Norris, Jonathan (CONTR)"
> <Jonathan.Norris@eia.gov>
> wrote:
>
> > Sorry for the Delay, it will have to be done COB
> today
>>
> > Jonathan Norris
> > Chenega Government Consulting, LLC
> > Contractor to U.S. Energy Information Administration
> > 1000 Independence Avenue, SW
> > Washington, DC 20585
>>
(b)(6),(b)(7)(C)
2/16/2012
Page 8 of 16
> > -----Original Message----> > From: (b)(6),(b)(7)(C) [(b)(6),(b)(7)(C)

>
> > Sent: Wednesday, April 06, 2011 9:03 AM
> > To: Norris, Jonathan (CONTR)
> > Subject: RE: RE: RE: Blocked OG+E ip address
>>
> > We still appear to be blocked. Do you still see a
> problem?
>>
>>
> > --- On Tue, 4/5/11, Norris, Jonathan (CONTR)
<Jonathan.Norris@eia.gov>
> wrote:
>>
> >> From: Norris, Jonathan (CONTR)
> >> Subject: RE: RE: RE: Blocked OG+E ip address
> >> To: "(b)(6),(b)(7)(C) <(b)(6),(b)(7)(C)
> >> Date: Tuesday, April 5, 2011, 7:49 AM
> >> Ok you will be unblocked before COB
> >> today. If the this activity is seen again then we
> will block
> >> you again.
> >>
> >> Jonathan Norris
> >> Chenega Government Consulting, LLC
> >> Contractor to U.S. Energy Information
> Administration
> >> 1000 Independence Avenue, SW
> >> Washington, DC 20585
> >>
> >>
> >> -----Original Message----> >> From: (b)(6),(b)(7)(C) [(b)(6),(b)(7)(C)
> >>
> >> Sent: Monday, April 04, 2011 5:39 PM
> >> To: Norris, Jonathan (CONTR)
> >> Subject: Fw: RE: RE: Blocked OG+E ip address
> >>
> >> Jonathan,
> >> This is from my boss..
> >>
> >> --- On Mon, 4/4/11, (b)(6),(b)(7)(C) <(b)(6),(b)(7)(C)
> >> wrote:
> >>
> >>> From: (b)(6),(b)(7)(C) <(b)(6),(b)(7)(C)
> >>> Subject: RE: RE: Blocked OG+E ip address
> >>> To: "(b)(6),(b)(7)(C) <(b)(6),(b)(7)(C)
> >>> Cc: "(b)(6),(b)(7)(C)
> >> <(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
2/16/2012
Page 9 of 16
> >>> Date: Monday, April 4, 2011, 4:36 PM

> >>> Dear Mr. Norris,
> >>> This e-mail is in response to ticket #54472.
> Your
> >> group has
> >>> blocked us from all access to your network due
> to
> >> traffic
> >>> from our network which apparently set of a DOS
> attack
> >>> threshold. We believe we have located and shut
> down
> >> the
> >>> offending host, which was running some kind
> of
> >> traffic
> >>> intensive web crawling program. In accordance
> with
> >> your
> >>> request for a remediation plan, here is a list
> of
> >> steps we
> >>> are taking which should address your
> concerns.
> >>>
> >>> 1. We have shut down the offending application
> and
> >>> cautioned the user not to use it again.
> >>> 2. We have applied a (b) (7)(E)
> >>>
> >>> All our external internet traffic will be
> coming from
> >> our
> >>> NAT address of(b)(6),(b)(7)(C) We don't
> expect more
> >> than
> >>> one access per second to your web site,
> averaged over
> >> five
2/16/2012
Page 10 of 16
> >>> minutes of course.

> >>>
> >>> I hope this satisfies your request for
> remediation.
> >> Please
> >>> re-enable our network access to your
> organization. The
> >> data
> >>> this governmental agency provides is important
> to our
> >>> business operations and critical to
> maintaining
> >> certain
> >>> federal regulation compliance. Thank you.
> >>>
> >>> Sincerely,
> >>>
> >>> (b)(6),(b)(7)(C) E.
> >>> Manager Network and Communications
> >>> IT Service Operations
> >>> OGE Energy Corp.
> >>>(b)(6),(b)(7)(C)
> >>> (b)(6),(b)(7)(C)
> >>>
> >>>
> >>>
> >>> -----Original Message----> >>> From: (b)(6),(b)(7)(C) [(b)(6),(b)(7)(C)
> >>>
> >>> Sent: Monday, April 04, 2011 2:31 PM
> >>> To: (b)(6),(b)(7)(C)
> >>> Subject: Fw: RE: Blocked OG+E ip address
> >>>
> >>>
> >>>
> >>> --- On Mon, 4/4/11, Norris, Jonathan (CONTR)
> <Jonathan.Norris@eia.gov>
> >>> wrote:
> >>>
> >>>> From: Norris, Jonathan (CONTR)
> >>>> Subject: RE: Blocked OG+E ip address
> >>>> To: "(b)(6),(b)(7)(C) <(b)(6),(b)(7)(C)
> >>>> Date: Monday, April 4, 2011, 2:16 PM
> >>>> Thank you for contacting the U.S.
> >>>> Energy Information Administration. We
> >>>> have created incident ticket #54472 to
> track
> >> your
> >>> request.
> >>>>
2/16/2012
Page 11 of 16
> >>>>
> >>>> We ask that you access the web site a
> reasonable
> >>> number of
> >>>> times per
> >>>> second when attempting to download the
> files to
> >> avoid
> >>> your
> >>>> traffic being
> >>>> categorized as a denial of service attack.
>
> >>>>
> >>>> In order to process your unblock request
> we will
> >> need
> >>> to
> >>>> have an
> >>>> official statement from your organization
> >> detailing
> >>> how you
> >>>> will be
> >>>> modifying your download traffic and how
> you will
> >>> prevent
> >>>> abusive
> >>>> download attempts. This plan should
> include:
> >>>> - List of IPs your organization will
> initiate
> >>> downloads
> >>>> from.
> >>>> - How many times a second you plan to
> access the
> >> web
> >>> site.
> >>>>
> >>>> - What measures you put in place to
> prevent the
> >> attack
> >>> from
> >>>> happening
> >>>> again.
> >>>> Once you have submitted your statement,
> EIA will
> >>> review
> >>>> your Unblock
> >>>> request.
> >>>>
> >>>> The EIA privacy statement and security
> policy can
2/16/2012
Page 12 of 16
> >> be
> >>> found
> >>>> here
> >>>> http://www.eia.gov/privacyweb.html .
> >>>>
> >>>> Jonathan Norris
> >>>> Chenega Government Consulting, LLC
> >>>> Contractor to U.S. Energy Information
> >> Administration
> >>>> 1000 Independence Avenue, SW
> >>>> Washington, DC 20585
> >>>>
> >>>>
> >>>> -----Original Message----> >>>> From: (b)(6),(b)(7)(C) [(b)(6),(b)(7)(C)
> >>>>
> >>>> Sent: Monday, April 04, 2011 3:05 PM
> >>>> To: Norris, Jonathan (CONTR)
> >>>> Subject: Blocked OG+E ip address
> >>>>
(b)(6),(b)(7)(C)
> >>>> From: Moore,
> >>>> Sent: Monday, April 04, 2011 1:51 PM
> >>>> To: 'Jonathan.Norris@eia.gov'
> >>>> Cc: (b)(6),(b)(7)(C)
> >>>> Subject: blocked site
> >>>>
> >>>>
> >>>>
> >>>> Jonathan,
> >>>>
> >>>> Can you give me more information as to
> what you
> >> are
> >>> seeing
> >>>> from our
> >>>> outside address? I have been receiving
> complaints
> >> from
> >>> our
> >>>> people that
> >>>> the site eia.gov is blocked. As I am
> writing
> >> this,
> >>> I
> >>>> think I just found
> >>>> the culprit in our company. He is in our
> >> corporate
> >>> planning
> >>>> dept and has
> >>>> a program called Polyanalyst that is a
> form of
2/16/2012
Page 13 of 16
> >> web

> >>> crawler
> >>>> that he has
> >>>> pointed to eia.gov to get all the energy
> >> documents
> >>> they can
> >>>> get for
> >>>> planning and marketing. Probably a no-no
> from a
> >>> network
> >>>> admins point of
> >>>> view. I have instructed him to kill it and
> try
> >> to
> >>> find
> >>>> another way to
> >>>> get the data they are seeking. There are
> others
> >> in
> >>> OG+E
> >>>> that access the
> >>>> site for Energy and Environmental issues
> and
> >>> information as
> >>>> well. What
> >>>> do I need to do to get the block removed?
> >>>>
> >>>> Thanks for your help,
> >>>>
> >>>>
> >>>>
> >>>>
> >>>>
> >>>> (b)(6),(b)(7)(C)
> >>>> Sr. Network Admin.
> >>>> OG+E
> >>>> (b)(6),(b)(7)(C)
> >>>>
> >>>>
> >>>>
> >>>>
> >>>
> >>
> -------------------------------------------------------------------> >>>>
> >>>> From: (b)(6),(b)(7)(C)
> >>>> Sent: Friday, April 01, 2011 1:32 PM
> >>>> To: (b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
>
> >>> (b)(6),(b)(7)(C) ,
2/16/2012
Page 14 of 16
> >>>>
(b)(6),(b)(7)(C)
> Doug
> >>>> Subject: FW: Abuse from (b)(6),(b)(7)(C)
> >>>> Importance: High
> >>>>
> >>>>
> >>>>
> >>>> Please trace this if you can. Resolve
> eia.gov and
> >> use
> >>> the
> >>>> Niksun to
> >>>> trace any conversations.
> >>>>
> >>>>
> >>>>
> >>>> From: Norris, Jonathan (CONTR)
> >>>>
> >>>> Sent: Friday, April 01, 2011 1:21 PM
> >>>> To: (b)(6),(b)(7)(C)
> >>>> Subject: Abuse from (b)(6),(b)(7)(C)
> >>>>
> >>>>
> >>>>
> >>>> Hello
> >>>>
> >>>> We are receiving malicious traffic from a
> host
> >>> registered
> >>>> to your
> >>>> domain: (b)(6),(b)(7)(C) this traffic is
> >> targeting
> >>>> eia.gov.
> >>>>
> >>>> Please investigate and remediate.
> >>>>
> >>>>
> >>>>
> >>>>
> >>>>
> >>>> Jonathan Norris
> >>>>
> >>>> Chenega Government Consulting, LLC
> >>>> Contractor to U.S. Energy Information
> >> Administration
> >>>> 1000 Independence Avenue, SW
> >>>> Washington, DC 20585
> >>>>
> >>>>
2/16/2012
Page 15 of 16
> >>>>
> >>>
> >>
>

email)
Owners
Only:
I will be out of the office until Monday. Please contact User

Changed ticket Status from "Opened" to "Closed".

Changed ticket Owner from Unassigned to "Narayanan,
Prashanth (CONTR)".
Rollins, Gregory (CONTR) - 2011/04/21 10:14:13
Changed ticket Status from "Awaiting Approval" to

"Opened".
Owners
Only:
This emergency change was approved by Joe Bollino on 4/18.

Prashanth is implementing this block on the NetScaler.
Rollins, Gregory (CONTR) - 2011/04/18 14:59:48
Owners
Only:
Ticket Created
On Friday evening, 4/15, there were (b) (7)(E) generated by

ColdFusion at various times between 5:46pm and 7:39pm. The
cause of the alerts has been tracked to heavy traffic from
(b)(6),(b)(7)(C) . This IP address is the same (b)(6),(b)(7)(C)
address which caused problems on Friday night 2 weeks
earlier.
A block of this particular IP was approved before on 4/1. The
block was then lifted by Joe Bollino on 4/6 after the company
agreed to take corrective action regarding their web crawler.
According to Jonny Norris, there is no need to warn (b)(6),(b)(7)(C)
a second time prior to blocking them again
Prashanth has agreed to perform the IP block using the NetScaler
device. Both the Dallas and Forrestal NetScalers will be updated
on Monday 4/18, pending approval from Emergency Change
Control management.
Risk - Low. Only 1 IP address will be blocked, and no outage is
needed
Impact - Low. There should be no impact to other users. The
2/16/2012
Page 16 of 16
change will be made on each NetScaler independently.

Backout plan - Remove the block from both NetScalers.
2/16/2012
Page 1 of 15
Ticket TICK:55002
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
Single IP
Unblock
Completed
Medium
Luu, Quan (CONTR)
None
IRblocks@eia.gov
2011/04/21 16:39:27
2011/10/07 03:45:44
None
None
.done
Owners
Only:
- 2011/10/07 03:45:44
Luu, Quan (CONTR) - 2011/05/04 08:39:13


Owners
Only:
From: (b)(6),(b)(7)(C)
Sent: Thursday, April 28, 2011 2:14 PM
Subject: RE: Blocked IP address
Concerning the use of the EIA website, we will be modifying our
download traffic to prevent abusive download attempts by doing
the following:
1) Assigned a single user to access the site, download files and
distribute them internally.
2) Assigned user will refresh the site no more than time per
second via web browser.
3) IP address range is (b)(6),(b)(7)(C)
(b) (7)(A)
2/16/2012
Page 2 of 15
All other users have been made aware of these modifications.

Thank you.
(b)(6),(b)(7)(C)
IT Developer
(b) (7)(A)
(b)(6),(b)(7)(C)

(b)(6),(b)(7)(C)

Mr.
(b)(6),(b)(7)(C)
We will need you to Clarify the assumption of users in your 2nd

answer, and tell us how you will prevent this kind of incident from
happening again. The excessive traffic during the release is what is
considered the DOS attack.
Jonathan Norris
From: (b)(6),(b)(7)(C) (b)(6),(b)(7)(C)
Jonathan,
I am in charge of the IT at our shop. I am having trouble
understanding why we are being blocked in the first place. We
have one or two people who access the site to download a few files
on an infrequent basis. We have been using the site without any
problems until yesterday when we were blocked. We are not using
any Bots to scrape the site, that would be something I would
control. I would not classify our limited use of the site as a threat.
As far as the information you asked for:
IP Address range:
(b)(6),(b)(7)(C)
We plan on accessing the website no more than (b) (7)(A) times per
second. (Assuming two people at the same time.)
2/16/2012
Page 3 of 15
The only thing I can think to prevent this is assigning only one
person to download files.
If you can provide any clarification on how our use could be
considered an attack that would be helpful. My direct line is
below so feel free to call.
Thank you,
(b)(6),(b)(7)(C)
IT Developer
(b) (7)(A)
(b)(6),(b)(7)(C)

To: (b)(6),(b)(7)(C)
Subject: Blocked IP address
your request.
-(b) (7)(A)
happening again.
Unblock request.
2/16/2012
Page 4 of 15
Jonathan Norris
Owners
Only:
From: (b)(6),(b)(7)(C) (b)(6),(b)(7)(C)

Jonathan,
I am in charge of the IT at our shop. I am having trouble
understanding why we are being blocked in the first place. We
have one or two people who access the site to download a few files
on an infrequent basis. We have been using the site without any
problems until yesterday when we were blocked. We are not using
any Bots to scrape the site, that would be something I would
control. I would not classify our limited use of the site as a threat.
As far as the information you asked for:
IP Address range:
(b)(6),(b)(7)(C)
We plan on accessing the website no more than (b) (7)(A) times per
second. (Assuming two people at the same time.)
The only thing I can think to prevent this is assigning only one
person to download files.
If you can provide any clarification on how our use could be
considered an attack that would be helpful. My direct line is
below so feel free to call.
Thank you,
(b)(6),(b)(7)(C)
IT Developer
(b) (7)(A)
(b)(6),(b)(7)(C)

2/16/2012
Page 5 of 15

To: (b)(6),(b)(7)(C)
your request.
- (b) (7)(A)
happening again.
Unblock request.
Jonathan Norris
Bily, Glenn (CONTR) - 2011/04/28 12:08:54 (via email)
Owners
Only:
I am out of the office April 28-May 3, 2011.

Please email unixadmins@eia.doe.gov with any issues or call the
User Services Center.
Owners
Only:
Changed ticket Title from "Block (b)(6),(b)(7)(C) 1" to "unBlock

(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)

2/16/2012
Page 6 of 15

To: (b)(6),(b)(7)(C)
your request.
(b) (7)(A)
happening again.
Unblock request.
Jonathan Norris
Bily, Glenn (CONTR) - 2011/04/27 08:25:27


Owners
Only:
Ticket Created
2/16/2012
Page 7 of 15
(b) (7)(A)
(b) (7)(A)
(b) (7)(A)
(b)(6),(b)(7)(C)
- - [21/Apr/2011:(b) (7)(A) -0400]

NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
AskTbTRL2/3.11.3.15590 Firefox/3.6.16
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
2/16/2012
Page 8 of 15

NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400] GET /ngs/ngs.html
HTTP/1.1 503 1399
http://www.eia.doe.gov/oil_gas/natural_gas/ngs_notice.html
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.16)
Gecko/20110319 AskTbTRL2/3.11.3.15590 Firefox/3.6.16
HTTP/1.1 503 1399
HTTP/1.1 503 1399
HTTP/1.1 503 1399
2/16/2012
Page 9 of 15
HTTP/1.1 503 1399
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
2/16/2012
Page 10 of 15
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319

(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
HTTP/1.1 503 1399
HTTP/1.1 503 1399
HTTP/1.1 503 1399
HTTP/1.1 503 1399
2/16/2012
Page 11 of 15

- - [21/Apr/2011:(b) (7)(A) -0400] GET /ngs/ngs.html
HTTP/1.1 503 1399
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
- - [21/Apr/2011:(b) (7)(A) -0400]

NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
2/16/2012
Page 12 of 15
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319

(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
HTTP/1.1 503 1398
HTTP/1.1 503 1398
2/16/2012
Page 13 of 15

- - [21/Apr/2011:(b) (7)(A) -0400] GET /ngs/ngs.html
HTTP/1.1 503 1398
HTTP/1.1 503 1398
HTTP/1.1 503 1398
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
Chrome/10.0.648.204 Safari/534.16
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C)
2/16/2012
Page 14 of 15
(b)(6),(b)(7)(C)
- - [21/Apr/2011:(b) (7)(A) -0400]

NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
(b)(6),(b)(7)(C) - - [21/Apr/2011:(b) (7)(A) -0400]
NT 6.1; en-US; rv:1.9.2.16) Gecko/20110319
HTTP/1.1 503 1398
2/16/2012
Page 15 of 15
HTTP/1.1 503 1398 - Mozilla/5.0 (Windows; U; Windows NT 6.1;

en-US) AppleWebKit/534.16 (KHTML, like Gecko)
Chrome/10.0.648.204 Safari/534.16
HTTP/1.1 503 1398
HTTP/1.1 503 1398
HTTP/1.1 503 1398
HTTP/1.1 503 1398
2/16/2012
Page 1 of 9
Ticket TICK:55304
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
block (b)(6),(b)(7)(C)
Single IP
Block
Completed
Medium
Bily, Glenn (CONTR)
None
(b)(6),(b)(7)(C)
2011/05/04 11:38:57
2011/05/19 16:40:59
None
None
.
Owners
Only:
(b)(6),(b)(7)(C)
called again for clarification.

To: '(b)(6),(b)(7)(C)
Subject: RE: Request: removal from blocking list
(b)(6),(b)(7)(C)
Mrs.
,
This email will serve as a record with that stated we need you to specify the IP, Specify the technical
and managerial controls you will put in place (your organization will be held to the stated controls) and
specify the number of times per second you will access the site.
We ask that you access the web site a reasonable number of times per second when attempting to
download the files to avoid your traffic being categorized as a denial of service attack. We also ask that
you limit the number of IP's accessing the web site. Many large organizations download the data once
and redistribute the information internally. You may want to consider this option.
In order to process your unblock request we will need to have an official statement from your
organization detailing how you will be modifying your download traffic and how you will prevent
(b) (7)(A)
- What measures you put in place to prevent the attack from happening again.
The EIA privacy statement and security policy can be found here http://www.eia.gov/privacyweb.html .
Jonathan Norris
From: (b)(6),(b)(7)(C) [mailto:(b)(6),(b)(7)(C)
afp.com]
2/16/2012
Page 2 of 9

To answer your requests:
Our company is only listed under 1 IP address, the one I gave you.
We do not plan to access the website many times per second. As its always been for the past few years,
one of our journalists usually access the weekly oil data every Wednesday at 10:30 am, and then maybe
cross check the two PDF documents two or three times over the next half an hour. We go on the website
usually around 10:15 am and then wait with the countdown.
We also refer to the EIA website on a regular basis to check facts on energy for stories.
We will do our part to prevent the problem from happening again, but its hard for us to understand how
we could be registered accessing your website several times per second. We are currently investigating
the problem, could you help us by showing us some data?
Best regards,
(b)(6),(b)(7)(C)
______________
(b)(6),(b)(7)(C)
Financial Markets Correspondent
(b) (7)(A)
(b)(6),(b)(7)(C)
(b) (7)(A)
(b) (7)(A)
________________________________________
From: Norris, Jonathan (CONTR) [mailto:Jonathan.Norris@eia.gov]
Sent: jeudi 19 mai 2011 15:11
To: (b)(6),(b)(7)(C)
Cc: DiMascio, Shannon (CONTR)
Thank you for contacting the U.S. Energy Information Administration. We have created incident ticket
download the files to avoid your traffic being categorized as a denial of service attack. We also ask that
you limit the number of IP's accessing the web site. Many large organizations download the data once
and redistribute the information internally. You may want to consider this option.
-(b) (7)(A)
2/16/2012
Page 3 of 9
The EIA privacy statement and security policy can be found here http://www.eia.gov/privacyweb.html .
Jonathan Norris
From: (b)(6),(b)(7)(C) [mailto:(b)(6),(b)(7)(C)
To:
Cc: (b)(6),(b)(7)(C)
Subject: Request: removal from blocking list
(b)(6),(b)(7)(C)
Good afternoon,
As requested when we spoke on the phone, here is the NAT address for my organization:
(b)(6),(b)(7)(C)
Apparently we have been blocked from accessing the data releases on the EIA website. We would like
to be removed from the blocking list.
We are a news organization and have been covering the EIA data releases for a long time now.
The head of our IT department in the US is CCed in this email.
Thank you again for looking into this.
Best regards,
(b)(6),(b)(7)(C)
______________
(b)(6),(b)(7)(C)
(b) (7)(A)
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
(b) (7)(A)
(b) (7)(A)
This e-mail, and any file transmitted with it, is confidential and intended solely for the use of the
individual or entity to whom it is addressed. If you have received this email in error, please contact the
sender and delete the email from your system. If you are not the named addressee you should not
disseminate, distribute or copy this email.
For more information on (b) (7)(A)
, please visit our web site at (b) (7)(A)
2/16/2012
Page 4 of 9
For more information on (b)
(7)(A)
please visit our web site at (b)
(7)(A)
Owners
Only:

Good afternoon,
As requested when we spoke on the phone, here is the NAT address for my organization:
(b)(6),(b)(7)(C)
Apparently we have been blocked from accessing the data releases on the EIA website. We would like
to be removed from the blocking list.
We are a news organization and have been covering the EIA data releases for a long time now.
The head of our IT department in the US is CCed in this email.
Thank you again for looking into this.
Best regards,
(b)(6),(b)(7)(C)
______________
(b)(6),(b)(7)(C)
(b) (7)(A)
(b)(6),(b)(7)(C)
(b)(6),(b)(7)(C)
(b) (7)(A)
(b) (7)(A)
(b) (7)(A)
(b) (7)(A)
(b) (7)(A)
For more information on (b)
(7)(A)
please visit our web site at (b)
(7)(A)
Bily, Glenn (CONTR) - 2011/05/11 08:24:40

Owners
Only:
Ticket Created
2/16/2012
Page 5 of 9
No POC, IP address Belongs to (b) (7)(A)
(b) (7)(A)
(b)(6),(b)(7)(C) - - [04/May/2011:(b) (7)(A) -0400] GET /wpsr/app/js_timer.jsp HTTP/1.1 200 2073
http://ir.eia.gov/wpsr/wpsrsummary.pdf Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.6)

Gecko/20100625 Firefox/3.6.6 ( .NET CLR 3.5.30729; .NET4.0C)
(b)(6),(b)(7)(C) - - [04/May/2011:(b) (7)(A) -0400] GET /wpsr/wpsrsummary.pdf HTTP/1.1 503 1698
http://www.eia.doe.gov/oil_gas/petroleum/data_publications/weekly_petroleum_status_report/wpsr.html
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.6) Gecko/20100625 Firefox/3.6.6 ( .NET
CLR 3.5.30729; .NET4.0C)
CLR 3.5.30729; .NET4.0C)
CLR 3.5.30729; .NET4.0C)
2/16/2012
Page 6 of 9

CLR 3.5.30729; .NET4.0C)
CLR 3.5.30729; .NET4.0C)
CLR 3.5.30729; .NET4.0C)
2/16/2012
Page 7 of 9
CLR 3.5.30729; .NET4.0C)
CLR 3.5.30729; .NET4.0C)
CLR 3.5.30729; .NET4.0C)

2/16/2012
Page 8 of 9
CLR 3.5.30729; .NET4.0C)
CLR 3.5.30729; .NET4.0C)
CLR 3.5.30729; .NET4.0C)
CLR 3.5.30729; .NET4.0C)
CLR 3.5.30729; .NET4.0C)
CLR 3.5.30729; .NET4.0C)
2/16/2012
Page 9 of 9

CLR 3.5.30729; .NET4.0C)
CLR 3.5.30729; .NET4.0C)
CLR 3.5.30729; .NET4.0C)
CLR 3.5.30729; .NET4.0C)
CLR 3.5.30729; .NET4.0C)
2/16/2012
Page 1 of 6
Ticket TICK:55424
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
block (b)(6),(b)(7)(C)
Single IP
Block
Completed
Medium
Bily, Glenn (CONTR)
None
IRblocks@eia.gov
2011/05/09 13:01:41
2011/05/11 08:24:19
None
None
.
Bily, Glenn (CONTR) - 2011/05/11 08:24:19


Owners
Only:
Ticket Created

POC it TW Telecom ISP
(b) (7)(A)
(b) (7)(A)
(b)(6),(b)(7)(C)
- - [05/May/2011:(b) (7)(A) -0400]

Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET
CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0;
MDDR; .NET CLR 1.1.4322)
(b)(6),(b)(7)(C) - - [05/May/2011:(b) (7)(A) -0400]
http://ir.eia.gov/ngs/ng_weekly_storage.html Mozilla/4.0
(compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2;
.NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729;
Media Center PC 6.0)
(b)(6),(b)(7)(C) - - [05/May/2011:(b) (7)(A) -0400]
2/16/2012
Page 2 of 6

(b)(6),(b)(7)(C) - - [05/May/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [05/May/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [05/May/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [05/May/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [05/May/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [05/May/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [05/May/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [05/May/2011:(b) (7)(A) -0400]
2/16/2012
Page 3 of 6
(b)(6),(b)(7)(C)
- - [05/May/2011:(b) (7)(A) -0400]

GET /ngs/ng_weekly_storage.html HTTP/1.1 503 1412
http://www.google.com/url?
sa=t&source=web&cd=1&ved=0CCoQqwMoATAA&url=http%
3A%2F%2Fir.eia.gov%2Fngs%
2Fng_weekly_storage.html&rct=j&q=eia%20natural%20gas%
20storage&ei=VrLCTYr8Fcq9tgfawvnGBQ&usg=AFQjCNFGPO5_GM2NrKTarVtdEggnfZWng Mozilla/4.0 (compatible; MSIE 8.0;
CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
(b)(6),(b)(7)(C) - - [05/May/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [05/May/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [05/May/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [05/May/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [05/May/2011:(b) (7)(A) -0400] GET /ngs/ngs.html
2/16/2012
Page 4 of 6

Media Center PC 6.0; MDDR; .NET CLR 1.1.4322)
(b)(6),(b)(7)(C) - - [05/May/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [05/May/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [05/May/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [05/May/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [05/May/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [05/May/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [05/May/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [05/May/2011:(b) (7)(A) -0400]
2/16/2012
Page 5 of 6

- - [05/May/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [05/May/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [05/May/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [05/May/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [05/May/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [05/May/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [05/May/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C)
2/16/2012
Page 6 of 6
(b)(6),(b)(7)(C)
- - [05/May/2011:(b) (7)(A) -0400]

(b)(6),(b)(7)(C) - - [05/May/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [05/May/2011:(b) (7)(A) -0400]
(b)(6),(b)(7)(C) - - [05/May/2011:(b) (7)(A) -0400] GET /ngs/ngs.html
Media Center PC 6.0; MDDR; .NET CLR 1.1.4322)
2/16/2012
Page 1 of 17
Ticket TICK:55810
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
unBlock (b) (7)(A)

on the netscaler
Range of IPs
Unblock
Completed
Medium
Somaram, James (CONTR)
Netscaler
None
Prashanth.Narayanan@eia.gov
2011/05/31 15:53:16
2011/08/25 08:41:19
None
None
blocks have been completed on both netscalers..
Somaram, James (CONTR) - 2011/08/25 08:41:19
Owners
Only:
Unblock has been applied to both netscalers.

Changed ticket Owner from "Narayanan, Prashanth

(CONTR)" to "Somaram, James (CONTR)".
Changed ticket Title from "Block (b) (7)(A)

(b) (7)(A)
on the netscaler" to "unBlock (b) (7)(A)
(b) (7)(A)
on the netscaler".
Owners
Only:

Changed Asset from "" to "Netscaler".
These IP addresses are no longer owned by the Abuser/ attacker

, they are know owned by (b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
Owners
Only:
From: (b) (6), (b) (7)(C)

Sent: Tuesday, June 07, 2011 4:17 PM
2/16/2012
Page 2 of 17
(7)
Subject: (b)
Official Response to Incident Ticket #54472
(A)
Hi Jonathan,
is requesting to remove the current block on the EIA site. As
(7)
a response to the incident related to ticket #54472, (b)
has taken
(A)
the analysis tool offline to avoid our network traffic from being
categorized as a denial of service attack. Taking the tool offline
should bring back our hit rate back to normal prior to the incident
(7)
related to ticket #54472. Considering that (b)
requires access to
(A)
the EIA site to download/upload required filings, we are estimating
(b)
that the peak hit rate will be at approximately (7)
hits per second.
(A)
(b) (6),
Additionally, although (b) (7)(C) have many users who requires to
(b) (6),
access the EIA site, all of (b) (7)(C) outbound traffic will be coming
(b) (6), (b) (7)(C)
from
I appreciate your assistance in resolving this matter. If you have
any questions, please feel free to contact me at (b) (6), (b) (7)(C) or
reply by email.
Thank you,
(b) (7)
(A)
(b) (6), (b) (7)

(C)
(b) (6), (b) (7)
(C)
(b) (7)(A)
Phone/Voice Mail (b) (6), (b) (7)(C)


To: (b) (6), (b) (7)(C)
Subject: RE: email address
your request.
2/16/2012
Page 3 of 17
(b) (7)(A)
your organization will initiate downloads from.
(b) (7)(A)
happening again.
Unblock request.
Jonathan Norris
From: (b) (6), (b) (7)(C)
Subject: email address
(b) (6), (b) (7)

(C)
(b) (7)(A)
Phone/Voice Mail (b) (6), (b) (7)(C)

2/16/2012
Page 4 of 17
Owners
Only:
add ns acl www-Block DENY -srcIP = (b) (6), (b) (7)(C)

-destIP =
205.254.135.24 -priority 10 -kernelstate SFAPPLIED61 -logstate
ENABLED
add ns acl www-Block1 DENY -srcIP = (b) (7)(A)
(b) (7)(A)
-destIP = 205.254.135.24 -priority 20 -kernelstate
SFNOTAPPLIED61 -logstate ENABLED
add ns acl www-Block2 DENY -srcIP = (b) (6), (b) (7)(C) -destIP =
205.254.135.24 -priority 30 -kernelstate SFNOTAPPLIED61 logstate ENABLED
Owners
Only:
add ns acl www-Block DENY -srcIP = (b) (6), (b) (7)(C)

-destIP =
38.96.246.204 -priority 10 -kernelstate SFAPPLIED61 -logstate
ENABLED
add ns acl www-Block1 DENY -srcIP = (b) (7)(A)
(b) (7)(A)
-destIP = 38.96.246.204 -priority 20 -kernelstate
SFNOTAPPLIED61 -logstate ENABLED
add ns acl www-Block2 DENY -srcIP = (b) (6), (b) (7)(C) -destIP =
38.96.246.204 -priority 30 -kernelstate SFNOTAPPLIED61 logstate ENABLED
Owners
Only:
Wild blue is hitting the site from multiple ranges

Please block (b) (6), (b) (7)(C) and (b) (6), (b) (7)(C)
(b)
(7)
over(b)
hits on the rule from this range in less than (7)
seconds
(A)
(A)
(b) (7)
(the Rule blocks at (A) hits this means (b) (7)(A)
Date/Time 2011-05-30 18:35:02 EDT
Tag Name (b) (7)(E)
Severity Low
Combined Event Count(b)
(7)(E)
Cleared Flag false
Target Service http
2/16/2012
Page 5 of 17
Source IP Address (b) (6), (b) (7)(C)

SourcePort Name 0
Sensor Name IPSdot7
:adapter A
:blocked-count (b)
(7)(E)
:end-time 2011-05-30 (b) (7)(A)
:event-type Attack
(b)
:opened (7)
(b)
(7)
:pam(b) (7)(A)
(A)
:Protocol Name TCP
(b) (7)
:repeat-count (A)
:start-time 2011-05-30 18:35:02
(b)
(7)
:(b) (7)(A)
(A)
AdapterID A
BLOCK Default
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7
Owners
Only:
this block is for the main website.
Owners
Only:
Please block (b) (6), (b) (7)(C)

(b)
(7) (b)
over (b)
from this range in less than (7)
seconds
(A)
(7)(A)
(A)
Date/Time 2011-05-30 18:35:08 EDT
Tag Name (b) (7)(E)
Severity Low
(7)(E)
Cleared Flag false
Target Service http
SourcePort Name 0
Sensor Name IPSdot7
2/16/2012
Page 6 of 17
:adapter A
(b) (7)
:blocked-count (A)
:end-time 2011-05-30 18:35:36
:event-type Attack
(b) (7)
:opened (A)
(b)
(7)
:pam.(b) (7)(A)
(A)
:Protocol Name TCP
(b) (7)
:repeat-count (A)
:start-time 2011-05-30 18:35:08
(b)
(7)
:(b) (7)(A)
(A)
AdapterID A
BLOCK Default
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7
Date/Time 2011-05-30 18:35:08 EDT
Tag Name (b) (7)(E)
Severity Low
(b) (7)
Combined Event Count (A)
Cleared Flag false
Target Service http
(6), (b) (7)
Source IP Address (b)
(C)
SourcePort Name 0
Sensor Name IPSdot7
:adapter A
(b) (7)
:blocked-count (A)
:end-time 2011-05-30 18:35:36
:event-type Attack
(b)
:opened (7)
(b)
(b) (7)(A)
(7)
:pam.
(A)
:Protocol Name TCP
(b) (7)
:repeat-count (A)
:start-time 2011-05-30 18:35:08
(b)
(7)
:(b) (7)(A)
(A)
2/16/2012
Page 7 of 17
AdapterID A
BLOCK Default
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7
Date/Time 2011-05-30 18:35:08 EDT
Tag Name (b) (7)(E)
Severity Low
(b) (7)
Cleared Flag false
Target Service http
SourcePort Name 0
Sensor Name IPSdot7
:adapter A
(b) (7)
:blocked-count (A)
:end-time 2011-05-30 18:35:17
:event-type Attack
(b) (7)
:opened (A)
(b) (7)(E)
:pam.
:Protocol Name TCP
(b) (7)
:repeat-count (A)
:start-time 2011-05-30 18:35:08
:(b) (7)(E)
AdapterID A
BLOCK Default
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7
Date/Time 2011-05-30 18:35:08 EDT
Tag Name (b) (7)(E)
2/16/2012
Page 8 of 17
Severity Low
(7)(E)
Cleared Flag false
Target Service http
(6), (b) (7)
(C)
SourcePort Name 0
Sensor Name IPSdot7
:adapter A
(b) (7)
:blocked-count (A)
:end-time 2011-05-30 18:35:12
:event-type Attack
(b) (7)
:opened (A)
b)
:pam.(b) (7)(A)
7)(A)
:Protocol Name TCP
(b) (7)
:repeat-count (A)
:start-time 2011-05-30 18:35:08
b)
:(b) (7)(A)
7)(A)
AdapterID A
BLOCK Default
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7
Date/Time 2011-05-30 18:35:08 EDT
Tag Name (b) (7)(E)
Severity Low
Cleared Flag false
Target Service http
Sensor Name IPSdot7
:adapter A
2/16/2012
Page 9 of 17
:blocked-count 1
:event-type Attack
(b)
:opened (7)
(b)
(7)
:pam.(b) (7)(A)
(A)
:Protocol Name TCP
:repeat-count 1
(b)
(7)
:(b) (7)(A)
(A)
AdapterID A
BLOCK Default
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7
Date/Time 2011-05-30 18:35:08 EDT
Tag Name (b) (7)(E)
Severity Low
Cleared Flag false
Target Service http
Sensor Name IPSdot7
:adapter A
:blocked-count 1
:event-type Attack
(b)
:opened (7)
(E)
(b)
(7)
:pam.(b) (7)(A)
(A)
:Protocol Name TCP
:repeat-count 1
(b)
(7)
:(b) (7)(A)
(A)
AdapterID A
BLOCK Default
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
2/16/2012
Page 10 of 17
SensorName IPSdot7
Date/Time 2011-05-30 18:35:08 EDT
Tag Name (b) (7)(E)
Severity Low
Cleared Flag false
Target Service http
Sensor Name IPSdot7
:adapter A
:blocked-count 1
:event-type Attack
(b)
:opened (7)
(b)
(7)
:pam.(b) (7)(A)
(A)
:Protocol Name TCP
:repeat-count 1
(b)
(b) (7)(A)
(7)
:(b) (7)(A)
(A)
AdapterID A
BLOCK Default
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7
Date/Time 2011-05-30 18:35:08 EDT
Tag Name (b) (7)(E)
Severity Low
(b)
Combined Event Count(7)
(E)
Cleared Flag false
Target Service http
2/16/2012
Page 11 of 17

Sensor Name IPSdot7
:adapter A
(b)
:blocked-count(7)
(A)
:event-type Attack
(b)
:opened (7)
b) (7)
(b) (7)(A)
A)
:pam.
:Protocol Name TCP
:repeat-count 1
(b)
(b) (7)(A)
(7)
:(b) (7)(A)
(A)
AdapterID A
BLOCK Default
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7
Changed ticket CC list from "" to

"Prashanth.Narayanan@eia.gov".
Owners
Only:
Ticket Created

(b)
(b) (7)(A)
over
hits from this range in less than (7)
seconds
(A)
Date/Time 2011-05-30 18:35:08 EDT
Tag Name (b) (7)(E)
Severity Low
(b) (7)
Cleared Flag false
Target Service http
SourcePort Name 0
Sensor Name IPSdot7
:adapter A
(b) (7)
:blocked-count (A)
:end-time 2011-05-30 18:35:36
2/16/2012
Page 12 of 17
:event-type Attack
:opened(b)
b)
:pam.(b) (7)(A)
7)(A)
:Protocol Name TCP
:repeat-count(b)
(7)(A)
:start-time 2011-05-30 18:35:08
b)
:(b) (7)(A)
7)(A)
AdapterID A
BLOCK Default
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7
Date/Time 2011-05-30 18:35:08 EDT
Tag Name (b) (7)(E)
Severity Low
(b) (7)
Cleared Flag false
Target Service http
(6), (b) (7)
(C)
SourcePort Name 0
Sensor Name IPSdot7
:adapter A
(b) (7)
:blocked-count (A)
:end-time 2011-05-30 18:35:36
:event-type Attack
(b)
:opened (7)
(b)
(7)
:pam.(b) (7)(A)
(A)
:Protocol Name TCP
(b) (7)
:repeat-count (A)
:start-time 2011-05-30 18:35:08
(b)
(7)
:(b) (7)(A)
(A)
AdapterID A
BLOCK Default
2/16/2012
Page 13 of 17
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7
Date/Time 2011-05-30 18:35:08 EDT
Tag Name (b) (7)(E)
Severity Low
(b) (7)
Cleared Flag false
Target Service http
SourcePort Name 0
Sensor Name IPSdot7
:adapter A
(b) (7)
:blocked-count (A)
:end-time 2011-05-30 18:35:17
:event-type Attack
(b) (7)
:opened (A)
(b)
(7)
:pam.(b) (7)(A)
(A)
:Protocol Name TCP
(b) (7)
:repeat-count (A)
:start-time 2011-05-30 18:35:08
(b)
(7)
:(b) (7)(A)
(A)
AdapterID A
BLOCK Default
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7
Date/Time 2011-05-30 18:35:08 EDT
Tag Name (b) (7)(E)
Severity Low
Combined Event Count (b)
(7)(A)
Cleared Flag false
2/16/2012
Page 14 of 17

Target Service http
(6), (b) (7)
(C)
SourcePort Name 0
Sensor Name IPSdot7
:adapter A
:blocked-count (b)
(7)(A)
:end-time 2011-05-30 18:35:12
:event-type Attack
(b) (7)
:opened (A)
:pam.(b) (7)(E)
:Protocol Name TCP
:repeat-count (b)
(7)(A)
:start-time 2011-05-30 18:35:08
b)
:(b) (7)(A)
7)(A)
AdapterID A
BLOCK Default
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7
Date/Time 2011-05-30 18:35:08 EDT
Tag Name (b) (7)(E)
Severity Low
Cleared Flag false
Target Service http
Sensor Name IPSdot7
:adapter A
:blocked-count 1
:event-type Attack
(b)
:opened (7)
(b)
(7)
:pam.(b) (7)(A)
(A)
2/16/2012
Page 15 of 17
:Protocol Name TCP

:repeat-count 1
(b)
(7)
:(b) (7)(A)
(A)
AdapterID A
BLOCK Default
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7
Date/Time 2011-05-30 18:35:08 EDT
Tag Name (b) (7)(E)
Severity Low
Cleared Flag false
Target Service http
Sensor Name IPSdot7
:adapter A
:blocked-count 1
:event-type Attack
(b)
:opened (7)
(b)
(7)
:pam.(b) (7)(A)
(A)
:Protocol Name TCP
:repeat-count 1
(b)
(7)
:(b) (7)(A)
(A)
AdapterID A
BLOCK Default
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7
Date/Time 2011-05-30 18:35:08 EDT
2/16/2012
Page 16 of 17
Tag Name (b) (7)(E)

Severity Low
Cleared Flag false
Target Service http
Sensor Name IPSdot7
:adapter A
:blocked-count 1
:event-type Attack
:opened 61
(b)
(7)
:pam.(b) (7)(A)
(A)
:Protocol Name TCP
:repeat-count 1
(b)
(7)
:(b) (7)(A)
(A)
AdapterID A
BLOCK Default
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7
Date/Time 2011-05-30 18:35:08 EDT
Tag Name (b) (7)(E)
Severity Low
Cleared Flag false
Target Service http
Sensor Name IPSdot7
:adapter A
:blocked-count 1
2/16/2012
Page 17 of 17
:event-type Attack
(b)
:opened (7)
(b)
(7)
:pam.(b) (7)(A)
(A)
:Protocol Name TCP
:repeat-count 1
(b)
(7)
:(b) (7)(A)
(A)
AdapterID A
BLOCK Default
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7
2/16/2012
Page 1 of 6
Ticket TICK:55941
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
block (b) (6), (b) (7)(C) on netscaler

Single IP
Block
Completed
Medium
Netscaler
None
2011/06/06 10:01:31
2011/06/08 08:26:09
None
None
Resolution:
added on both netscalers..
Narayanan, Prashanth (CONTR) - 2011/06/08

08:26:09


to "Narayanan, Prashanth (CONTR)".
Owners
Only:
Changed ticket Title from "block (b) (6), (b) (7)(C) " to "block
(b) (6), (b) (7)(C)
on netscaler".
Changed ticket CC list from "" to
"Prashanth.Narayanan@eia.gov".
please block (b) (6), (b) (7)(C)

(b)
events
(7)(A)
on the IPS from this (b) (7)(A)
IP
Date/Time 2011-06-06 02:19:26 EDT

Tag Name (b) (7)(E)
Severity Low
(b) (7)
Cleared Flag false
2/16/2012
Page 2 of 6
Target Service http

SourcePort Name 0
Sensor Name IPSdot7
:adapter A
:blocked-count (b)
(7)(A)
:end-time 2011-06-06 02:19:27
:event-type Attack
:(b) (7)(A) (b)
(b)
(7)
:pam.(b) (7)(A)
(A)
:Protocol Name TCP
:repeat-count (b)
(7)(A)
:start-time 2011-06-06 02:19:26
(b)
(7)
:(b) (7)(A)
(A)
AdapterID A
BLOCK Default
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7
Date/Time 2011-06-06 02:19:26 EDT
Tag Name (b) (7)(E)
Severity Low
Cleared Flag false
Target Service http
Sensor Name IPSdot7
:adapter A
:blocked-count 1
:event-type Attack
(b)
:(b) (7)(A) (7)
(b)
(b) (7)(A)
(7)
:pam.
(A)
:Protocol Name TCP
(b)
:repeat-count(7)
(A)
2/16/2012
Page 3 of 6
(b)
(7)
:(b) (7)(A)
(A)
AdapterID A
BLOCK Default
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7
Date/Time 2011-06-06 02:19:26 EDT
Tag Name (b) (7)(E)
Severity Low
(b)
(A)
Cleared Flag false
Target Service http
Sensor Name IPSdot7
:adapter A
:blocked-count 1
:event-type Attack
(b)
:(b) (7)(A) (7)
(b)
(7)
:pam.(b) (7)(A)
(A)
:Protocol Name TCP
:repeat-count 1
(b)
(7)
:(b) (7)(A)
(A)
AdapterID A
BLOCK Default
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7
Owners
Only:
Ticket Created
2/16/2012
Page 4 of 6
(b) (7)(A)
Date/Time 2011-06-06 02:19:26 EDT

Tag Name (b) (7)(E)
Severity Low
Combined Event Count (b)
(7)(A)
Cleared Flag false
Target Service http
SourcePort Name 0
Sensor Name IPSdot7
:adapter A
:blocked-count (b)
(7)(A)
:end-time 2011-06-06 02:19:27
:event-type Attack
:(b) (7)(A) (b)
(b)
(7)
:pam.(b) (7)(A)
(A)
:Protocol Name TCP
:repeat-count (b)
(7)(A)
:start-time 2011-06-06 02:19:26
(b)
(7)
:(b) (7)(A)
(A)
AdapterID A
BLOCK Default
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7
Date/Time 2011-06-06 02:19:26 EDT
Tag Name (b) (7)(E)
Severity Low
Cleared Flag false
Target Service http
2/16/2012
Page 5 of 6

Sensor Name IPSdot7
:adapter A
(b)
:blocked-count(7)
(A)
:event-type Attack
(b)
:(b) (7)(A) (7)
(b)
(7)
:pam.(b) (7)(A)
(A)
:Protocol Name TCP
(b)
:repeat-count(7)
(A)
(b)
(7)
:(b) (7)(A)
(A)
AdapterID A
BLOCK Default
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7
Date/Time 2011-06-06 02:19:26 EDT
Tag Name (b) (7)(E)
Severity Low
(b)
(A)
Cleared Flag false
Target Service http
Sensor Name IPSdot7
:adapter A
(b)
:blocked-count(7)
(A)
:event-type Attack
(b)
:(b) (7)(A) (7)
(b)
(7)
:pam.(b) (7)(A)
(A)
:Protocol Name TCP
(b)
:repeat-count(7)
(A)
(b)
(7)
:(b) (7)(A)
(A)
AdapterID A
2/16/2012
Page 6 of 6
BLOCK Default
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7
2/16/2012
Page 1 of 9
Ticket TICK:55948
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
block (b) (6), (b) (7)(C)

on netscaler
Range of IPs
Block
Completed
Medium
Netscaler
None
2011/06/06 12:03:41
2011/06/29 14:33:18
None
None
compelted
Resolution:
(b) (6), (b) (7)(C)
Owners
Only:
Date/Time 2011-06-29 (b) (7)(A) EDT

Tag Name (b) (7)(E)
Severity Low
(b) (7)
Cleared Flag false
Target Service http
SourcePort Name 0
Sensor Name IPSdot7
:adapter A
(b) (7)
:blocked-count (A)
:end-time 2011-06-29 15:43:25
:event-type Attack
(b) (7)
:opened (A)
(b)
(7)
:pam.(b) (7)(A)
(A)
:Protocol Name TCP
(b) (7)
:repeat-count (A)
:start-time 2011-06-29 15:43:24
2/16/2012
Page 2 of 9
(b) (7)
(A)
:(b) (7)(A)
AdapterID A
BLOCK Default
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7
Date/Time 2011-06-29 02:10:56 EDT

Tag Name (b) (7)(E)
Severity Low
(b)
Combined Event Count (7)
(A)
Cleared Flag false
Target Service http
SourcePort Name 0
Sensor Name IPSdot7
:adapter A
(b)
:blocked-count (7)
(A)
:end-time 2011-06-29 02:10:56
:event-type Attack
(b) (7)
:opened (A)
(b)
(7)
:pam.(b) (7)(A)
(A)
:Protocol Name TCP
(b)
:repeat-count (7)
(A)
:start-time 2011-06-29 02:10:56
(b) (7)
(A)
:(b) (7)(A)
AdapterID A
BLOCK Default
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7
2/16/2012
Page 3 of 9
Date/Time 2011-06-29 12:18:13 EDT

Tag Name (b) (7)(E)
Severity Low
(b)
(A)
Cleared Flag false
Target Service http
SourcePort Name 0
Sensor Name IPSdot7
:adapter A
(b)
:blocked-count (7)
(A)
:end-time 2011-06-29 12:18:13
:event-type Attack
(b) (7)
:opened (A)
(b)
(7)
:pam.(b) (7)(A)
(A)
:Protocol Name TCP
(b)
:repeat-count (7)
(A)
:start-time 2011-06-29 12:18:13
:(b) (7)(A)
132
AdapterID A
BLOCK Default
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7

08:23:42


Owners
Only:
Ticket Created
2/16/2012
Page 4 of 9

OC3 Networks & Web Solutions
Date/Time 2011-06-06 10:00:22 EDT
Tag Name (b) (7)(E)
Severity Low
(b) (7)
Cleared Flag false
Target Service http
SourcePort Name 0
Sensor Name IPSdot7
:adapter A
(b) (7)
:blocked-count (A)
:end-time 2011-06-06 10:00:22
:event-type Attack
(b) (7)
:opened (A)
(b)
(7)
:pam.(b) (7)(A)
(A)
:Protocol Name TCP
(b) (7)
:repeat-count (A)
:start-time 2011-06-06 10:00:22
(b) (7)
(A)
:(b) (7)(A)
AdapterID A
BLOCK Default
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7
Date/Time 2011-06-06 01:15:56 EDT
Tag Name (b) (7)(E)
Severity Low
(b) (7)
Cleared Flag false
2/16/2012
Page 5 of 9
Target Service http

SourcePort Name 0
Sensor Name IPSdot7
:adapter A
(b) (7)
:blocked-count (A)
:end-time 2011-06-06 01:15:56
:event-type Attack
(b) (7)
:opened (A)
(b)
(7)
:pam.(b) (7)(A)
(A)
:Protocol Name TCP
(b) (7)
:repeat-count (A)
:start-time 2011-06-06 01:15:56
(b) (7)
(A)
:(b) (7)(A)
AdapterID A
BLOCK Default
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7
Date/Time 2011-06-06 11:29:02 EDT
Tag Name (b) (7)(E)
Severity Low
(b)
(A)
Cleared Flag false
Target Service http
SourcePort Name 0
Sensor Name IPSdot7
:adapter A
(b)
:blocked-count (7)
(A)
:end-time 2011-06-06 11:29:03
:event-type Attack
(b) (7)
:opened (A)
(b)
(7)
:pam.(b) (7)(A)
(A)
:Protocol Name TCP
2/16/2012
Page 6 of 9
(b)
:repeat-count (7)
(A)
:start-time 2011-06-06 11:29:02
(b)
(7)
:(b) (7)(A)
(A)
AdapterID A
BLOCK Default
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7
Date/Time 2011-06-06 10:00:22 EDT
Tag Name (b) (7)(E)
Severity Low
(b)
(A)
Cleared Flag false
Target Service http
Sensor Name IPSdot7
:adapter A
:blocked-count 1
:event-type Attack
(b)
:opened (7)
(b)
(7)
:pam.(b) (7)(A)
(A)
:Protocol Name TCP
(b)
:repeat-count(7)
(A)
(b)
(7)
:(b) (7)(A)
(A)
AdapterID A
BLOCK Default
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7
Date/Time 2011-06-06 10:00:22 EDT
Tag Name (b) (7)(E)
2/16/2012
Page 7 of 9

Severity Low
(b)
(A)
Cleared Flag false
Target Service http
Sensor Name IPSdot7
:adapter A
(b)
:blocked-count(7)
(A)
:event-type Attack
(b)
:opened (7)
(b)
(7)
:pam.(b) (7)(A)
(A)
:Protocol Name TCP
(b)
:repeat-count(7)
(A)
(b)
(7)
:(b) (7)(A)
(A)
AdapterID A
BLOCK Default
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7
Date/Time 2011-06-06 11:29:02 EDT
Tag Name (b) (7)(E)
Severity Low
(b)
(A)
Cleared Flag false
Target Service http
Sensor Name IPSdot7
:adapter A
(b)
:blocked-count(7)
(A)
:event-type Attack
(b)
:opened (7)
(A)
2/16/2012
Page 8 of 9
(b)
(7)
:pam.(b) (7)(A)
(A)
:Protocol Name TCP
(b)
:repeat-count(7)
(A)
:(b) (7)(A)
AdapterID A
BLOCK Default
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7
Date/Time 2011-06-06 11:29:02 EDT

Tag Name (b) (7)(E)
Severity Low
(b)
(A)
Cleared Flag false
Target Service http
Sensor Name IPSdot7
:adapter A
(b)
:blocked-count(7)
(A)
:event-type Attack
(b)
:opened (7)
(b)
(7)
:pam.(b) (7)(A)
(A)
:Protocol Name TCP
(b)
:repeat-count(7)
(A)
(b)
(7)
:(b) (7)(A)
(A)
AdapterID A
BLOCK Default
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7
Date/Time 2011-06-06 11:29:02 EDT
Tag Name (b) (7)(E)
2/16/2012
Page 9 of 9

Severity Low
(b)
(A)
Cleared Flag false
Target Service http
Sensor Name IPSdot7
:adapter A
(b)
:blocked-count(7)
(A)
:event-type Attack
(b)
:opened (7)
(b)
(7)
:pam.(b) (7)(A)
(A)
:Protocol Name TCP
(b)
:repeat-count(7)
(A)
(b)
(7)
:(b) (7)(A)
(A)
AdapterID A
BLOCK Default
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7
2/16/2012
Page 1 of 38
Ticket TICK:55997
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
unblock (b) (6), (b) (7)(C)

Single IP
Unblock
Completed
Medium
Luu, Quan (CONTR)
IR Server
None
IRblocks@eia.gov
2011/06/07 14:20:10
2011/07/13 08:52:29
None
None
done
Luu, Quan (CONTR) - 2011/07/13 08:52:29


Owners
Only:
Added attachment 'Incident Ticket_55997.pdf'

Changed ticket Title from "block (b) (6), (b) (7)(C)
to
"unblock (b) (6), (b) (7)(C)
From: (b) (6), (b) (7)(C)

Sent: Monday, July 11, 2011 4:09 PM
Subject: FW: blocked access for http://ir.eia.gov/ngs
From: (b) (6), (b) (7)(C)

Sent: Thursday, June 30, 2011 1:49 PM
Cc: (b) (6), (b) (7)(C)
Subject: RE: blocked access for http://ir.eia.gov/ngs
2/16/2012
Page 2 of 38
Thank you Jonathan for your quick response and apologies for
creating excess traffic. Attached is an official letter along with our
future plan to reduce the traffic generated from (b) (7)(A)
Thank you and have a good holiday weekend.

To: (b) (6), (b) (7)(C)
your request.
(b) (7)(A)
(b) (7)(A)
happening again.
Unblock request.
From: (b) (6), (b) (7)(C)
Subject: blocked access for http://ir.eia.gov/ngs
Hi Mr. Norris, I was directed to you concerning blocked access
from the weekly natural gas reports. I think it was due to excessive
hits to the site by an application that was accessing the main page.
We have disabled the application to comply with the instructions
found here: http://www.eia.gov/neic/press/press335.html.
Can you unblock (b) (7)(A)
at the following IP address
2/16/2012
Page 3 of 38
(b) (6), (b) (7)(C)
Thank you for your time.
(b) (6), (b) (7)(C)
VP, NatGas & Power Analyst

(b) (7)(A)
Cell: (b) (6), (b) (7)(C)

Office: (b) (6), (b) (7)(C)
Attachment: Incident Ticket_55997.pdf (130.41 KB)
Owners
Only:

To:(b) (6), (b) (7)(C)
your request.
(b) (7)(A)
(b) (7)(A)
happening again.
Unblock request.
From: (b) (6), (b) (7)(C)
Subject: blocked access for http://ir.eia.gov/ngs
Hi Mr. Norris, I was directed to you concerning blocked access
from the weekly natural gas reports. I think it was due to excessive
2/16/2012
Page 4 of 38
hits to the site by an application that was accessing the main page.
We have disabled the application to comply with the instructions
found here: http://www.eia.gov/neic/press/press335.html.
Can you unblock (b) (7)(A)
at the following IP address
Thank you for your time.
(b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
VP, NatGas & Power Analyst

(b) (7)(A)
Cell: (b) (6), (b) (7)(C)

Office:(b) (6), (b) (7)(C)
Luu, Quan (CONTR) - 2011/06/08 08:47:50

Luu, Quan (CONTR) - 2011/06/08 08:47:36

Owners
Only:
Please Block (b) (6), (b) (7)(C)

POC/ ISP (b) (6), (b) (7)(C)
(b)
over (7)
hits a second
(A)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]

Windows NT 5.1; GTB7.0; .NET CLR 1.1.4322; .NET CLR
2.0.50727; .NET CLR 3.0.04506.30; MDDR; .NET CLR
3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2; .NET4.0C;
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
2/16/2012
Page 5 of 38
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]

.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
MSIE 7.0; Windows NT 5.1; GTB7.0; .NET CLR 1.1.4322; .NET
CLR 2.0.50727; .NET CLR 3.0.04506.30; MDDR; .NET CLR
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
2/16/2012
Page 6 of 38

.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
GET /ngs/weekly.csv HTTP/1.1 503 1401 - Mozilla/4.0
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
2/16/2012
Page 7 of 38

.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
2/16/2012
Page 8 of 38

(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
2/16/2012
Page 9 of 38
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
2/16/2012
Page 10 of 38
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
2/16/2012
Page 11 of 38
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
Windows NT 5.1; InfoPath.2; .NET CLR 2.0.50727; .NET CLR
1.1.4322; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
1.1.4322; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
1.1.4322; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
1.1.4322; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
2/16/2012
Page 12 of 38

.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
q=eia+gas+storage+report&rls=com.microsoft:en-us&ie=UTF8&oe=UTF-8&startIndex=&startPage=1&rlz=1I7ADRA_en
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.2;
.NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR
3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
2/16/2012
Page 13 of 38

.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
http://ir.eia.gov/ngs/weekly.csv Mozilla/5.0 (Windows NT 5.1)
AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.71
Safari/534.24
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
2/16/2012
Page 14 of 38

- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
2/16/2012
Page 15 of 38

- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
GET /ngs/weekly.csv HTTP/1.1 503 1401
http://ir.eia.gov/ngs/ngs.html Mozilla/5.0 (Windows NT 5.1)
Safari/534.24
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
Safari/534.24
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
Safari/534.24
(b) (6), (b) (7)(C)
2/16/2012
Page 16 of 38
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]

.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
2/16/2012
Page 17 of 38
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
GET /ngs/weekly.csv HTTP/1.1 503 1401
Safari/534.24
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400] GET /favicon.ico
2/16/2012
Page 18 of 38
.NET CLR 3.0.04506.30; MDDR; InfoPath.2; .NET CLR

3.0.4506.2152; .NET CLR 3.5.30729; MS-RTC LM 8)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; MS-RTC LM 8)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; MS-RTC LM 8)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; MS-RTC LM 8)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
2/16/2012
Page 19 of 38

(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
2.0.50727; .NET CLR 3.0.04506.30; MDDR; InfoPath.2; .NET
CLR 3.0.4506.2152; .NET CLR 3.5.30729; MS-RTC LM 8)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
2/16/2012
Page 20 of 38

- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
http://ir.eia.gov/ngs/blackberry.txt Mozilla/5.0 (Windows NT 5.1)
Safari/534.24
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
2/16/2012
Page 21 of 38

.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
Safari/534.24
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
GET /ngs/blackberry.txt HTTP/1.1 503 1405
Safari/534.24
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
2/16/2012
Page 22 of 38
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
GET /ngs/ngs.html HTTP/1.1 503 1399 - Mozilla/5.0 (Windows
NT 5.1) AppleWebKit/534.24 (KHTML, like Gecko)
Chrome/11.0.696.71 Safari/534.24
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
2/16/2012
Page 23 of 38

Safari/534.24
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
Safari/534.24
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
2/16/2012
Page 24 of 38

.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
Safari/534.24
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
Safari/534.24
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
2/16/2012
Page 25 of 38

- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
Safari/534.24
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
Safari/534.24
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
2/16/2012
Page 26 of 38

.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
Safari/534.24
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
Safari/534.24
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
Safari/534.24
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
Safari/534.24
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
2/16/2012
Page 27 of 38

- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
Safari/534.24
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
Safari/534.24
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
Safari/534.24
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
Safari/534.24
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
2/16/2012
Page 28 of 38
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]

.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
GET /ngs/ngs.html HTTP/1.1 503 1399 - Mozilla/5.0 (Windows
NT 5.1) AppleWebKit/534.24 (KHTML, like Gecko)
Chrome/11.0.696.71 Safari/534.24
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
Safari/534.24
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
Safari/534.24
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
2/16/2012
Page 29 of 38

.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
Safari/534.24
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
Safari/534.24
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
Safari/534.24
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
2/16/2012
Page 30 of 38
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]

.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
Safari/534.24
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
Safari/534.24
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
2/16/2012
Page 31 of 38
Safari/534.24
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]

Safari/534.24
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
Safari/534.24
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
Safari/534.24
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
Safari/534.24
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(compatible; MSIE 7.0; Windo

Changed Asset from "" to "IR Server".
Owners
Only:
Ticket Created

POC/ ISP (b) (6), (b) (7)(C)
(b)
over (7)
hits a second
(A)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]

2/16/2012
Page 32 of 38
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]

.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
2/16/2012
Page 33 of 38

.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
2/16/2012
Page 34 of 38
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
2/16/2012
Page 35 of 38
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]

.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]

2/16/2012
Page 36 of 38
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
2/16/2012
Page 37 of 38
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
2/16/2012
Page 38 of 38
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [02/Jun/2011:(b) (7)(A) -0400]
2/16/2012
Page 1 of 5
Ticket TICK:56105
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
unBlock (b) (6), (b) (7)(C)

Single IP
Unblock
Completed
Medium
Luu, Quan (CONTR)
IR Server
None
IRblocks@eia.gov
2011/06/13 11:18:25
2011/06/30 08:45:35
None
None
done
Luu, Quan (CONTR) - 2011/06/30 08:45:35
Owners
Only:
Changed ticket Title from "Block (b) (6), (b) (7)(C)

to "unBlock (b) (6), (b) (7)(C)
Changed ticket Owner from "Luu, Quan (CONTR)" to "Bily, Glenn (CONTR)".
From: (b) (6), (b) (7)(C)

Sent: Wednesday, June 29, 2011 3:25 PM
Cc: (b) (6), (b) (7)(C)
Subject: RE: EIA website CSV file table downloads not working
Jonathan,
- Access to the EIA web site has been restricted for our Houston office to ONLY allow (b) (6), (b)
(7)(C)
and (b) (6), (b) (7) the ability to view the required data.
(C)
- Access to the website should only be done (b) (7)(A)

on Wednesday mornings at 09:30 by
(b) (6), (b)
(b) (6), (b) (7)
either(7)(C) OR (C)
until the .csv data is retrieved. Once the data retrieval is complete the
website access will no longer be needed until the next week.
Please advise if these additional measures are sufficient to complete our unblock request.
Thank you.
(b) (6), (b) (7)(C)
Client Technologies Technician II

(b) (7)(A)
Houston, TX
(b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
2/16/2012
Page 2 of 5
Sent: Tuesday, June 28, 2011 8:00 AM

To: (b) (6), (b) (7)(C)
Cc: Till(b) (6), (b) (7)(C)
Mr.(b) (6), (b)
(7)(C)
This plan should include:

(b) (7)(A)
(b) (7)(A)
You need to list both Technical and managerial controls.

If you get this to me COB today I can have you unblocked by Wed.
Jonathan Norris
From: (b) (6), (b) (7)(C)
Sent: Monday, June 27, 2011 5:27 PM
Cc: (b) (6), (b) (7)(C)
Hello Jonathan,
Just following up to verify that you received my last correspondence in this matter. Please advise.
Thank you.
(b) (6), (b) (7)(C)

(b) (7)(A)
Houston, TX
(b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
From: (b) (6), (b) (7)(C)

Cc: (b) (6), (b) (7)(C)
Hello Jonathan,
Ive consulted with (b) (6), (b) (7)(C)
analysts (b) (6), (b) (7) and (b) (6), (b) (7)
(C)
(C)
from our network operations group and our market data

whom Ive included in this email.
The following EIA websites are accessed once a week, every Wednesday at 09:30 AM to download
the CSV file data:
http://ir.eia.gov/wpsr/table9.csv
http://ir.eia.gov/wpsr/table5a.csv
2/16/2012
Page 3 of 5
The downloads for this data could be initiated from either of these IP addresses from our Houston
office:
(b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
Once the data is downloaded it is being posted internally for access by other (b) (7) employees. The
(A)
process for obtaining this data has been in place for several years and was working well until very
recently. No changes have been made to the process for obtaining this data or how it is then posted
for internal use by others.
Please advise if this is sufficient information to unblock our access to the .csv file portion of the site.
If you have any concerns or if there is additional information you require or that you can provide
please let us know.
Thank you.
(b) (6), (b) (7)(C)

(b) (7)(A)
Houston, TX
(b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)

Sent: Friday, June 17, 2011 7:51 AM
To: (b) (6), (b) (7)(C)
Thank you for contacting the U.S. Energy Information Administration. We have created incident
ticket #56105 to track your request.
download the files to avoid your traffic being categorized as a denial of service attack. We also ask
that you limit the number of IP's accessing the web site. Many large organizations download the
data once and redistribute the information internally. You may want to consider this option.
(b) (7)(A)
(b) (7)(A)
Jonathan Norris
From: (b) (6), (b) (7)(C)
2/16/2012
Page 4 of 5

Subject: EIA website CSV file table downloads not working
Hello Jonathan,
We are unable to open CSV files from your website
http://www.eia.gov/oil_gas/petroleum/data_publications/weekly_petroleum_status_report/wpsr.html
The page appears to hang up and eventually the page errors out.
From input weve received from our network ops group they gave indications that your site may be
blocking traffic coming from our proxies specifically our (b) (6), (b) (7)(C)
address.
Can you please confirm if youre seeing denied connection requests for our (b) (6), (b) (7)(C)
address?
Please advise.
Thank you.
(b) (6), (b) (7)(C)

Koch Business Solutions
Houston, TX
(b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
Owners
Only:
was contacted by
(b) (6), (b) (7)(C)

(b) (7)(A)
Houston, TX
(b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
about this case
Luu, Quan (CONTR) - 2011/06/15 09:20:25

Changed ticket Owner from "Norris, Jonathan (CONTR)" to "Luu, Quan (CONTR)".
Owners
Only:
Ticket Created

POC is (b) (7)(A)
(b) (7)(A)
(b) (6), (b) (7)(C)
- - [09/Jun/2011:(b) (7)(A) -0400] GET /favicon.ico HTTP/1.1 200 4150 Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.17) Gecko/20110420 Firefox/3.6.17
(b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
- - [09/Jun/2011:(b) (7)(A) -0400] GET /ngs/app/js_timer.jsp HTTP/1.1 200 2152
http://ir.eia.gov/ngs/ngs.html Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.17)
2/16/2012
Page 5 of 5
(b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
- - [09/Jun/2011:(b) (7)(A) -0400] GET /ngs/ngs.html HTTP/1.1 503 1398 Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.17) Gecko/20110420 Firefox/3.6.17
(b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
2/16/2012
Page 1 of 6
Ticket TICK:56118
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
(6), (b) (7)

block (b)
on netscaler
(C)
Range of IPs
Block
Completed
Medium
Netscaler
None
None
2011/06/13 13:01:33
2011/07/18 09:30:28
None
None
implemented block on netscaler
Norris, Jonathan (CONTR) - 2011/07/18 09:30:28 (via

email)
Owners
Only:
I will be Training offsite July 14, 2011. Please contact User


09:30:26


09:30:09
Owners
Only:
Completed Block on NetScaler to www1
Owners
Only:
(6), (b) (7)

please block (b)
(C)
amsterdam no POC
Date/Time 2011-06-13 11:33:07 EDT
Tag Name (b) (7)(E)
Severity Low
Cleared Flag false
Target Service http
2/16/2012
Page 2 of 6
SourcePort Name 0
Sensor Name IPSdot7
:adapter A
:blocked-count 312
:end-time 2011-06-13 11:33:08
:event-type Attack
:(b) (7)(A)
:pam.(b) (7)(A)
:Protocol Name TCP
:repeat-count 312
:start-time 2011-06-13 11:33:07
:(b) (7)(A)
AdapterID A
BLOCK Default
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7
Date/Time 2011-06-13 11:52:17 EDT
Tag Name (b) (7)(E)
Severity Low
(b) (7)
Cleared Flag false
Target Service http
SourcePort Name 0
Sensor Name IPSdot7
:adapter A
(b) (7)
:blocked-count (A)
:end-time 2011-06-13 11:52:17
:event-type Attack
(b) (7)
:(b) (7)(A) (A)
:pam.(b) (7)(A)
:Protocol Name TCP
(b) (7)
:repeat-count (A)
:start-time 2011-06-13 11:52:17
2/16/2012
Page 3 of 6
(b)
(7)
:(b) (7)(A)
(A)
AdapterID A
BLOCK Default
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7
Date/Time 2011-06-13 11:52:17 EDT
Tag Name (b) (7)(E)
Severity Low
Cleared Flag false
Target Service http
Sensor Name IPSdot7
:adapter A
:blocked-count 1
:event-type Attack
(b)
:(b) (7)(A) (7)
(b)
(7)
:pam.(b) (7)(A)
(A)
:Protocol Name TCP
:repeat-count 1
(b)
(7)
:(b) (7)(A)
(A)
AdapterID A
BLOCK Default
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7
Date/Time 2011-06-13 11:52:17 EDT
Tag Name (b) (7)(E)
Severity Low
2/16/2012
Page 4 of 6
Cleared Flag false

Target Service http
Sensor Name IPSdot7
:adapter A
:blocked-count 1
:event-type Attack
(b)
:(b) (7)(A) (7)
(b)
(7)
:pam.(b) (7)(A)
(A)
:Protocol Name TCP
:repeat-count 1
(b)
(7)
:(b) (7)(A)
(A)
AdapterID A
BLOCK Default
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7

Owners
Only:
Ticket Created
(6), (b) (7)

please block (b)
(C)
amsterdam no POC
Date/Time 2011-06-13 11:33:07 EDT
Tag Name (b) (7)(E)
Severity Low
Cleared Flag false
Target Service http
2/16/2012
Page 5 of 6
SourcePort Name 0
Sensor Name IPSdot7
:adapter A
(b) (7)
:blocked-count (A)
:end-time 2011-06-13 (b) (7)(A)
:event-type Attack
(b) (7)
:(b) (7)(A) (A)
:pam.(b) (7)(A)
:Protocol Name TCP
(b) (7)
:repeat-count (A)
:start-time 2011-06-13 11:33:07
(b)
(7)
:(b) (7)(A)
(A)
AdapterID A
BLOCK Default
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7
Date/Time 2011-06-13 (b) (7)(A) EDT
Tag Name (b) (7)(E)
Severity Low
(b) (7)
Cleared Flag false
Target Service http
SourcePort Name 0
Sensor Name IPSdot7
:adapter A
(b) (7)
:blocked-count (A)
:end-time 2011-06-13 (b) (7)(A)
:event-type Attack
(b) (7)
:(b) (7)(A) (A)
(b)
(7)
:pam.(b) (7)(A)
(A)
:Protocol Name TCP
(b) (7)
:repeat-count (A)
:start-time 2011-06-13 (b) (7)(A)
2/16/2012
Page 6 of 6
:(b) (7)(A)
61
AdapterID A
BLOCK Default
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7
2/16/2012
Page 1 of 11
Ticket TICK:56548
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
block (b) (6), (b) (7)

(C)
Single IP
Block
Completed
Medium
Luu, Quan (CONTR)
IR Server
None
IRblocks@eia.gov
2011/07/08 15:26:41
2011/07/13 08:53:10
None
None
done
Luu, Quan (CONTR) - 2011/07/13 08:53:10

Owners
Only:
Please block (b) (6), (b) (7)

(C)
POC is ATT iptool@(b) (7)(A)

(b)
(7)
(A)
(b) (7)(A)
(b) (6), (b) (7)

(C)
- - [07/Jul/2011:(b) (7)(A) -0400] GET /wpsr/app/js_timer.jsp HTTP/1.1 200 2073

http://ir.eia.gov/wpsr/wpsrsummary.pdf Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1;
GTB7.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
2/16/2012
Page 2 of 11

3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
- - [07/Jul/2011:(b) (7)(A) -0400] GET /wpsr/wpsrsummary.pdf HTTP/1.1 503 1698
(C)
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; GTB7.1; .NET CLR 1.1.4322; .NET CLR
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b) (6), (b) (7)
(C)
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b) (6), (b) (7)
(C)
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b) (6), (b) (7)
(C)
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b) (6), (b) (7)
(C)
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
2/16/2012
Page 3 of 11
(b) (6), (b) (7)

(C)

3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
2/16/2012
Page 4 of 11
3.5.30729)
(b) (6), (b) (7)
(C)

2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b) (6), (b) (7)
(C)
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b) (6), (b) (7)
(C)
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b) (6), (b) (7)
(C)
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
2/16/2012
Page 5 of 11
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b) (6), (b) (7)
(C)
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b) (6), (b) (7)
(C)
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b) (6), (b) (7)
(C)
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
2/16/2012
Page 6 of 11

3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b) (6), (b) (7)
(C)
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b) (6), (b) (7)
(C)
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b) (6), (b) (7)
(C)
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b) (6), (b) (7)
(C)
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b) (6), (b) (7)
(C)
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Owners
Only:
Ticket Created
Please block (b) (6), (b) (7)

(C)
POC is ATT iptool@(b) (7)(A)

(b) (7)
(A)
(b) (7)(A)
(b) (6), (b) (7)

(C)

3.5.30729)
(b) (6), (b) (7)
(C)
2/16/2012
Page 7 of 11
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b) (6), (b) (7)
(C)
2/16/2012
Page 8 of 11
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b) (6), (b) (7)
(C)
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b) (6), (b) (7)
(C)
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b) (6), (b) (7)
(C)
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
2/16/2012
Page 9 of 11
(b) (6), (b) (7)

(C)

3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b) (6), (b) (7)
(C)
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b) (6), (b) (7)
(C)
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b) (6), (b) (7)
(C)
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
2/16/2012
Page 10 of 11
3.5.30729)
(b) (6), (b) (7)
(C)

3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b) (6), (b) (7)
(C)
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b) (6), (b) (7)
(C)
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b) (6), (b) (7)
(C)
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
2/16/2012
Page 11 of 11
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
3.5.30729)
(b) (6), (b) (7)
(C)
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b) (6), (b) (7)
(C)
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b) (6), (b) (7)
(C)
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b) (6), (b) (7)
(C)
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b) (6), (b) (7)
(C)
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b) (6), (b) (7)
(C)
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
2/16/2012
Page 1 of 11
Ticket TICK:56892
unBlock (b) (6), (b) (7)(C)
and (b) (6), (b) (7)(C)
Title:
(b) (6), (b) (7)(C)
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
Range of IPs
Unblock
Requested
Medium
IR Server
None
IRblocks@eia.gov
2011/07/26 14:52:33
2011/09/16 03:45:28
None
None
done
and
- 2011/09/16 03:45:28
Owners
Only:
Owners
Only:

and
(b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
and
to "unBlock
(b) (6), (b) (7)(C)
and (b) (6), (b) (7)(C)
and
(b) (6), (b) (7)(C)

My apologies,
You have (b) (7)(A)
and we cant allow any entity to have
that many can you cut them down. See below
your request.
2/16/2012
Page 2 of 11
be modifying your download traffic and how you will prevent
(b) (7)(A)
(b) (7)(A)
happening again.
Unblock request.
Jonathan Norris
From: (b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
Sent: Monday, August 22, 2011 12:10 PM

Cc: (b) (6), (b) (7)(C)
Hi Jonathan,
I just wanted to send a follow-up to the email below. Ive not seen
a reply from you yet. My apologies if you have, and Ive missed it.
Could you unblock the IP addresses referenced below?
Thank you,
(b) (6), (b) (7)(C)
(b) (7)(A)
Tel: (b) (6), (b) (7)(C)

Email: (b) (6), (b) (7)(C)
From: (b) (6), (b) (7)(C)
STUSCO-ITST/TD
Cc: (b) (6), (b) (7)(C) SENA-STE/43
2/16/2012
Page 3 of 11
Subject: FW: IEA NG Storage Report Website blocked

Importance: High
Hi Jonathan,
I work at (b) (7)(A)
along with (b) (6), (b) (7)(C)
, which you
have worked with prior (see email thread below), and I wanted to
provide you with an update on the work we are doing and also ask
for your help with something.
We have been able to automatically replicate the data (referred to
below) to a single server for internal distribution so that most of
our staff will not hit your site directly. Most of our users will view
the replicated data now.
We are also in the process of trying to move our process to another
set of IPs. We actually tried it out about two weeks ago and we
received an email from our service provider regarding abuse. We
were subsequently blocked by your firewall. We were much more
aggressive in our testing than we intended to be and that is
probably what caused the problem. Weve addressed the issue and
we should not have the same behavior.
The IPs that we are trying to use from this point forward are:
through (b) (6), (b) (7)(C)
. Some of these are
active and some are backups.
(b) (6), (b) (7)(C)
Would it be possible to add these IPs to the list that you maintain
for (b) (7)(A)
and unblock the ones that are blocked, so that
we can transition fully to these new IP addresses? We will only use
the IPs mentioned below ((b) (6), (b) (7)(C) or (b) (6), (b) (7)(C) ) for
backup purposes.
Thank you,
(b) (6), (b) (7)(C)
(b) (7)(A)
From: (b) (6), (b) (7)(C)

SENA-ITST/ID
Sent: Tuesday, March 15, 2011 5:22 PM
(6), (b) (7)
Cc: (b)
SENA-ITST/IA; FOX, VINCENT (ATTSI)
(C)
Subject: IEA NG Storage Report Website blocked
Jonathan,
I am writing to update you on our progress toward resolution of the
problem where we are hitting the website too frequently.
ACTIONS
2/16/2012
Page 4 of 11
(b) (6), (b) (7)

1) (C)
is implementing a policy on our proxy server to limit
(b) (7)
the number of staff who can query the website to (A) addresses. We
need to have the block removed on our address ((b) (6), (b) (7)(C) or
(b) (6), (b) (7)(C)
) to enable these staff to access the site prior by
Wednesday evening so that they can get the data on Thursday
morning.
2) Our scripting team is working on an automated pull of the data

to one machine so that it can be the internal source for getting this
data going forward. The scripting team will be testing their work
on Thursday. Depending on the results, they may need a few
weeks to get the programming completed.
We believe that the short-term step of internally limiting access to
the report will mitigate risk of over-querying. We believe that the
scripting work is the longer term solution to addressing this
problem and are actively working on getting this in place.
I would like to visit with you to ensure you have the confidence
you need to proceed with unblocking access. I will be in meetings
but will step out to call you back if you send me a phone number
where I can reach you.
Thanks,
(b) (6), (b) (7)(C)

(b) (7)(A)
(b) (7)(A)
Phone:(b) (6), (b) (7)(C)

Mobile: (b) (6), (b) (7)(C)
Softphone: (b) (6), (b) (7)(C)
Email: (b) (6), (b) (7)(C)
----- Original Message ----From: Norris, Jonathan (CONTR)

To: (b) (6), (b) (7)(C)
(ATTSI)
Subject: RE: Website blocked
Administration. We
have created incident ticket #53510 to track your request.
2/16/2012
Page 5 of 11
per
second when attempting to download the files to avoid your traffic
being
categorized as a denial of service attack. We also ask that you limit
the number of IP's accessing the web site. Many large
organizations
download the data once and redistribute the information internally.
You
may want to consider this option.
be
(b) (7)(A)
happening
again.
Unblock
request.
(b) (7)(A)
Jonathan Norris
-----Original Message----From: (b) (6), (b) (7)(C)
(ATTSI) [mailto:(b) (6), (b) (7)(C)
Jonathan:
My users in Houston with (b) (7)(A)
are being blocked getting
to
ir.eia.gov/ngs/ngs.html. We should be coming from (b) (6), (b) (7)(C)
(b) (6),
(b) (7)(C)

blocked in
2/16/2012
Page 6 of 11
the future?
Thanks,
(b) (6), (b) (7)(C)
AT&T Network Administrator for (b) (7)(A)

email: (b) (6), (b) (7)(C)
AT&T email: (b) (6), (b) (7)(C)
Phone: (b) (6), (b) (7)(C)
Mobile: (b) (6), (b) (7)(C)
2HC 930F
(b) (7)
(A)
(b) (7)(A)

(6),
information and proprietary information of (b)
. If you are not
(b) (7)(C)
the
distribution
(6),
or use of the contents of this email without permission from (b)
(b) (7)(C)
is
me
your
system
Luu, Quan (CONTR) - 2011/07/27 08:50:36



Block (b) (6), (b) (7)(C)
and (b) (6), (b) (7)(C)
and (b) (6), (b) (7)(C)
Owners
Only:
Owners
Only:
Ticket Created

(b) (7)
over(A)
and (b) (6), (b) (7)(C)
(b) (7)(A)
POC is (b) (7)(A)

(b) (7)(A)
(b) (7)(A)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]

GET /ngs/blackberry.txt HTTP/1.1 503 1405 - Java/1.6.0_26
2/16/2012
Page 7 of 11
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
2/16/2012
Page 8 of 11

- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
(b) (7)
over(A)
(b) (7)(A)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
2/16/2012
Page 9 of 11

- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
2/16/2012
Page 10 of 11
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
2/16/2012
Page 11 of 11

- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
2/16/2012
Page 1 of 8
Ticket TICK:56911
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
Block (b) (6), (b) (7)(C)

Single IP
Block
Completed
Medium
Luu, Quan (CONTR)
IR Server
None
IRblocks@eia.gov
2011/07/27 14:00:58
2011/07/28 08:37:29
None
None
done
Luu, Quan (CONTR) - 2011/07/28 08:37:29


Owners
Only:
Ticket Created

over
(b) (7)(A)
(b) (7)(A)
POC/ ISP is ATT

(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]

GET /ngs/blackberry.txt HTTP/0.9 200 1405 - (b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
GET /ngs/ngs.html HTTP/0.9 200 1399 - (b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
GET /ngs/ngs.html HTTP/0.9 200 1399 - -
2/16/2012
Page 2 of 8
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]

- - [21/Jul/2011:(b) (7)(A) -0400]
GET /ngs/weekly.csv HTTP/0.9 200 1401 - (b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
GET /ngs/ngs.html HTTP/1.0 503 1399 - HTTPing v1.5.1beta
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
GET /ngs/weekly.csv HTTP/1.0 503 1401 - HTTPing v1.5.1beta
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
2/16/2012
Page 3 of 8
GET /ngs/weekly.csv HTTP/0.9 200 1401 - - - [21/Jul/2011:(b) (7)(A) -0400]

- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
GET /ngs/blackberry.txt HTTP/1.0 503 1405 - HTTPing
v1.5.1beta
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
2/16/2012
Page 4 of 8
GET /ngs/ngs.html HTTP/0.9 200 1398 - - - [21/Jul/2011:(b) (7)(A) -0400]

- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
GET /ngs/blackberry.txt HTTP/1.0 200 215 - HTTPing v1.5.1beta
(b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]

2/16/2012
Page 5 of 8
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]

- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]

2/16/2012
Page 6 of 8
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]

- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]

- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
2/16/2012
Page 7 of 8

(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]

- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]

- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]

- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]

- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
2/16/2012
Page 8 of 8

- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
2/16/2012
Page 1 of 26
Ticket TICK:56912
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
Block (b) (6), (b) (7)(C)

Single IP
Block
Completed
Medium
Luu, Quan (CONTR)
None
IRblocks@eia.gov
2011/07/27 14:06:28
2011/07/28 08:38:17
None
None
done
Luu, Quan (CONTR) - 2011/07/28 08:38:17


Owners
Only:
Ticket Created

(b)
over (7)
(A)
(b) (7)(A)
POC is
(b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]

3.0.04506.648; .NET CLR 3.5.21022; InfoPath.1; .NET CLR
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
2/16/2012
Page 2 of 26

3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
2/16/2012
Page 3 of 26
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;

.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400] GET /ngs/ngs.html
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
InfoPath.1; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2/16/2012
Page 4 of 26

3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
2/16/2012
Page 5 of 26
(b) (6), (b) (7)(C)

2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
2/16/2012
Page 6 of 26

3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
2/16/2012
Page 7 of 26
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;

.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2/16/2012
Page 8 of 26

2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
2/16/2012
Page 9 of 26
.NET4.0C; .NET4.0E)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
2/16/2012
Page 10 of 26

3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
2/16/2012
Page 11 of 26

3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2/16/2012
Page 12 of 26
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;

.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
2/16/2012
Page 13 of 26

3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
2/16/2012
Page 14 of 26
.NET4.0C; .NET4.0E)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
2/16/2012
Page 15 of 26

3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
2/16/2012
Page 16 of 26
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;

.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2/16/2012
Page 17 of 26

2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
2/16/2012
Page 18 of 26
.NET4.0C; .NET4.0E)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
2/16/2012
Page 19 of 26

3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
2/16/2012
Page 20 of 26

3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2/16/2012
Page 21 of 26
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;

.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2/16/2012
Page 22 of 26

2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
2/16/2012
Page 23 of 26
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;

.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2/16/2012
Page 24 of 26
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;

.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
2/16/2012
Page 25 of 26

3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [21/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.1.4322;
.NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2/16/2012
Page 26 of 26

2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
InfoPath.1; .NET CLR 3.0.4506.2152; .
2/16/2012
Page 1 of 22
Ticket TICK:57002
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
unBlock (b) (6), (b) (7)(C)

Single IP
Unblock
Completed
Medium
Luu, Quan (CONTR)
IR Server
None
IRblocks@eia.gov
2011/08/02 11:51:08
2011/08/17 08:53:42
None
None
.
Luu, Quan (CONTR) - 2011/08/17 08:53:42
Changed ticket Status from "Approved" to "Completed".
Luu, Quan (CONTR) - 2011/08/17 08:51:26
Changed ticket Status from "Requested" to "Approved".

Owners
Only:
From: (b) (6), (b) (7)(C)

Sent: Friday, August 12, 2011 12:05 PM
Cc: (b) (6), (b) (7)(C)
Higgs, Don; Atchley,
Marvin
Subject: RE: NG Storage Report
Jonathan,
Please find updated proposal:
List of IPs your organization will initiate downloads from.
We generally download from the IP (b) (6), (b) (7)(C) As generally
excepted practice, this is a NATd address, and as such, represents
multiple users.
How many (b) (7)(A)
We plan to give only (b) (7)(A)
access to the site, with strict
understanding to minimize access attempts to only those required.
At most then, at 10:30am, you should see ten access attempts
within a small frame of time, which based upon the publication
methods, should be considered reasonable.
2/16/2012
Page 2 of 22
What measures you put in place to prevent the attack from

happening again.
Instead of giving everyone who could use the information access,
(b) (7)
we will identify (A) key employees and block everyone elses
access via a timed web filter policy during the window at 10:30am
on Thursdays, thus limiting access to only those employees and
then giving instructions to access the site only as required during
this critical window.
All I appreciate your involvement.
Best regards,
(b) (6), (b)
(7)(C)

Sent: Friday, August 12, 2011 11:57 AM
To: (b) (6), (b) (7)(C)
(b) (7)
We can work with (A) can you put that in your previous proposal,
and send it. If so you will be unblocked before the next release.
From: (b) (6), (b) (7)(C)
Ok, we were thinking that might be too high Greg mentioned he
(b) (7)
could keep it to (A) if we absolutely had to with understanding
that well begin working on a proxy solution From: Norris, Jonathan (CONTR)
To: (b) (6), (b) (7)(C)
(b) (6), (b)
You are in the ball park (7)(C)

more.
, I need you to come down some
From: (b) (6), (b) (7)(C)

(b)
Ok, Ive talked internally, we can get this down to (7)

people with
(A)
access at 10:30am and will work on a proxy solution as the
permanent solution. Good?
2/16/2012
Page 3 of 22

To: (b) (6), (b) (7)(C)
(b) (7)(A)
per second is extremely too high.
From: (b) (6), (b) (7)(C)

Cc: (b) (6), (b) (7)(C)
Staller, Paul
Importance: High
Jonathon,
To recap our discussion so far, we discussed the fact that we were
accessing the below mentioned site too many times (b) (7)(A)
at
10:30am last Thursday, the normal publishing time for the data
which our organization requires. This resulted in our blacklisting.
When I asked how many times (b) (7)(A) is considered reasonable,
you said this information cannot be divulged. You mentioned that
one approach to minimize the access attempts (b) (7)(A)
during
that critical window was to have a single person collect and then
disseminate the information. Since this information is generally
used in a web forma by our internal business processes, that is to
say, collected via browser not file, we have below proposed an
alternative solution that should meet both of our requirements.
As your below email requests, please find responses to the required
points.
(b) (7)(A)

We generally download from the IP (b) (6), (b) (7)(C) As generally
excepted practice, this is a NATd address, and as such, represents
multiple users.
- How many (b) (7)(A)

(7)
We plan to give only (b)
people
access to the site, with strict
(A)
understanding to minimize access attempts to only those required.
(7)
At most then, at 10:30am, you should see (b)
access attempts
(A)
within a small frame of time, which based upon the publication
methods, should be considered reasonable.
happening again.
Instead of giving everyone who could use the information access,
(7)
we will identify (b)
key employees and block everyone elses
(A)
access via a timed web filter policy, thus limiting access to only
those employees and then giving instructions to access the site only
2/16/2012
Page 4 of 22
as required during this critical window.

Let me reiterate that we are in no way using a bot, and as such,
are not breaking any published use policy that has been given to us.
Id like to stress that these are real users with an identifiable
business need to access this data and we currently cannot. Our
business requires solid information like that which you provide and
while it would be straight forward to find other solutions to access
this data (use different IP addresses, etc.) it is our desire to fully
cooperate with your OPSEC group and do our best to find a
solution equitable to all parties. If this action was taken due to an
IPS, than this is a classic false positive. If your infrastructure is
identifying this traffic as a syn attack due to very low thresholds, a
simple analysis of the traffic will reveal that these flows are
legitimate and a signature adjustment might be in order for our IP
address.
I identify with the challenge of drawing the fine line between
providing excellent security and keeping legitimate users from
data.
Your speedy resolution to this issue is most appreciated.
Best Regards,
(b) (6), (b)
(7)(C)
From: (b) (6), (b) (7)(C)

Sent: Thursday, August 11, 2011 2:58 PM
Cc: (b) (6), (b) (7)(C)
Jonathan,
(b) (6),
Ive talked through this with (b) (7)(C) It sounds like this is a document
that is published at a specific time every week and is important for
us to understand a fairly critical part of our business. It also sounds
like there is a peak interest in the resource at a specific time for
everyone that needs the information. Were a fairly small
(b)
organization with around (7)
people that need access to this
(A)
information, but everyone is translated to a single IP address
((b) (6), (b) (7)(C) so it may appear to your systems like a SYN attack
or the like. Ideally, we shouldnt see more than (b) (7)(A)
(b) (7)(A)
during the critical 10:30 publishing window, assuming
the site is responsive. Ive discussed this with Greg, and it sounds
like the site is set up to keep people from refreshing the site too
aggressively and verified that we dont have any automated
systems retrieving this data, so Im not sure what steps we can take
internally to alleviate this situation, as an organization our size
should have a difficult time generating the traffic necessary to fire
2/16/2012
Page 5 of 22
off a well tuned firewall/IPS infrastructure, unless something else

is awry.
Could you help us understand when we were blacklisted and
whether or not it is an internal or external blacklist? Its difficult to
truly root cause the issue without the exact reasoning behind the
blacklist and the time period that it occurred.
If you could give me a call at (b) (6), (b) (7)(C) or send over your
contact information, it would be helpful. Your assistance much
appreciated.
Warm Regards,
(b) (6), (b)
(7)(C)
(6), (b)
From: (b)
(7)(C)
To: (b) (6), (b) (7)(C)
Subject: FW: NG Storage Report
It looks like weve been blacklisted by a governmental agency.

Have we dealt with this before?
To: (b) (6), (b) (7)(C)
Yes you have been blocked.
your request.
(b) (7)(A)
(b) (7)(A)
happening again.
2/16/2012
Page 6 of 22
Unblock request.
From: (b) (6), (b) (7)(C)

Jonathan,
Hi, our IP address is (b) (6), (b) (7)(C) Let me know if weve been
blacklisted.
Thanks,
(b) (6),
(b) (7)
(C)
(b) (6), (b) (7)

From: (C)
(6), (b)
Cc: (b)
(7)(C)
(b) (6), (b) (7)
Im forwarding this to (C)
who is troubleshooting the issue
in our IT department. It sounds like we have several public IP
addresses.
Thanks,
(b) (6), (b) (7)
(C)

(6), (b) (7)
To: (b)
(C)
(b) (6),
Mr. (b) (7)(C) ,

In order to tell you if you have been blocked we will need your
Public IP address.
From: (b) (6), (b) (7)(C)
Mr. Norris,
Im having trouble accessing http://ir.eia.gov/ngs/ngs.html . My IT
2/16/2012
Page 7 of 22
department is investigating possible internal causes. Paul Hesse

suggested that the EIA website itself may be blocking us from
accessing the data. To my knowledge we are able to get to
everything on the EIA website except that storage report link.
Could you tell me how to find out if the EIA website could be
blocking us?
Thank you,
(b) (6), (b) (7)
(C) (7)(A)
(b)
From: InfoCtr (OC) [mailto:INFOCTR@eia.gov]

(6), (b) (7)
To: (b)
(C)
(b) (6),
Dear Mr. (b) (7)(C) :

Hello again, you are welcome for the previously sent information,
and thank you for your additional email to the U.S. Energy
Information Administration (EIA)
Perhaps it has something to do with our automated data retrieval
policy:
http://www.eia.gov/about/privacy_security_policy.cfm
Contact the following person to see if you have been blocked from
accessing that data:
Jonathan.Norris@eia.gov
I hope this information helps. Please contact us again if you need
further assistance with energy data and statistics.
Paul Hesse
Catapult Technology, Ltd., Contractor to the
Office of Communications
U.S. Energy Information Administration (EIA)
www.eia.gov
===============================
From: (b) (6), (b) (7)(C)
Sent: Thursday, August 11, 2011 11:52 AM
To: InfoCtr (OC)
2/16/2012
Page 8 of 22
Paul,
Im moving around the rest of the website with no problem. Just

this one link seems to fail. However, Ive checked with a couple of
people at other companies and they can get in no problem. Weird.
Ill contact my IT department.
Thanks,
(b) (6), (b)

(7)(C)

(6), (b) (7)
To: (b)
(C)
Dear (b) (6), (b) (7)(C)

Thank you for your inquiry to the U.S. Energy Information
Administration (EIA) concerning our natural gas storage report.
I was able to access the report with no problem.
Please reply back with a screen shot of the message you get when
you try accessing:
http://ir.eia.gov/ngs/ngs.html
Paul Hesse
www.eia.gov
===============================
From: (b) (6), (b) (7)(C)
To: InfoCtr (OC)
2/16/2012
Page 9 of 22
Subject: NG Storage Report
Having trouble getting into your storage report page after the report
release today at 10:30. Other folks here say they havent been able
to get in to that page for ie storage history etc for several days.
Thanks,
(b) (6), (b) (7)(C)
| Supply Analyst
Direct (b) (6), (b) (7)(C) | Fax (b) (6), (b) (7)(C)
(b) (7)(A)
(b) (7)(A)
________________________________
Confidentiality Notice: The information contained in this email

may be confidential and/or legally privileged. It has been sent for
the sole use of the intended recipient(s). If you are not the intended
recipient or authorized to receive information for the recipient, you
are hereby notified that any review, use, disclosure, distribution,
copying, printing, or action taken in reliance on the contents of this
e-mail is strictly prohibited. If you have received this
communication in error, please contact the sender by reply email
and destroy all copies of the original message. To contact our email
administrator directly, send to (b) (7)(A)
________________________________
2/16/2012
Page 10 of 22

________________________________________
________________________________________
________________________________________
________________________________________
2/16/2012
Page 11 of 22

________________________________________
________________________________________
Owners
Only:
User called and I explained proccess for getting unblocked. user

reques instuctions, I did explain EIA cannot assist him in
configuring his system. 20 min call
Owners
Only:
to "unBlock
(b) (6), (b) (7)(C)

2/16/2012
Page 12 of 22

Jonathan,
(b) (6), (b)
Ive talked through this with (7)(C) It sounds like this is a document
that is published at a specific time every week and is important for
us to understand a fairly critical part of our business. It also sounds
like there is a peak interest in the resource at a specific time for
everyone that needs the information. Were a fairly small
(b)
organization with around (7)
people that need access to this
(A)
information, but everyone is translated to a single IP address
((b) (6), (b) (7)(C) so it may appear to your systems like a SYN attack
or the like. Ideally, we shouldnt see more than 50 access attempts
per second during the critical 10:30 publishing window, assuming
the site is responsive. Ive discussed this with Greg, and it sounds
like the site is set up to keep people from refreshing the site too
aggressively and verified that we dont have any automated
systems retrieving this data, so Im not sure what steps we can take
internally to alleviate this situation, as an organization our size
should have a difficult time generating the traffic necessary to fire
off a well tuned firewall/IPS infrastructure, unless something else
is awry.
Could you help us understand when we were blacklisted and
whether or not it is an internal or external blacklist? Its difficult to
truly root cause the issue without the exact reasoning behind the
blacklist and the time period that it occurred.
If you could give me a call at (b) (6), (b) (7)(C) or send over your
contact information, it would be helpful. Your assistance much
appreciated.
Warm Regards,
(b) (6), (b)
(7)(C)
(6), (b)
From: (b)
(7)(C)
To: (b) (6), (b) (7)(C)
Subject: FW: NG Storage Report
It looks like weve been blacklisted by a governmental agency.

Have we dealt with this before?
To: (b) (6), (b) (7)(C)
Yes you have been blocked.
2/16/2012
Page 13 of 22

your request.
(b) (7)(A)
(b) (7)(A)
happening again.
Unblock request.
From:(b) (6), (b) (7)(C)

Jonathan,
Hi, our IP address is (b) (6), (b) (7)(C) Let me know if weve been
blacklisted.
Thanks,
(b) (6),
(b) (7)
(C)
(b) (6), (b) (7)

From: (C)
(6), (b)
Cc: (b)
(7)(C)
(b) (6), (b)
Im forwarding this to (7)(C)
, who is troubleshooting the issue
in our IT department. It sounds like we have several public IP
addresses.
Thanks,
2/16/2012
Page 14 of 22
(b) (6), (b) (7)

(C)

(6), (b) (7)
To: (b)
(C)
(b) (6),
Mr. (b) (7)(C) ,

In order to tell you if you have been blocked we will need your
Public IP address.
From: (b) (6), (b) (7)(C)
Mr. Norris,
Im having trouble accessing http://ir.eia.gov/ngs/ngs.html . My IT
department is investigating possible internal causes. Paul Hesse
suggested that the EIA website itself may be blocking us from
accessing the data. To my knowledge we are able to get to
everything on the EIA website except that storage report link.
Could you tell me how to find out if the EIA website could be
blocking us?
Thank you,
(b) (6), (b) (7)
(C)
(b) (7)(A)

(6), (b) (7)
To: (b)
(C)
(b) (6), (b)
Dear Mr.(7)(C)
Hello again, you are welcome for the previously sent information,
and thank you for your additional email to the U.S. Energy
Information Administration (EIA)
Perhaps it has something to do with our automated data retrieval
policy:
http://www.eia.gov/about/privacy_security_policy.cfm
Contact the following person to see if you have been blocked from
2/16/2012
Page 15 of 22
accessing that data:

Jonathan.Norris@eia.gov
I hope this information helps. Please contact us again if you need
further assistance with energy data and statistics.
Paul Hesse
www.eia.gov
===============================
From: (b) (6), (b) (7)(C)
To: InfoCtr (OC)
Paul,
Im moving around the rest of the website with no problem. Just

this one link seems to fail. However, Ive checked with a couple of
people at other companies and they can get in no problem. Weird.
Ill contact my IT department.
Thanks,
(b) (6), (b)

(7)(C)

(6), (b) (7)
To: (b)
(C)
Dear (b) (6), (b) (7)(C)
2/16/2012
Page 16 of 22
Thank you for your inquiry to the U.S. Energy Information

Administration (EIA) concerning our natural gas storage report.
I was able to access the report with no problem.
Please reply back with a screen shot of the message you get when
you try accessing:
http://ir.eia.gov/ngs/ngs.html
Paul Hesse
www.eia.gov
===============================
From: (b) (6), (b) (7)(C)
To: InfoCtr (OC)
Subject: NG Storage Report
Having trouble getting into your storage report page after the report
release today at 10:30. Other folks here say they havent been able
to get in to that page for ie storage history etc for several days.
Thanks,
(b) (6), (b) (7)(C)
| Supply Analyst
Direct (b) (6), (b) (7)(C) | Fax (b) (6), (b) (7)(C)
(b) (7)(A)
(b) (7)(A)
________________________________
2/16/2012
Page 17 of 22

________________________________

________________________________________
________________________________________
2/16/2012
Page 18 of 22

________________________________________
Bily, Glenn (CONTR) - 2011/08/03 08:40:56


Changed Asset from "" to "IR Server".
Owners
Only:
Ticket Created

POC is (b) (6), (b) (7)(C)
(b) (7)(A)
(b) (6), (b) (7)(C)
- - [28/Jul/2011:(b) (7)(A) -0400] GET /favicon.ico

2.0.50727; InfoPath.2; .NET CLR 3.0.04506.30; .NET CLR
3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152;
.NET CLR 3.5.30729; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [28/Jul/2011:(b) (7)(A) -0400]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; InfoPath.3; .NET4.0E)
2/16/2012
Page 19 of 22
(b) (6), (b) (7)(C)
- - [28/Jul/2011:(b) (7)(A) -0400]

Windows NT 5.1; Trident/4.0; InfoPath.2; .NET CLR 2.0.50727;
.NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR
1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [28/Jul/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.3; .NET4.0C; .NET
CLR 1.1.4322)
(b) (6), (b) (7)(C)
- - [28/Jul/2011:(b) (7)(A) -0400]
3.0.04506.30; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET CLR 1.1.4322; .NET4.0C; InfoPath.3; .NET4.0E)
(b) (6), (b) (7)(C)
- - [28/Jul/2011:(b) (7)(A) -0400]
3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152;
.NET CLR 3.5.30729; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [28/Jul/2011:(b) (7)(A) -0400]
3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152;
.NET CLR 3.5.30729; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [28/Jul/2011:(b) (7)(A) -0400]
1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [28/Jul/2011:(b) (7)(A) -0400]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
(b) (6), (b) (7)(C)
- - [28/Jul/2011:(b) (7)(A) -0400]
3.0.04506.30; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
(b) (6), (b) (7)(C)
- - [28/Jul/2011:(b) (7)(A) -0400]
2/16/2012
Page 20 of 22

CLR 1.1.4322)
(b) (6), (b) (7)(C)
- - [28/Jul/2011:(b) (7)(A) -0400]
3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152;
.NET CLR 3.5.30729; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [28/Jul/2011:(b) (7)(A) -0400]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
(b) (6), (b) (7)(C)
- - [28/Jul/2011:(b) (7)(A) -0400] GET /ngs/ngs.gif
3.0.04506.30; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022;
.NET4.0E)
(b) (6), (b) (7)(C)
CLR 3.5.30729; .NET4.0C; InfoPath.3; .NET4.0E)
(b) (6), (b) (7)(C)
(compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.2;
3.5.30729; .NET CLR 1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152;
.NET CLR 3.5.30729; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
CLR 1.1.4322)
2/16/2012
Page 21 of 22
(b) (6), (b) (7)(C)

3.0.04506.30; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
(b) (6), (b) (7)(C)
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
(b) (6), (b) (7)(C)
- - [28/Jul/2011:(b) (7)(A) -0400]
3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152;
.NET CLR 3.5.30729; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [28/Jul/2011:(b) (7)(A) -0400]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
(b) (6), (b) (7)(C)
- - [28/Jul/2011:(b) (7)(A) -0400]
1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [28/Jul/2011:(b) (7)(A) -0400]
CLR 1.1.4322)
(b) (6), (b) (7)(C)
- - [28/Jul/2011:(b) (7)(A) -0400]
3.0.04506.30; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
(b) (6), (b) (7)(C)
- - [28/Jul/2011:(b) (7)(A) -0400]
3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152;
.NET CLR 3.5.30729; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [28/Jul/2011:(b) (7)(A) -0400]
2/16/2012
Page 22 of 22

2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
(b) (6), (b) (7)(C)
- - [28/Jul/2011:(b) (7)(A) -0400]
1.1.4322; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [28/Jul/2011:(b) (7)(A) -0400]
CLR 1.1.4322)
2/16/2012
Page 1 of 3
Ticket TICK:57003
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
Block (b) (6), (b) (7)(C) on NetScaler

Single IP
Block
Completed
Medium
Netscaler
None
None
2011/08/02 13:26:16
2011/09/16 03:45:28
None
None
block completed on netscalers
- 2011/09/16 03:45:28
Owners
Only:
Owners
Only:
(6), (b) (7)

Open system would like (b)
blocked also. it seems to be
(C)
part of the same incident. added to ticket #57026

Owners
Only:
DENY -srcIP = (b) (6), (b) (7)(C) -destIP = 38.96.246.204 -priority 70

-kernelstate SFAPPLIED61 -logstate ENABLED
completed on both netscalers.
Owners
Only:
Ticket Created
Block (b) (6), (b) (7)(C) on Net Scaler
From: Rollins, Gregory (CONTR)

2/16/2012
Page 2 of 3

Cc: Narayanan, Prashanth (CONTR); Saladin, Sayeed (CONTR);
Singh, Jarnail (CONTR)
Subject: (b) (7)(A)
(6),
Hi(b)
(b) (7)(C)
(7)
The (b) (6), (b) (7)(C) IP address was hitting us(b)
times per second
(A)
on Saturday. It was GETing the same page over and over again,
which is poor practice. It calls itself the: (b) (7)(A)
(b) (7)(A)
(6), (b)
I did not try browsing that (b)
website, but the WHOIS
(7)(C)
information does not provide much info so that may be
worthwhile.
WHOIS - (b) (6), (b) (7)(C)

Location: United States [City: Chicago, Illinois]
#
# Query terms are ambiguous. The query is assumed to be:
# "n (b) (6), (b) (7)(C)
#
# Use "?" to get help.
#
#
# The following results may also be obtained via:
# http://whois.arin.net/rest/nets;q=(b) (6), (b) (7)(C)
showDetails=true&showARIN=true
#
Server Central Network SCN-7 (NET-75-102-0-0-1) (b) (7)(A)
(b) (7)(A)
HostForWeb Inc SCNET-75-102-24-0 (b) (7)(A)

(b) (7)(A)
American Registry for Internet Numbers NET75 (NET-75-0-0-0-0)

75.0.0.0 - 75.255.255.255
#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#
Please see if you can either find some contact info for this
organization, or if you can get approval to temporarily block them.
2/16/2012
Page 3 of 3
Greg Rollins
gregory.rollins@eia.gov
202-586-4299
2/16/2012
Page 1 of 3
Ticket TICK:57026
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
(6), (b) (7)

block (b)
(C)
Single IP
Block
Completed
Medium
Netscaler
None
Gregory.Rollins@eia.gov
2011/08/03 10:13:53
2011/09/16 03:45:28
None
None
blocked,
Owners
Only:
- 2011/09/16 03:45:28

email)
Owners
Only:
I will be out of the office until Wednesday. Please contact User

Services or Sayeed Saladin for any assistance.

Owners
Only:
Ticket Created
(6), (b) (7)

Open system would like (b)
(C)
part of the same incident.
blocked also. it seems to be

Sent: Wednesday, August 03, 2011 9:23 AM
Subject: RE: (b) (6), (b) (7)(C)
(6),
Thanks (b)
Are you also going to block that other IP at the
(b) (7)
bottom of
(C) the AAR document I sent Monday night?
2/16/2012
Page 2 of 3
Greg Rollins
202-586-4299
Sent: Tuesday, August 02, 2011 8:30 AM
To: Rollins, Gregory (CONTR)
Subject: RE: (b) (6), (b) (7)(C)
Ill put the ticket in for the netscaler
Subject: Sogou+web+spider
(6),
Hi (b)
(b) (7)
(C)
(7)
The (b) (6), (b) (7)(C) IP address was hitting us(b)
times per second
(A)
on Saturday. It was GETing the same page over and over again,
which is poor practice. It calls itself the: (b) (6), (b) (7)(C)
((b) (6), (b) (7)(C)
)
(6), (b)
I did not try browsing that (b)
website, but the WHOIS
(7)(C)
information does not provide much info so that may be
worthwhile.
WHOIS - (b) (6), (b) (7)(C)

Location: United States [City: Chicago, Illinois]
#
# Query terms are ambiguous. The query is assumed to be:
# "n (b) (6), (b) (7)(C)
#
# Use "?" to get help.
#
#
# The following results may also be obtained via:
# http://whois.arin.net/rest/nets;q=(b) (6), (b) (7)(C)
2/16/2012
Page 3 of 3
showDetails=true&showARIN=true
#
Server Central Network SCN-7 (NET-(b) (7)(A)
7(b) (7)(A)
HostForWeb Inc (b) (7)(A)
(b) (7)(A)
American Registry for Internet Numbers NET75 (NET-75-0-0-0-0)

75.0.0.0 - 75.255.255.255
#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#
Please see if you can either find some contact info for this
organization, or if you can get approval to temporarily block them.
Greg Rollins
202-586-4299
2/16/2012
Page 1 of 19
Ticket TICK:57075
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
Block (b) (6), (b) (7)(C)

Single IP
Block
Completed
Medium
Luu, Quan (CONTR)
IR Server
None
IRblocks@eia.gov
2011/08/04 16:22:18
2011/08/10 08:31:24
None
None
done
Luu, Quan (CONTR) - 2011/08/10 08:31:24


Owners
Only:
Ticket Created
POC is(b) (6), (b) (7)(C)

(b) (7)
over(A)
(b) (7)(A)
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]

- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 2 of 19
GET /ngs/blackberry.txt HTTP/0.9 200 1405 - - - [04/Aug/2011:(b) (7)(A) -0400]

- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
2/16/2012
Page 3 of 19

- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 4 of 19
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]

- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
2/16/2012
Page 5 of 19
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 6 of 19
GET /ngs/ngs.html HTTP/0.9 200 1398 - - - [04/Aug/2011:(b) (7)(A) -0400]

- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
2/16/2012
Page 7 of 19
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]

v1.5.1beta
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 8 of 19
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]

- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]

- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]

http://ir.eia.gov/ngs/ngs.html Mozilla/5.0 (X11; Linux i686;
rv:5.0) Gecko/20100101 Firefox/5.0
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
GET /ngs/weekly.csv HTTP/0.9 200 977 - -
2/16/2012
Page 9 of 19
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]

- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]

2/16/2012
Page 10 of 19
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]

- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]

- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]

- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]

- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 11 of 19
GET /ngs/weekly.csv HTTP/0.9 200 977 - - - [04/Aug/2011:(b) (7)(A) -0400]

- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]

- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 12 of 19
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A)
-0400]
2/16/2012
Page 13 of 19

- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]

- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 14 of 19
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]

- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]

- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]

- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 15 of 19

- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]

- - [04/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 16 of 19
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]

- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 17 of 19

- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]

- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]

- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]

- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 18 of 19

- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]

- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]

- - [04/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 19 of 19

(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
- - [04/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 1 of 9
Ticket TICK:57085
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
unBlock (b) (6), (b) (7)(C)

Single IP
Unblock
Completed
Medium
Luu, Quan (CONTR)
IR Server
None
IRblocks@eia.gov
2011/08/05 12:20:01
2011/08/25 08:39:46
None
None
This ip was not on the block list to begin with.
Luu, Quan (CONTR) - 2011/08/25 08:39:46

Owners
Only:
completed on both netscalers..

(b) (6), (b) (7)(C)

to
"unBlock (b) (6), (b) (7)(C)
Owners
Only:

Subject: RE: Abuse from (b) (6), (b) (7)(C)
Mr. Norris,
We understand that we were categorized as "abusers" due to
having surpassed the(b) (7)(E)
during Thursday morning 8/4 in the minutes surrounding the
weekly release of the EIA Natural Gas storage estimate.
We agreed to reduce our number of requests per second last time
2/16/2012
Page 2 of 9
this happened and did so. We have recently had some of our
network users who did not monitor the release of this information
in the past begin to monitor the release. They were unaware of our
new policy and proceeded to press F5(refresh) repeatedly in
anticipation of the release of the weekly EIA NG storage number.
Since yesterday, these people been educated on our policy for
minimizing our requests per second to the EIA resources.
Our official statement from our organization detailing how we will
be modifying our download traffic and how we will try to prevent
being categorized as having abusive download attempts is as
follows:
--Requests will come from ip: (b) (6), (b) (7)(C) --We will attempt to
(b) (7)
(A)
limit our (b) (7)(A)
--This was not an attack
and an attack will Never be initiated from within our small
network, but we have taken steps to educat our new users to limit
their requests per second so that they will not be categorized as an
attack by the automated EIA processes that monitor requests per
second.
I understand that these limits are in place not just to protect from
true DOS attacks but also to limit the cost of resources it would
take to service an unlimited simultaneous load on the resources.
The EIA is probably already be implementing the following:
-- IP mulitcast traffic: http://en.wikipedia.org/wiki/Multicast
-- HTTP compression:
http://en.wikipedia.org/wiki/HTTP_compression
.. if they are not, then there may be an opportunity to better service
the ever growing load on the EIA resources through the
implementation of the above technologies.
Thanks for your consideration and for everything you are doing to
protect these resources. Please let us know when we will be
unblocked.
(b) (6), (b) (7)(C)
Office: (b) (6), (b) (7)(C)

Cell: (b) (6), (b) (7)(C)
To: (b) (6), (b) (7)(C)
Administration.
2/16/2012
Page 3 of 9
This is not a mistake this is the SECOND incident. We have

created incident ticket #57085 to track your request.
(b) (7)(A)
(b) (7)(A)
happening again.
Unblock request.
http://www.eia.gov/privacyweb.html
Jonathan Norris
Contractor to U.S. Energy Information Administration 1000
Independence Avenue, SW Washington, DC 20585

Mr. Norris,
Please unblock out IP address as soon as possible. As determined
before, blocking us is a mistake. We are valid, legitimate
consumers of the EIA data. Today, this mistake delayed our
attempts to retrieve this important data.
Please also let me know when we are unblocked.
(b) (6), (b) (7)(C)
Office: (b) (6), (b) (7)(C)

Cell: (b) (6), (b) (7)(C)
2/16/2012
Page 4 of 9
-----Original Message----From: Cogent Help Desk [mailto:abuse@cogentco.com]

To: (b) (6), (b) (7)(C)
Cc: abuse@cogentco.com
Subject: #HD0000002398823-Abuse; Cust; (b) (7)(A)
(b) (7)(A)
Unauthorized access attempts, scans or connection attempt

reported (b) (6), (b) (7)(C)
(b) (7)(A)
Please be advised that Cogent Abuse has received the following

complaint and subsequent logs regarding unauthorized access
attempt and or exploit attempt originating from IP address
(b) (6), (b) (7)(C)
Please investigate the issue and reply back with your findings
including actions taken on your end to mitigate the issue. Failure to
reply and or cure will result in additional AUP actions.
Best regards,
AR-02
Cogent Abuse
abuse@cogentco.com
==
Hello,
Thanks for the reply. A generic report of the activity will be
reported to our customer for their review. Please note in the
absence of logging or log file makes your report an alleged
instance of abuse. A general description of the events regarding the
associated ports, protocol etc.
or edited log file would yield the best results in identifying,
isolating and negating the source.
Best regards,
Cogent Abuse
abuse@cogentco.com
To: Abuse
2/16/2012
Page 5 of 9
I cannot send you logs from this Government Agency. I will tell
you that this activity occurred on August 4 between 10am and
11am
-----Original Message----From: Abuse [mailto:nocabuse@cogentco.com]
Cc: Abuse
Hello,
Thanks for contacting Cogent Abuse. Please provide a log sample
or detailed summary depicting the traffic in question which will aid
in our investigation. Please be sure any logging provided includes
the destination IP, source and destination ports, protocol, time, date
and time zone associated with the logged event[s].
Best regards,
Cogent Abuse
abuse@cogentco.com
==
To: ipalloc; Abuse
Subject: Abuse from (b) (6), (b) (7)(C)
Hello
domain: (b) (6), (b) (7)(C) this traffic is targeting ir.eia.gov. Please
investigate and remediate.
Jonathan Norris
Luu, Quan (CONTR) - 2011/08/10 08:30:54


Owners
2/16/2012
Page 6 of 9
Only:
Ticket Created

POC is COgent
(b) (7)
(A)
(b) (7)(A)
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]

CLR 1.0.3705; .NET4.0C; MSSDMC2.4.2011.2)
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
CLR 1.0.3705; .NET4.0C; MSSDMC2.4.2011.2)
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
CLR 1.0.3705; .NET4.0C; MSSDMC2.4.2011.2)
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
Windows NT 6.1; WOW64; Trident/5.0)
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
CLR 1.0.3705; .NET4.0C; MSSDMC2.4.2011.2)
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
CLR 1.0.3705; .NET4.0C; MSSDMC2.4.2011.2)
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 7 of 9

CLR 1.0.3705; .NET4.0C; MSSDMC2.4.2011.2)
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
GET /ngs/ngs.html HTTP/1.1 503 1398 http://www.eia.gov/
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0;
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.0.3705;
.NET4.0C; MSSDMC2.4.2011.2)
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.0.3705;
.NET4.0C; MSSDMC2.4.2011.2)
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.0.3705;
.NET4.0C; MSSDMC2.4.2011.2)
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64;
Trident/5.0)
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.0.3705;
.NET4.0C; MSSDMC2.4.2011.2)
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.0.3705;
.NET4.0C; MSSDMC2.4.2011.2)
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.0.3705;
.NET4.0C; MSSDMC2.4.2011.2)
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
Trident/5.0)
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 8 of 9
CLR 1.0.3705; .NET4.0C; MSSDMC2.4.2011.2)

- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
CLR 1.0.3705; .NET4.0C; MSSDMC2.4.2011.2)
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
CLR 1.0.3705; .NET4.0C; MSSDMC2.4.2011.2)
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
CLR 1.0.3705; .NET4.0C; MSSDMC2.4.2011.2)
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
CLR 1.0.3705; .NET4.0C; MSSDMC2.4.2011.2)
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
CLR 1.0.3705; .NET4.0C; MSSDMC2.4.2011.2)
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
2/16/2012
Page 9 of 9
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.0.3705;

.NET4.0C; MSSDMC2.4.2011.2)
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.0.3705;
.NET4.0C; MSSDMC2.4.2011.2)
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.0.3705;
.NET4.0C; MSSDMC2.4.2011.2)
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.0.3705;
.NET4.0C; MSSDMC2.4.2011.2)
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.0.3705;
.NET4.0C; MSSDMC2.4.2011.2)
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
Trident/5.0)
(b) (6), (b) (7)(C)
- - [04/Aug/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 1.0.3705;
.NET4.0C; MSSDMC2.4.2011.2)
2/16/2012
Page 1 of 11
Ticket TICK:57091
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
(b) (6), (b) (7)

unBlock (C)
Single IP
Unblock
Completed
Medium
Netscaler
None
IRblocks@eia.gov
2011/08/05 16:35:52
2011/09/14 08:42:53
None
None
(b) (6), (b) (7)
HAS BEEN UNBLOCKED ON BOTH
(C)
NETSCALERS.
Owners
Only:
(b) (6), (b) (7)

(C)
HAS BEEN UNBLOCKED ON BOTH

NETSCALERS.

"Somaram, James (CONTR)".
Owners
Only:
From: (b) (6), (b) (7)(C)

[mailto:(b) (6), (b) (7)(C)
Sent: Thursday, September 08, 2011 3:44 PM
Cc: Atchley, Marvin
Subject: Please remove (b) (7)(A) from your blocked list.
Importance: High
Hello,
We have been placed on a block list due to high activity on August
4th.
We had a Development, Test, QA, and production automated jobs
all downloading the file at the exact same time. We believe this
caused the excessive traffic. We have modified the process so jobs
2/16/2012
Page 2 of 11
in Dev, Test, and QA are only run when they need to be tested. The
production job is the only job that will run daily.
We plan to access this website about (b) (7)(E)
at the
most, our application team has made changes to reduce traffic.
Here are the two IPs that are linked to (b) (7)(A) :
(b) (6), (b) (7)(C)
(b) (6), (b) (7)
(C)
Please let me know if you need anything else to get us off the
blocked list.
Thank you for your assistance.
(b) (6), (b) (7)(C)
IT Analyst, Power Team

Trade Floor Support
(b) (7)(A)
************************************************** This
e-mail and any of its attachments may contain (b) (7)(A) Corporation
proprietary information, which is privileged, confidential, or
subject to copyright belonging to the (b) (7)(A) Corporation family of
Companies. This e-mail is intended solely for the use of the
individual or entity to which it is addressed. If you are not the
intended recipient of this e-mail, you are hereby notified that any
dissemination, distribution, copying, or action taken in relation to
the contents of and attachments to this e-mail is strictly prohibited
and may be unlawful. If you have received this e-mail in error,
please notify the sender immediately and permanently delete the
original and any copy of this e-mail and any printout. Thank You.
**************************************************
Owners
Only:
Customers from company called at 10:19 wanting to be unblocked
Owners
Only:
From: (b) (6), (b) (7)(C)

[mailto:(b) (6), (b) (7)(C)
Sent: Thursday, September 01, 2011 10:24 AM
Subject: Can no longer access Natural Gas Storage report from EIA
site.
Importance: High
Please assist!
2/16/2012
Page 3 of 11
(b) (6), (b) (7)(C)

Trade Floor Support
(b) (7)(A)
(b) (6), (b)
From: (b) (6), (b) (7)(C)
(7)(C)
Sent: Tuesday, August 30, 2011 5:27 PM
To: jonathan.norris@eia.gov
Subject: Can no longer access Natural Gas Storage report from EIA
site.
Importance: High
Jonathan,
This is still an issue, can you please let me know what else do you
need to get us off the blocked list?
Im adding more information below.
Thanks,
(b) (6), (b) (7)(C)

Trade Floor Support
(b) (7)(A)
(6), (b)
From: (b) (6), (b) (7)(C) (b)
(7)(C)
(b) (6), (b)
(6),
(b) (6),
To: (b) (6), (b) (7)(C)
IT Netwrk Ops(b)
(7)(C)
(b) (7)(C) (b) (7)(C)
(b) (6), (b) (b) (6), (b) (b) (6), (b) (7)(C) (b) (6), (b)
(7)(C)
(7)(C)
(7)(C)(b) (6),
(b) (7)(C)
Cc:
BSC)
Subject: RE: <update> Can no longer access Natural Gas Storage
report from EIA site.
Here is the ip information you need
Source: ksqmswe_(b) (6), (b) (7)(C)
Destination: tibcoqa (b) (6), (b) (7)(C)
which is translated to
(6), (b) (7)
(b) (6), (b) (7)(C)
ksqweb_(b)
_nat
(C)
Hide NAT is (b) (6), (b) (7)(C) This should be what they see coming to
them.
The other information I dont know
(b) (6), (b)
From: (b) (6), (b) (7)(C)
(7)(C)
(6),
(b) (6), (b)
(b) (6), (b) (7)(C)
To: IT Netwrk Ops(b)
(b) (7)(C)
(7)(C)
(b) (6), (b) (7)(C)
(b) (6),
(b) (7)(C)
(b) (6), (b)

Cc: (b) (6), (b) (7)(C)
(7)(C)
Subject: <update> Can no longer access Natural Gas Storage report
from EIA site.
2/16/2012
Page 4 of 11
Please see the information below and provide details for the
information requested in red.
Thank you!
(b) (6), (b) (7)(C)

Trade Floor Support
(b) (7)(A)

(b) (6), (b) (b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
To: (b) (6), (b) (7)(C)
(7)(C)
Subject: RE: Weekly Nat Gas Storage survey - can't access
That IP is on our block list for activity on august 4th, 2011 please
read below
your request.
(b) (7)(A)
(b) (7)(A)
happening again.
Unblock request.
Jonathan Norris
2/16/2012
Page 5 of 11
From: (b) (6), (b) (7)(C)

[mailto:(b) (6), (b) (7)(C)
To: (b) (6), (b) (7)(C)
; Norris, Jonathan (CONTR)
This is what I get:
(b) (6), (b) (7)
(C)
(b) (6), (b) (7)(C)

Trade Floor Support
(b) (7)(A)
From: (b) (6), (b) (7)(C) :(b) (6), (b) (7)(C)

(b) (6), (b)
Cc: (b) (6), (b) (7)(C)
(7)(C)
Vicky please see below
To: (b) (6), (b) (7)(C) :(b) (6), (b) (7)(C)
(b) (6),
(b) (7)
(C)
,
Can you or the woman I just spoke with go to this site
http://whatismyipaddress.com/ and send me that IP
From: (b) (6), (b) (7)(C)

[mailto:(b) (6), (b) (7)(C)
To: InfoCtr (OC)
Subject: Weekly Nat Gas Storage survey
Hi,
Everyone here at (b) (7)(A) had the website for the weekly storage
2/16/2012
Page 6 of 11
release saved as a favorite but the link no longer works. Is there a

new link and if so please forward . I even tried to go back through
the home web site and that does not work either.
Any help that you can provide would be appreciated
Regards,
(b) (6),
(b) (7)
(C)
(b) (6), (b) (7)(C)
Fuels Trader
(b) (7)(A)
(b) (7)(A)
Desk/ Cell Phone (b) (6), (b) (7)(C)

24 Hr Fuels Phone (b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
************************************************** This
**************************************************
Jonathan Norris
************************************************** This
2/16/2012
Page 7 of 11
**************************************************
************************************************** This
**************************************************
Changed ticket Title from "Block (b) (6), (b) (7)(C) to "unBlock
(b) (6), (b) (7)(C)

Changed Asset from "IR Server" to "Netscaler".
Owners
Only:
3 seperat calls with this user today. they emailed OC before

contacting security.
Luu, Quan (CONTR) - 2011/08/10 08:30:21


Owners
Only:
Ticket Created
(6), (b) (7)

please block (b)
(C)
(6), (b)
POC is abuse@(b)
(7)(C)
(b) (6), (b) (7)(C)
(b) (6), (b) (7)

(C)
- - [04/Aug/2011:(b) (7)(A) -0400] GET /favicon.ico

HTTP/1.1 200 4150 - Mozilla/5.0 (Windows; U; Windows NT 5.1;
2/16/2012
Page 8 of 11
en-US; rv:1.9.2.18) Gecko/20110614 Firefox/3.6.18

- - [04/Aug/2011:(b) (7)(A) -0400]
Windows NT 5.1; Trident/4.0; GTB7.1; .NET CLR 1.1.4322; .NET
InfoPath.2)
(b) (6), (b) (7)
- - [04/Aug/2011:(b) (7)(A) -0400]
(C)
http://ir.eia.doe.gov/ngs/ngs.html Mozilla/4.0 (compatible; MSIE
6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
InfoPath.2; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)
- - [04/Aug/2011:(b) (7)(A) -0400]
(C)
3.0.4506.2152; .NET CLR 3.5.30729; MS-RTC LM 8)
(b) (6), (b) (7)
- - [04/Aug/2011:(b) (7)(A) -0400]
(C)
Safari/534.30
(b) (6), (b) (7)
- - [04/Aug/2011:(b) (7)(A) -0400]
(C)
Windows NT 5.1; SV1; GTB7.0; .NET CLR 1.1.4322; .NET CLR
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
InfoPath.2)
(b) (6), (b) (7)
- - [04/Aug/2011:(b) (7)(A) -0400]
(C)
Safari/534.30
(b) (6), (b) (7)
- - [04/Aug/2011:(b) (7)(A) -0400]
(C)
3.0.4506.2152; .NET CLR 3.5.30729; MS-RTC LM 8)
(b) (6), (b) (7)
- - [04/Aug/2011:(b) (7)(A) -0400]
(C)
InfoPath.2)
(b) (6), (b) (7)
- - [04/Aug/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
(C)
2/16/2012
Page 9 of 11
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;

(b) (6), (b) (7)
- - [04/Aug/2011:(b) (7)(A) -0400]
(C)
GET /ngs/eiabanner.gif HTTP/1.1 200 20100 - Mozilla/5.0
(b) (6), (b) (7)
- - [04/Aug/2011:(b) (7)(A) -0400]
(C)
3.0.4506.2152; .NET CLR 3.5.30729; MS-RTC LM 8)
(b) (6), (b) (7)
- - [04/Aug/2011:(b) (7)(A) -0400]
(C)
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
InfoPath.2)
(b) (6), (b) (7)
- - [04/Aug/2011:(b) (7)(A) -0400] GET /ngs/ngs.gif
(C)
3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)
(b) (6), (b) (7)
(C)
HTTP/1.1 200 10842 http://ir.eia.doe.gov/ngs/ngs.html Mozilla/4.0
CLR 3.5.30729; InfoPath.2; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)
(C)
(Windows NT 5.1) AppleWebKit/534.30 (KHTML, like Gecko)
Chrome/12.0.742.122 Safari/534.30
(b) (6), (b) (7)
(C)
CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152;
.NET CLR 3.5.30729; InfoPath.2)
(b) (6), (b) (7)
(C)
1.1.4322; .NET CLR 1.0.3705; .NET CLR 2.0.50727; InfoPath.2;
.NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; MS-RTC LM 8)
(b) (6), (b) (7)
- - [04/Aug/2011:(b) (7)(A) -0400] GET /ngs/ngs.html
(C)
HTTP/1.1 200 15739 http://www.eia.gov/naturalgas/ Mozilla/5.0
(Windows NT 5.1) AppleWebKit/534.30 (KHTML, like Gecko)
Chrome/12.0.742.122 Safari/534.30
(b) (6), (b) (7)
(C)
3.0.4506.2152; .NET CLR 3.5.30729; MS-RTC LM 8)
2/16/2012
Page 10 of 11
(b) (6), (b) (7)

(C)

1.0.3705; .NET CLR 2.0.50727; InfoPath.2; MS-RTC LM 8; .NET
CLR 3.0.4506.2152; .NET CLR 3.5.30729)
(b) (6), (b) (7)
- - [04/Aug/2011:(b) (7)(A) -0400]
(C)
InfoPath.2)
(b) (6), (b) (7)
- - [04/Aug/2011:(b) (7)(A) -0400]
(C)
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
(b) (6), (b) (7)
- - [04/Aug/2011:(b) (7)(A) -0400]
(C)
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
InfoPath.2)
(b) (6), (b) (7)
- - [04/Aug/2011:(b) (7)(A) -0400]
(C)
Safari/534.30
(b) (6), (b) (7)
- - [04/Aug/2011:(b) (7)(A) -0400]
(C)
3.0.4506.2152; .NET CLR 3.5.30729; MS-RTC LM 8)
(b) (6), (b) (7)
- - [04/Aug/2011:(b) (7)(A) -0400]
(C)
InfoPath.2)
(b) (6), (b) (7)
- - [04/Aug/2011:(b) (7)(A) -0400]
(C)
GET /ngs/search_button.gif HTTP/1.1 200 1370 - Mozilla/5.0
(b) (6), (b) (7)
- - [04/Aug/2011:(b) (7)(A) -0400]
(C)
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
(b) (6), (b) (7)
- - [04/Aug/2011:(b) (7)(A) -0400]
(C)
2/16/2012
Page 11 of 11

Safari/534.30
(b) (6), (b) (7)
- - [04/Aug/2011:(b) (7)(A) -0400]
(C)
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
InfoPath.2)
(b) (6), (b) (7)
- - [04/Aug/2011:(b) (7)(A) -0400]
(C)
3.0.4506.2152; .NET CLR 3.5.30729; MS-RTC LM 8)
2/16/2012
Page 1 of 25
Ticket TICK:57130
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
FW: Can't access EIA website (b) (6), (b) (7)

(C)
Single IP
Unblock
Completed
Medium
Netscaler
None
Marvin.Atchley@eia.gov, Prashanth.Narayanan@eia.gov
2011/08/09 10:02:30
2011/09/16 03:45:28
None
None
www-Block7 - -srcIP = (b) (6), (b) (7) has been remove per request.
(C)
Owners
Only:
- 2011/09/16 03:45:28

Owners
Only:
Changed ticket Owner from "Norris, Jonathan (CONTR)" to "Narayanan, Prashanth

(CONTR)".
From: (b) (6), (b) (7)(C)

Sent: Tuesday, August 09, 2011 12:40 PM
Subject: Can't access EIA website
Jonathan,
Here is the information you requested in order to process our unblock request.
(b) (7)(A)
your organization will use to access the website.
(b) (6), (b) (7)

(C)
(b) (7)(A)

We access the site in 2 ways:
1) On EIA Weekly Petroleum release days, we wish to download the weekly petroleum data as soon
as it is made available:
a. We look for the data once (b) (7)(A) seconds from 9:25 to 9:29:55
b. We look for the data once (b) (7)(A)
from 9:29:55 to 9:30:06
c. We look for the data once (b) (7)(A) seconds after 9:30:06 until the data comes out
This process does not open simultaneous connections to the site, it is a max of connection per
second.
(b)
(7)
(A)
2/16/2012
Page 2 of 25
2) During the first and last weeks of each month we run a process daily that synchs the EIA Monthly
Petroleum data. This process looks across the (about 2000) files that EIA releases and makes sure
(b)
that we have the latest copy. This process does not open more than (7) simultaneous connection,
(A)
(b)
(7)(A)
however, it may end up connecting
per second in succession as it scans for all of the
files one by one.
**We believe that #2 above is the process that is causing you concern.
We will disable the #2 job above and will change the process so it doesn't not open as many rapid
(b
connections in succession within the same second. We will limit the job to open a max of )
(7
)
connection per second. Also, prior to running the job the next time, we will contact you first
so that
(A
)
you can monitor the traffic and make sure that it is not causing any problems.
I hope this is enough information for you to process our unblock request. We would really appreciate
it if you can unblock our IP address as soon as possible.
Thank you for your consideration,
(b) (6), (b)
(7)(C)
2011/08/07 (b) (7)(A) SECTION: Summary

2011/08/07 (b) (7)(A) NAME: Supply & Disposition
2011/08/07 (b) (7)(A) TENOR: Monthly
2011/08/07 (b) (7)(A) AREA: East Coast (PADD 1)
2011/08/07 (b) (7)(A) PAGE: pet_sum_snd_d_r10_mbblpd_m_cur.xls
2011/08/07 (b) (7)(A) http://tonto.eia.doe.gov/dnav/pet/xls/pet_sum_snd_d_r10_mbblpd_m_cur.xls is
the
same or older
than /data/energy/MarketData/Crude/DOE/EIA/pet_sum_snd_d_r10_mbblpd_m_cur.20110728_1244
30.xls.gz
2011/08/07 (b) (7)(A) TENOR: Monthly
2011/08/07 (b) (7)(A) AREA: Gulf Coast (PADD 3)
the
same or older
31.xls.gz
2011/08/07 (b) (7)(A) TENOR: Monthly
2011/08/07 (b) (7)(A) AREA: Midwest (PADD 2)
the
same or older
33.xls.gz
2011/08/07 (b) (7)(A)
2011/08/07 (b) (7)(A)
SECTION: Summary
NAME: Supply & Disposition
2/16/2012
Page 3 of 25
2011/08/07 (b) (7)(A) TENOR: Monthly

2011/08/07 (b) (7)(A) AREA: Rocky Mountain (PADD 4)
the
same or older
34.xls.gz
2011/08/07 (b) (7)(A) TENOR: Monthly
2011/08/07 (b) (7)(A) AREA: U.S.
2011/08/07 (b) (7)(A) PAGE: pet_sum_snd_d_nus_mbblpd_m_cur.xls
2011/08/07 (b) (7)(A) http://tonto.eia.doe.gov/dnav/pet/xls/pet_sum_snd_d_nus_mbblpd_m_cur.xls is
the
same or older
than /data/energy/MarketData/Crude/DOE/EIA/pet_sum_snd_d_nus_mbblpd_m_cur.20110728_1244
39.xls.gz
Owners
Only:
on the phone again with (b) (6), (b) (7)(C)

Explaning that he cannot have access to logs. Eplained in
detail the emailI sent earlier. Istructed him on getting unblocking procces and how long it will take.
Owners
Only:
Had a 10 min phone conversation with user to explain that we show that he did infact hit the site
eccessively and needs to remediate the issue on his end and submit a plan
Owners
Only:
From: (b) (6), (b) (7)(C)

Subject: RE: Can't access EIA website
Do you know if something changed in the past week that resulted in us getting blocked? We have a
(b) (7)(A)
(b) (7)
(b) (7)(A)
process that checks
per(A) seconds and from 9:25 to 9:30 and then
per second from 9:30 to
(b)
(7)(A)
9:31, but definitely not
per second. This has been running for the past couple years.
If you could please supply us with more information in terms of when the traffic occurred, that would
help us identify who in the organization is causing the multiple times per second attempts.
Thanks,
(b) (6), (b)
(7)(C)

To: (b) (6), (b)
(7)(C)
Thank you for contacting the U.S. Energy Information Administration. We have created incident
ticket #57130 to track your request.
2/16/2012
Page 4 of 25
download the files to avoid your traffic being categorized as a denial of service attack. We also ask
that you limit the number of IP's accessing the web site simultaneously. Many large organizations
download the data once and redistribute the information internally. You may want to consider this
option.
(b) (7)(A)
your organization will use to access the website.
(b) (7)(A)
From: (b) (6), (b) (7)(C)

I believe it is (b) (6), (b) (7)
(C)
Thanks,
(b) (6), (b)
(7)(C)

To: (b) (6), (b)
(7)(C)
Hello,
In order to work on your request we need your public IP address.
Jonathan Norris
Changed ticket CC list from "" to "Marvin.Atchley@eia.gov, Prashanth.Narayanan@eia.gov".
Changed ticket Title from "FW: Can't access EIA website" to "FW: Can't access EIA website
(b) (6), (b) (7)(C)

Owners
Only:

2/16/2012
Page 5 of 25

Cc: Rollins, Gregory (CONTR)
Subject: RE: log info
I see a lot of SYN timeouts, which indicates the ACLs on the netsclaer, but we need info before
12pm.
thanks
Cc: Rollins, Gregory (CONTR)
Subject: FW: log info
-----Original Message----From: HQNST [mailto:HQNST@hq.doe.gov]

Subject: FW: log info
Mr. Norris,
Please see the log info you requested for (b) (6), (b) (7) to 205.254.135.24. The search was done for
(C)
yesterdays logs from 12pm to 5pm.
Thank You,
Xavier Villalobos
EES LLC, Contractor to
IM-623.1/Germantown Building
U.S. Department of Energy
Cyber Security Analyst
Operational Assurance & Cyber Security Division
301-903-3895
xavier.villalobos@hq.doe.gov
-----Original Message----From: CYBERIR - Xavier Villalobos [mailto:cscvillaxa@ocho.nmic.doe.gov]

Sent: Monday, August 08, 2011 11:24 AM
To: Villalobos, Xavier (CONTR)
Subject: log info
Aug 7 (b) (7)(A) esc-isp-fw1-isp.nmic.doe.gov %ASA-6-302014: Teardown TCP connection
434701485 for outside:(b) (6), (b) (7)
to inside:205.254.135.24/80 duration 0:00:00 bytes 497
(C)
TCP FINs
434701634 for outside:(b) (6), (b) (7)
(C)
TCP FINs
Aug 7 (b) (7)(A) esc-isp-fw1-isp.nmic.doe.gov %ASA-6-302013: Built inbound TCP connection
434701660 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(b) (6), (b)
(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(C)
(b) (6), (b) (7)

(C)
(C)
2/16/2012
Page 6 of 25
(205.254.135.24/80)
434701682 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434701706 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434701706 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434701722 for outside:(b) (6), (b) (7)
((b) (6), (b) (7) 8
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434701722 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434701742 for outside:(b) (6), (b) (7) 8690 ((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434701759 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434701742 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434701855 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434701878 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434701898 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434701878 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434701898 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434701940 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434701959 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434701940 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434701959 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434701983 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
(b) (6), (b)
(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
2/16/2012
Page 7 of 25
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
434702006 for outside:(b) (6), (b) (7)

((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434701983 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434702006 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434702022 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434702094 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434702063 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434702137 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434702108 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434702137 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434702162 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434702184 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434702162 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434702184 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434702227 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434702247 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434702227 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434702247 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434702270 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434702270 for outside:(b) (6), (b) (7)
(C)
TCP FINs
(b) (6), (b)
(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
2/16/2012
Page 8 of 25

434702289 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434702289 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434702317 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434702340 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434702317 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434702340 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434702370 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434702390 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434702370 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434702390 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434702405 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434702433 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434702405 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434702433 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434702452 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434702478 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
) to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434702452 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434702478 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434702500 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(b) (6), (b)
(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(C)
(b) (6), (b) (7)

(C)
(C)
2/16/2012
Page 9 of 25
(205.254.135.24/80)
434702516 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434702500 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434702516 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434702538 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434702561 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434702538 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434702561 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434702577 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434702598 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434702577 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434702598 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434702621 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434702632 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434702650 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434702660 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434702650 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434702660 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434702674 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
(b) (6), (b)
(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
2/16/2012
Page 10 of 25
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
434702696 for outside:(b) (6), (b) (7)

((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434702674 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434702696 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434702713 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434702732 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434702713 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434702732 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434702755 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434702768 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434702755 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434702768 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434702780 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434702792 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434702780 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434702792 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434702803 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434702824 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434702803 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434702824 for outside:(b) (6), (b) (7)
(C)
TCP FINs
(b) (6), (b)
(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
2/16/2012
Page 11 of 25

434702847 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434702915 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434702938 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434702951 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434702938 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434702951 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434702974 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434702995 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434702974 for outside:(b) (6), (b) (7) 8833 to inside:205.254.135.24/80 duration 0:00:00 bytes 412
(C)
TCP FINs
434702995 for outside:(b) (6), (b) (7) 8836 to inside:205.254.135.24/80 duration 0:00:00 bytes 514
(C)
TCP FINs
434703023 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434703039 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434703023 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434703039 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434703064 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434703088 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434703064 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434703088 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434703109 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(b) (6), (b)
(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(C)
(b) (6), (b) (7)

(C)
(C)
2/16/2012
Page 12 of 25
(205.254.135.24/80)
434703127 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434703109 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434703127 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434703146 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434703160 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434703146 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434703160 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434703176 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434703199 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434703176 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434703199 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434703215 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434703225 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434703215 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434703225 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434703245 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434703263 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434703245 for outside:(b) (6), (b) (7)
(C)
TCP FINs
(b) (6), (b)
(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
2/16/2012
Page 13 of 25
(b) (6), (b)

(7)(C)
434703263 for outside:(b) (6), (b) (7)

(C)
TCP FINs
434703279 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434703301 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434703279 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434703301 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434703314 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434703329 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434703314 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434703329 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434703343 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434703367 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434703343 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434703367 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434703393 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434703414 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434703393 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434703520 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434703532 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434703561 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
(b) (6), (b)
(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
2/16/2012
Page 14 of 25

434703532 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434703561 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434703574 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434703597 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434703574 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434703597 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434703619 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434703632 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434703619 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434703632 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434703645 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434703655 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434703645 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434703655 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434703748 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434703762 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434703774 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434703762 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434703774 for outside:(b) (6), (b) (7)
(b) (6), (b)
(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(C)
2/16/2012
Page 15 of 25
TCP FINs
434703783 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434703799 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434703783 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434703799 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434703818 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434703839 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434703818 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434703839 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434703868 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434703868 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434703882 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434703909 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434703896 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434703909 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434703921 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434703945 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434703921 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434703945 for outside:(b) (6), (b) (7)
(C)
TCP FINs
(b) (6), (b)
(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
2/16/2012
Page 16 of 25
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
434703959 for outside:(b) (6), (b) (7)

((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434703974 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434703959 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434703974 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434703993 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434704013 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434703993 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434704013 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434704025 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434704035 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434704025 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434704035 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434704053 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434704068 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434704053 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434704068 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434704082 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434704092 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434704082 for outside:(b) (6), (b) (7)
(C)
TCP FINs
(b) (6), (b)
(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
2/16/2012
Page 17 of 25

434704092 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434704111 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434704352 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434704363 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434704373 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434704363 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434704373 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434704379 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434704394 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434704379 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434704394 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434704406 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434704417 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434704406 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434704417 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434704454 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434704492 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434704454 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434704492 for outside:(b) (6), (b) (7)
(b) (6), (b)
(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(C)
2/16/2012
Page 18 of 25
TCP FINs
434704509 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434704521 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434704509 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434704521 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434704543 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434704565 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434704579 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434704595 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434704579 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434704595 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434704636 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434704655 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434704636 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434704655 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434704668 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434704685 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434704668 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434704685 for outside:(b) (6), (b) (7)
(C)
TCP FINs
(b) (6), (b)
(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
2/16/2012
Page 19 of 25
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
434704707 for outside:(b) (6), (b) (7)

((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434704724 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434704707 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434704724 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434704735 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434704745 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434704735 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434704745 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434704761 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434704776 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434704761 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434704776 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434704797 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434704807 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434704797 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434704831 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434704821 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434704831 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434704855 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
(b) (6), (b)
(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
2/16/2012
Page 20 of 25

434704875 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434704855 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434704875 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434704899 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434704920 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434704899 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434704920 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434704934 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434704946 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
) to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434704934 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434704946 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434704972 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434704985 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434704972 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434704985 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434705006 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434705017 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434705006 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434705017 for outside:(b) (6), (b) (7)
(b) (6), (b)
(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(C)
2/16/2012
Page 21 of 25
TCP FINs
434705032 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434705048 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434705032 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434705078 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434705096 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434705110 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434705096 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434705110 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434705127 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434705136 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434705127 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434705136 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434705158 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434705169 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434705158 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434705169 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434705195 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434705224 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
(b) (6), (b)
(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
2/16/2012
Page 22 of 25
(b) (6), (b)

(7)(C)
434705195 for outside:(b) (6), (b) (7)

(C)
TCP FINs
434705224 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434705246 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434705266 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434705246 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434705266 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434705301 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434705318 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434705301 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434705614 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434705598 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434705614 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434705620 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434705630 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434705620 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434705630 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434705642 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434705648 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434705642 for outside:(b) (6), (b) (7)
(C)
TCP FINs
(b) (6), (b)
(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
2/16/2012
Page 23 of 25

434705648 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434705667 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434705679 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434705667 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434705679 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434705694 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434705711 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434705694 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434705711 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434705726 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434705745 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80
(C)
(C)
(205.254.135.24/80)
434705726 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434705745 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434705778 for outside:(b) (6), (b) (7)
(C)
TCP FINs
434705790 for outside:(b) (6), (b) (7)
((b) (6), (b) (7)
to inside:205.254.135.24/80 (205.254
(b) (6), (b)
(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b) (7)

(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(b) (6), (b)

(7)(C)
(C)
(b) (6), (b) (7)

(C)
(C)
Changed ticket Queue from Security to Block List.

Changed ticket Status from "Opened" to "Requested".
Changed ticket Impact from "1 person inconvenienced" to "Single IP".
Changed ticket Category from "Security Incident" to "Block".
Changed ticket Owner from "DiMascio, Shannon (CONTR)" to "Norris, Jonathan (CONTR)".
Norris, Jonathan (CONTR) - 2011/08/09 10:02:30 (via email)
Owners
Only:
Ticket Created
From: User-Services-Center
2/16/2012
Page 24 of 25

Subject: FW: Can't access EIA website
Jonathan,
Please assist the external user .
Regards,
Sujith Krishnan
Chenega Government Consulting, LLC,
User Services Center
Sujith.Krishnan@eia.gov
PH: 202-586-2994
From: (b) (6), (b) (7)(C)

To: uscenter@eia.gov; User-Services-Center
Subject: Can't access EIA website
Hello, my name is (b) (6), (b) I work for (b) (7) in Chicago. We can't
(7)(C)
(A)
seem to access the EIA website and was wondering if our company has been
blocked. Can you please see if this is the case and if possible, why we
were blocked?
Thanks,
(b) (6), (b)
(7)(C)
2/16/2012
Page 25 of 25
________________________________
CONFIDENTIALITY AND SECURITY NOTICE
The contents of this message and any attachments may be confidential and
proprietary and also may be covered by the Electronic Communications
Privacy Act. This message is not intended to be used by, and should not
be relied upon in any way, by any third party. If you are not an
intended recipient, please inform the sender of the transmission error
and delete this message immediately without reading, disseminating,
distributing or copying the contents. (b) (7) l makes no assurances that
(A)
this e-mail and any attachments are free of viruses and other harmful
code.
2/16/2012
Page 1 of 14
Ticket TICK:57186
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
unBlock (b) (6), (b) (7)(C)

Single IP
Unblock
Completed
Medium
Luu, Quan (CONTR)
IR Server
None
IRblocks@eia.gov
2011/08/11 12:46:40
2011/09/16 03:45:28
None
None
done
- 2011/09/16 03:45:28
Owners
Only:
Luu, Quan (CONTR) - 2011/08/24 09:13:15

Owners
Only:

to
"unBlock (b) (6), (b) (7)(C)
this may need to be done on both the IR and the netscaler

Owners
Only:
From: (b) (6), (b) (7)(C)

Cc: (b) (6), (b) (7)(C)
Subject: RE: Unblock Request - Re: Incident Ticket 57186
2/16/2012
Page 2 of 14
Hi Jonathan,
(b) (6),
(b) (7)(C)
is out today. I will do my best to weigh in and attempt to

address your concern, as perhaps our reply was not worded clearly
enough. With our current web proxy server configuration, a worst
case scenario would have only one of the named addresses hitting
(b)
your site up to (7)
times a second, based on our load balancing. A
(A)
perfectly balanced load would have each IP listed hitting your site
(b)
up to (7)
times per second. We did not intend to convey that it was a
(b)
(b) (A)
(7) X(7) hits a second situation, as we understand your thresholds
(A)
(A)
would not support that.
I am available to discuss via phone, if you need, for futher
clarification such that we can arrive at a mutual understanding and
move forward accordingly to be back on the "nice" list. As we
noted before, we certainly respect your security controls and want
to operate our business in concert with those.
Regards,
(b) (6), (b) (7)(C)
(b) (7)(A)
Manager, Information Systems

(b) (6), (b) (7)(C)
________________________________________
To: (b) (6), (b) (7)(C)
Cc: (b) (6), (b) (7)(C)
Subject: RE: Unblock Request - Re: Incident Ticket 57186
(6),
Mrs. (b)
(b) (7)
(C)
(b)
(b)
(b)
The (7)
IPs coming in a (7)
hits a Second will give you a total of (7)
(A)
(A)
(A)
per second that is extremely too high.
From: (b) (6), (b) (7)(C)
Cc: (b) (6), (b) (7)(C)
Subject: FW: Unblock Request - Re: Incident Ticket 57186
Hi Jonathan,
Thank you for the conversation today. We have corrected our
submission. Please find the updated information below in your
initial email.
Thank you!
2/16/2012
Page 3 of 14
(b) (6), (b) (7)(C)

(b) (7)(A)
(b) (7)(A)
(b) (7)(A)
(b) (7)(A)
(b) (6), (b) (7)(C)
| ) (b) (6), (b) (7)(C)
______________________________________________
From: (b) (6), (b) (7)(C)
Sent: Wednesday, August 17, 2011 6:32 PM
Cc: (b) (6), (b) (7)(C)
Subject: Unblock Request - Re: Incident Ticket 57186
Hello Jonathan,
Thank you again for your return phone call yesterday in response
to your incident ticket #57186 and your concern referencing
potential malicious traffic. The traffic is legitimate and therefore
remediation measures are not necessary as the below listed IP
address is one of several web proxy devices in our environment.
We ask that you process our unblock request as quickly as feasible,
and please inform when this is completed. Please expedite this
request, as this information is critical to our customer's business
processes. In fact, tomorrow morning's Weekly Natural Gas
Storage Report Schedule information release scheduled at
Thursday, August 17 at 10:30AM requires access by our business
unit. Please see the information (answers added into your email
below) to serve as the statement from our organization.
Thank you.
(b) (6), (b) (7)(C)
(b) (7)(A)
(b) (7)(A)
(b) (7)(A)
(b) (7)(A)
(b) (6), (b) (7)(C)
| ) (b) (6), (b) (7)(C)

_____________________________________________
From: (b) (6), (b) (7)(C)
Sent: Wednesday, August 17, 2011 10:39 AM
Subject: Response to Incident Ticket 57186
Hello Jonathan,
Thank you for your return phone call yesterday. We are
investigating the issue.
Sincere Regards,
(b) (6), (b) (7)(C)
(b) (7)(A)
2/16/2012
Page 4 of 14
(b) (7)(A)
(b) (7)(A)
(b) (7)(A)
(b) (6), (b) (7)(C)
| ) (b) (6), (b) (7)(C)

_____________________________________________
To: (b) (6), (b) (7)(C)
your request.
(b) (7)(A)

- The IP range assigned to our proxy servers.
Specifically:
(b) (7)(A)
(b) (6), (b) (7)(C)

(b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
(b) (7)(A)
you plan to access the web site. Each

(b)
IP will only access this site (7)
times per second. This site is used to
(A)
get the natural gas storage report release at
http://ir.eia.gov/ngs/ngs.html and is key to their business function.
We verified that our customers are manually refreshing the web
browser screens (no automated processes or scripts usage).
happening again. While we would not consider the events that
precipitated the initiation of the block as an "attack," we certainly
appreciate and respect your security controls. We limit the number
of IPs accessing the web site by (b) (7)(A)
(b) (7)(A)
We have
performed our due diligence in checking the devices for malware
and other compromises and also provided awareness to the
business workgroup accessing the site concerning the need to
review their access accordingly to adhere to the controls in place.
Unblock request.
2/16/2012
Page 5 of 14
_____________________________________________
To: (b) (6), (b) (7)(C)
Hello
domain: (b) (6), (b) (7)(C) this traffic is targeting ir.eia.gov.
Jonathan Norris
The information contained in this message is intended only for the
personal and
confidential use of the recipient(s) named above. If the reader of
this message is
not the intended recipient or an agent responsible for delivering it
to the intended
recipient, you are hereby notified that you have received this
document in error
and that any review, dissemination, distribution, or copying of this
message is
strictly prohibited. If you have received this communication in
error, please notify
us immediately, and delete the original message.
personal and
this message is
to the intended
document in error
message is
Norris Jonathan (CONTR) - 2011/08/19 14:41:44
Owners
2/16/2012
Page 6 of 14
Only:
Spoke with POC twice and Explained the procedure and why I
cannot direct them on there own configuration.
Luu, Quan (CONTR) - 2011/08/17 08:53:10


Owners
Only:
From: (b) (6), (b) (7)(C)

Jonathan,
Thanks for notifying us of this issue. Ive passed this on to our
Information Security team for investigation. Ill keep you informed
of their progress.
(b) (6),
(b) (7)
(C)

To: Boag, Robert D
Hello
Jonathan Norris
personal and
this message is
to the intended
document in error
2/16/2012
Page 7 of 14

message is
Owners
Only:
Ticket Created

POC PPL Corporation
(b)
(7)
(A)
times a second
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

3.5.30729; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
3.5.30729; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
3.5.30729; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
.NET4.0C; .NET4.0E; InfoPath.1)
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 8 of 14

2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
3.5.30729; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
(b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
CLR 3.5.30729; .NET4.0C; .NET4.0E; InfoPath.1)
2/16/2012
Page 9 of 14
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
.NET4.0E)
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
CLR 3.5.30729; .NET4.0C; .NET4.0E; InfoPath.1)
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
CLR 3.5.30729; InfoPath.1; .NET4.0C; .NET4.0E; MS-RTC LM
8)
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
2/16/2012
Page 10 of 14
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

3.5.30729; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
3.5.30729; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
InfoPath.1; .NET4.0C; .NET4.0E; MS-RTC LM 8)
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 11 of 14

2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
(b) (6), (b) (7)(C)
3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
CLR 3.5.30729; InfoPath.1; .NET4.0C; .NET4.0E; MS-RTC LM
8)
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
.NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.1; .NET CLR
3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
2/16/2012
Page 12 of 14

- - [11/Aug/2011:(b) (7)(A) -0400]
3.5.30729; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
3.5.30729; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
3.5.30729; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
2/16/2012
Page 13 of 14

3.5.30729; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
3.5.30729; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
.NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.1; .NET CLR
3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 14 of 14

3.5.30729; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
3.5.30729; .NET4.0C; .NET4.0E)
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
3.5.30729; .NET4.0C; .NET4.0E)
2/16/2012
Page 1 of 30
Ticket TICK:57201
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
Block (b) (6), (b) (7)(C)

Single IP
Block
Completed
Medium
Luu, Quan (CONTR)
IR Server
None
IRblocks@eia.gov
2011/08/11 16:25:06
2011/09/16 03:45:28
None
None
done
- 2011/09/16 03:45:28
Owners
Only:
Luu, Quan (CONTR) - 2011/08/17 08:52:30


to "Luu, Quan (CONTR)".

(b) (7)
(A)
hits per second
Owners
Only:
Owners
Only:
Ticket Created

POC is abuse@xo.net
(b) (7)
(A)
(b)
(7)
(A)
(b) (7)(A)
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 2 of 30

- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
2/16/2012
Page 3 of 30

- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 4 of 30
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 5 of 30
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A)
-0400]
2/16/2012
Page 6 of 30

(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 7 of 30
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 8 of 30
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 9 of 30
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 10 of 30
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 11 of 30
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 12 of 30

- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 13 of 30
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 14 of 30
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 15 of 30

v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 16 of 30

- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

2/16/2012
Page 17 of 30
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 18 of 30
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 19 of 30

(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 20 of 30

- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
2/16/2012
Page 21 of 30

(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 22 of 30

- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
2/16/2012
Page 23 of 30

(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 24 of 30

- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
2/16/2012
Page 25 of 30
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 26 of 30
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 27 of 30

v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 28 of 30

(b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 29 of 30

v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
v1.5.1beta
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A)
-0400]
2/16/2012
Page 30 of 30

(b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
- - [11/Aug/2011:(b) (7)(A) -0400]

- - [11/Aug/2011:(b) (7)(A) -0400]
- - [11/Aug/2011:(b) (7)(A) -0400
2/16/2012
Page 1 of 3
Ticket TICK:57227
(b)(6),(b)(7)(C)
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
Block
Single IP
Block
Completed
Medium
Luu, Quan (CONTR)
IR Server
None
IRblocks@eia.gov
2011/08/15 10:05:44
2011/12/08 03:45:04
None
None
done
Owners
Only:
- 2011/12/08 03:45:04
Luu, Quan (CONTR) - 2011/08/17 08:52:00

Owners
Only:
Ticket Created
Please block
(b)
(7)
(A)
POC is abuse@yellowfiber.net
(b) b) (7)(A)(b) (7)(A)
(7)(A)
(b)(6),
(b)(7)
(C)
- - [11/Aug/2011:
-0400] GET /ngs/blackberry.txt HTTP/1.1 200 215 - Mozilla/4.0+
(compatible;+MSIE+7.0;+Windows+NT+6.0;+SLCC1;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.04506;+MSRTC+LM+8;+.NET4.0C;+.NET4.0E)
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
(compatible;+MSIE+7.0;+Windows+NT+6.0;+SLCC1;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.04506;+MS-
2/16/2012
Page 2 of 3
(b)
(6),
(b)(7)
(C)
RTC+LM+8;+.NET4.0C;+.NET4.0E)
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
(b) (7)
(A)
2/16/2012
Page 3 of 3
(b)(6),
(7)(C)
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
(b)(7)
(A)
2/16/2012
Page 1 of 3
Ticket TICK:57227
(b)(6),(b)(7)(C)
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
Block
Single IP
Block
Completed
Medium
Luu, Quan (CONTR)
IR Server
None
IRblocks@eia.gov
2011/08/15 10:05:44
2011/12/08 03:45:04
None
None
done
Owners
Only:
- 2011/12/08 03:45:04
Luu, Quan (CONTR) - 2011/08/17 08:52:00

Owners
Only:
Ticket Created
Please block
(b)
(7)
(A)
POC is abuse@yellowfiber.net
(b) (7)(A)
over
(b)(6),
(b)(7)
(C)
hits a second
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
(compatible;+MSIE+7.0;+Windows+NT+6.0;+SLCC1;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.04506;+MS-
2/16/2012
Page 2 of 3
(b)
(6),
(b)(7)
(C)
RTC+LM+8;+.NET4.0C;+.NET4.0E)
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
(b) (7)
(A)
2/16/2012
Page 3 of 3
(b)(6),
(7)(C)
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
- - [11/Aug/2011:
(b)(7)
(A)
2/16/2012
Page 1 of 2
Ticket TICK:57443
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
block (b) (6), (b) (7)(C)

Single IP
Block
Completed
Medium
Netscaler
None
IRblocks@eia.gov
2011/08/24 11:43:59
2011/12/08 03:45:04
None
None
Block has been applied.
- 2011/12/08 03:45:04
Owners
Only:

"Unassigned".

Owners
Only:

to "Somaram, James (CONTR)".
Changed ticket Status from "Approved" to "Requested".

Changed ticket Status from "Requested" to "Approved".
Owners
Only:
Ticket Created

(b) (b) (7)(A)
(7)(A)
POC is Verizon/ (b) (7)(A)
2/16/2012
Page 2 of 2
(note (b) (7)(A)
also apears in ticket 56445)
(b) (6), (b) (7)(C)
- - [18/Aug/2011:(b) (7)(A)
GET /ngs/app/js_timer.jsp 200 2151 - (b) (6), (b) (7)(C)
- - [18/Aug/2011:(b) (7)(A)
- - [18/Aug/2011:(b) (7)(A)
- - [18/Aug/2011:(b) (7)(A)
- - [18/Aug/2011:(b) (7)(A)
GET /ngs/weekly.csv 200 1400 - (b) (6), (b) (7)(C)
- - [18/Aug/2011:(b) (7)(A)
- - [18/Aug/2011:(b) (7)(A)
- - [18/Aug/2011:(b) (7)(A)
- - [18/Aug/2011:(b) (7)(A)
- - [18/Aug/2011:(b) (7)(A)
- - [18/Aug/2011:(b) (7)(A)
- - [18/Aug/2011:(b) (7)(A)
- - [18/Aug/2011:(b) (7)(A)
- - [18/Aug/2011:(b) (7)(A)
- - [18/Aug/2011:(b) (7)(A)
- - [18/Aug/2011:(b) (7)(A)
- - [18/Aug/2011:(b) (7)(A)
- - [18/Aug/2011:(b) (7)(A)
- - [18/Aug/2011:(b) (7)(A)
- - [18/Aug/2011:(b) (7)(A)
- - [18/Aug/2011:(b) (7)(A)
- - [18/Aug/2011:(b) (7)(A)
- - [18/Aug/2011:(b) (7)(A)
- - [18/Aug/2011:(b) (7)(A)
GET /ngs/weekly.csv 200 982 - -
-0400]
-0400]
-0400]
(
b
)
(
6
)
,
(
b
)
(
7
)
(
C
)
-0400]
-0400]
-0400]
-0400]
-0400]
-0400]
-0400]
-0400]
-0400]
-0400]
-0400]
-0400]
-0400]
-0400]
-0400]
-0400]
-0400]
-0400]
-0400]
-0400]
-0400]
2/16/2012
Page 1 of 6
Ticket TICK:57444
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
block (b) (6), (b) (7)(C)

Single IP
Block
Completed
Medium
Netscaler
None
IRblocks@eia.gov
2011/08/24 12:15:27
2011/10/07 03:45:45
None
None
Block is in place.
- 2011/10/07 03:45:45
Owners
Only:
Changed ticket Owner from "Somaram, James (CONTR)" to

Owners
Only:
From: (b) (6), (b) (7)(C)

Cc: (b) (7)(A)
Subject: Fwd: #HD0000002409257-Abuse; Cust; (b) (7)(A)
(7)
I(b)
Complaint received from eia.gov regarding traffic from (A)
(b) (6), (b) (7)(C)
Hello Mr. Norris,

Our support team received the below complaint from our ISP
regarding "malicious traffic" originating from (b) (6), (b) (7)(C) Can
you provide any more information regarding the nature of this
traffic?
While we have identified and corrected an application
misconfiguration that resulted in an increase in traffic volume, the
total number of requests (b)
does not seem excessive. Perhaps
(7)(A)
there is some other activity that we are not seeing in our logs?
2/16/2012
Page 2 of 6
Is it possible to arrange a time to discuss this issue in more detail?

We would like to better understand what levels of traffic are
acceptable to the EIA and how we can best meet our obligations to
delivery time-sensitive energy data to our clients.
Thank you in advance,
(b) (6),
(b) (7)(C)
(b) (6), (b) (7)(C)

(b) (7)(A)
Main. (b) (6), (b) (7)(C)

Direct. (b) (6), (b) (7)(C)
Fax. (b) (6), (b) (7)(C)
Mobile. (b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
(b) (7)(A)
www.twitter.com/(b) (7)(A)
www.Linkedin.com/companies/(b) (7)(A)
---------- Forwarded message ---------From: (b) (6), (b) (7)(C) <(b) (6), (b) (7)(C)
>
Date: Wed, Aug 24, 2011 at 14:07
Subject: Re: #HD0000002409257-Abuse; Cust; (b) (7)(A)
Complaint received from eia.gov regarding traffic from (b) (6), (b) (7)(C)
To: Cogent Help Desk <abuse@cogentco.com>

Cc: (b) (7)(A)
We have investigated and determined the cause to be a
misconfiguration of a new process recently introduced into our
production environment. As a side effect of the misconfiguration
(b) (7)
(b)
we made(A) HTTP requests within a(7)
minute window. This is
(A)
substantially higher than expected and will be reduced. We have
rolled back the new process with immediate effect and will verify
correct configuration prior to re-deployment.
I apologize again for any issues caused by this error and will
ensure that it does not happen again.
(b) (6), (b)
(7)(C)
2/16/2012
Page 3 of 6
On Wed, Aug 24, 2011 at 13:48, (b) (6), (b) (7)(C)

<(b) (6), (b) (7)(C)
> wrote:
We are investigating this incident at present and will report
findings as soon as possible.
I apologize in advance for any issues we may have caused.
(b) (6), (b)
(7)(C)
(b) (6), (b) (7)(C)

(b) (7)(A)
Main. (b) (6), (b) (7)(C)

Direct. (b) (6), (b) (7)(C)
Fax. (b) (6), (b) (7)(C)
Mobile. (b) (6), (b) (7)(C)
(b) (6), (b) (7)(C)
(b) (7)(A)
www.twitter.com/(b) (7)(A)
www.Linkedin.com/companies/(b) (7)(A)
---------- Forwarded message ---------From: Cogent Help Desk <abuse@cogentco.com>

Date: Wed, Aug 24, 2011 at 1:06 PM
Subject: #HD0000002409257-Abuse; Cust; (b) (7)(A)
Complaint received from eia.gov regarding traffic from (b) (6), (b) (7)(C)
To: (b) (6), (b) (7)(C)

Cc: abuse@cogentco.com
(b) (7)(A)
Please be advised that Cogent Abuse has received a complaint

regarding malicious traffic originating from IP address
(b) (6), (b) (7)(C)
destined for eia.gov.
Please note that logging has not been supplied with the complaint
and Cogent Abuse is unable to validate or discount the issue.
Please investigate the issue and reply back with your findings.
Best regards,
2/16/2012
Page 4 of 6
AR-02
Cogent Abuse
abuse@cogentco.com
==
I cannot give you any logs from this government agency.
-----Original Message----From: Abuse [mailto:nocabuse@cogentco.com]
To: Norris, Jonathan (CONTR); Abuse
Cc: Atchley, Marvin; Abuse
Subject: RE: abuse from (b) (6), (b) (7)(C)
Hello,
Thanks for contacting Cogent Abuse. Please provide detailed
logging and or a description of the malicious traffic you are
receiving from IP address (b) (6), (b) (7)(C)
Please be sure to include the source and destination ports, protocol,
date, time and time zone the event[s] were logged in.
Best regards,
Cogent Abuse
abuse@cogentco.com
To: Abuse
Cc: Atchley, Marvin
Subject: abuse from (b) (6), (b) (7)(C)
Hello
Jonathan Norris

2/16/2012
Page 5 of 6
Owners
Only:
Block is in place.
Owners
Only:
Ticket Created
POC PSI net

(b) (7)
(A)
(b) (7)(A)
(b) (6), (b) (7)(C)
- - [18/Aug/2011:(b) (7)(A)
- - [18/Aug/2011:(b) (7)(A)
- - [18/Aug/2011:(b) (7)(A)
- - [18/Aug/2011:(b) (7)(A)
- - [18/Aug/2011:(b) (7)(A)
- - [18/Aug/2011:(b) (7)(A)
- - [18/Aug/2011:(b) (7)(A)
- - [18/Aug/2011:(b) (7)(A)
- - [18/Aug/2011:(b) (7)(A)
- - [18/Aug/2011:(b) (7)(A)
- - [18/Aug/2011:(b) (7)(A)
- - [18/Aug/2011:(b) (7)(A)
- - [18/Aug/2011:(b) (7)(A)
- - [18/Aug/2011:(b) (7)(A)
- - [18/Aug/2011:(b) (7)(A)
- - [18/Aug/2011:(b) (7)(A)
-0400]
-0400]
-0400]
-0400]
-0400]
-0400]
-0400]
-0400]
-0400]
-0400]
-0400]
-0400]
-0400]
-0400]
-0400]
-0400]
2/16/2012
Page 6 of 6
(b) (6), (b) (7)(C)
- - [18/Aug/2011:(b) (7)(A)
- - [18/Aug/2011:(b) (7)(A)
- - [18/Aug/2011:(b) (7)(A)
- - [18/Aug/2011:(b) (7)(A)
- - [18/Aug/2011:(b) (7)(A)
- - [18/Aug/2011:(b) (7)(A)
- - [18/Aug/2011:(b) (7)(A)
- - [18/Aug/2011:(b) (7)(A)
-0400]
-0400]
-0400]
-0400]
-0400]
-0400]
-0400]
-0400]
2/16/2012
Page 1 of 44
Ticket TICK:57506
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
IR-block (b) (6), (b) (7)(C)

Single IP
Block
Completed
Medium
Netscaler
None
IRblocks@eia.gov
2011/08/26 13:11:48
2011/08/31 08:52:20
None
None
Applied block on both netscalers.
Owners
Only:

Changed ticket Title from "block (b) (6), (b) (7)(C)
to "IRblock (b) (6), (b) (7)(C)
Block has been applied on both netscalers.

Owners
Only:
(b) (6), (b) (7)(C)
- - [25/Aug/2011:(b) (7)(A) -0400]

- - [25/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [25/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 2 of 44

- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
GET /ngs/ngs.html HTTP/1.1 200 15742 - Mozilla/5.0 (X11;
Linux i686; rv:5.0) Gecko/20100101 Firefox/5.0
(b) (6), (b) (7)(C)
- - [25/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
GET /ngs/ngs.gif HTTP/1.1 200 9390
(b) (6), (b) (7)(C)
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
2/16/2012
Page 3 of 44

- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 4 of 44
(b) (6), (b) (7)(C)
- - [25/Aug/2011:(b) (7)(A) -0400]

- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 5 of 44

- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 6 of 44
(b) (6), (b) (7)(C)
- - [25/Aug/2011:(b) (7)(A) -0400]

- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 7 of 44

- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 8 of 44
(b) (6), (b) (7)(C)
- - [25/Aug/2011:(b) (7)(A) -0400]

- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 9 of 44

- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 10 of 44
(b) (6), (b) (7)(C)
- - [25/Aug/2011:(b) (7)(A) -0400]

- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 11 of 44

- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 12 of 44
(b) (6), (b) (7)(C)
- - [25/Aug/2011:(b) (7)(A) -0400]

- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 13 of 44

- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 14 of 44
(b) (6), (b) (7)(C)
- - [25/Aug/2011:(b) (7)(A) -0400]

- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 15 of 44

- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 16 of 44
(b) (6), (b) (7)(C)
- - [25/Aug/2011:(b) (7)(A) -0400]

- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 17 of 44

- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 18 of 44
(b) (6), (b) (7)(C)
- - [25/Aug/2011:(b) (7)(A) -0400]

- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 19 of 44

- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 20 of 44
(b) (6), (b) (7)(C)
- - [25/Aug/2011:(b) (7)(A) -0400]

- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 21 of 44

- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 22 of 44
(b) (6), (b) (7)(C)
- - [25/Aug/2011:(b) (7)(A) -0400]

- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 23 of 44

- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 24 of 44
(b) (6), (b) (7)(C)
- - [25/Aug/2011:(b) (7)(A) -0400]

- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 25 of 44

- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 26 of 44
(b) (6), (b) (7)(C)
- - [25/Aug/2011:(b) (7)(A) -0400]

- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 27 of 44

- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 28 of 44
(b) (6), (b) (7)(C)
- - [25/Aug/2011:(b) (7)(A) -0400]

- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:10:
Owners
Only:

POC is abuse@xo.net
2/16/2012
Page 29 of 44
(b)
over (7)
hit a second
(A)
(b) (6), (b) (7)(C)
- - [25/Aug/2011:(b) (7)(A) -0400]

- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 30 of 44

- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 31 of 44
(b) (6), (b) (7)(C)
- - [25/Aug/2011:(b) (7)(A) -0400]

- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 32 of 44

- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 33 of 44
(b) (6), (b) (7)(C)
- - [25/Aug/2011:(b) (7)(A) -0400]

- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 34 of 44

- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 35 of 44
(b) (6), (b) (7)(C)
- - [25/Aug/2011:(b) (7)(A) -0400]

- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 36 of 44

- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
Owners
Only:
Ticket Created

POC is abuse@xo.net
2/16/2012
Page 37 of 44
(b)
over (7)
hit a second
(A)
(b) (6), (b) (7)(C)
- - [25/Aug/2011:(b) (7)(A) -0400]

- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 38 of 44

- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 39 of 44
(b) (6), (b) (7)(C)
- - [25/Aug/2011:(b) (7)(A) -0400]

- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 40 of 44

- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 41 of 44
(b) (6), (b) (7)(C)
- - [25/Aug/2011:(b) (7)(A) -0400]

- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 42 of 44

- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 43 of 44
(b) (6), (b) (7)(C)
- - [25/Aug/2011:(b) (7)(A) -0400]

- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 44 of 44

- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
- - [25/Aug/2011:(b) (7)(A) -0400]
2/16/2012
Page 1 of 9
Ticket TICK:57785
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
IR Block (b) (6), (b) (7)(C)

Single IP
Block
Completed
Medium
Netscaler
None
IRblocks@eia.gov
2011/09/13 12:30:22
2011/12/08 03:45:04
None
None
Blocks have been applied on both netscalers.
- 2011/12/08 03:45:04
Owners
Only:

"Unassigned".

Owners
Only:
Block has been applied on both Phantom and Redball.

Owners
Only:
Ticket Created

POC is Amazon Cloud
ec2-abuse@amazon.com
(b) (7)
(A)
(b) (7)(A)
(b) (6), (b) (7)(C)
- - [08/Sep/2011:(b) (7)(A) -0400]

2/16/2012
Page 2 of 9
(b) (6), (b) (7)(C)
- - [08/Sep/2011:(b) (7)(A) -0400]

- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
2/16/2012
Page 3 of 9
GET /ngs/blackberry.txt HTTP/1.1 503 1404 - - - [08/Sep/2011:(b) (7)(A) -0400]

- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
2/16/2012
Page 4 of 9
(b) (6), (b) (7)(C)
- - [08/Sep/2011:(b) (7)(A) -0400]

- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
2/16/2012
Page 5 of 9

- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
2/16/2012
Page 6 of 9
(b) (6), (b) (7)(C)
- - [08/Sep/2011:(b) (7)(A) -0400]

- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
2/16/2012
Page 7 of 9

- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
2/16/2012
Page 8 of 9
(b) (6), (b) (7)(C)
- - [08/Sep/2011:(b) (7)(A) -0400]

- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
2/16/2012
Page 9 of 9

- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
- - [08/Sep/2011:(b) (7)(A) -0400]
2/16/2012
Page 1 of 21
Ticket TICK:57965
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
(6), (b) (7)

IR block (b)
(C)
Single IP
Block
Completed
Medium
Netscaler
None
IRblocks@eia.gov
2011/09/21 11:40:54
2011/12/08 03:45:04
None
None
Applied on both netscalers.
- 2011/12/08 03:45:04
Owners
Only:

"Unassigned".


08:09:59

Owners
Only:
Ticket Created
(6), (b) (7)

Please Block (b)
(C)
POC is (b) (7)(A)

(b) (7)(A)
(b) (7)
(A)
(b) (7)(A)
(b) (6), (b) (7)

(C)
- - [21/Sep/2011:(b) (7)(A) -0400]

GET /wpsr/psw04.xls HTTP/1.1 503 1691 - Python-urllib/2.7
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
2/16/2012
Page 2 of 21
(b) (6), (b) (7)

(C)
- - [21/Sep/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
2/16/2012
Page 3 of 21

- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
(C)
2/16/2012
Page 4 of 21
(b) (6), (b) (7)

(C)
- - [21/Sep/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
2/16/2012
Page 5 of 21

- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
(C)
2/16/2012
Page 6 of 21
(b) (6), (b) (7)

(C)
- - [21/Sep/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
2/16/2012
Page 7 of 21

- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
(C)
2/16/2012
Page 8 of 21
(b) (6), (b) (7)

(C)
- - [21/Sep/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
2/16/2012
Page 9 of 21

- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
(C)
2/16/2012
Page 10 of 21
(b) (6), (b) (7)

(C)
- - [21/Sep/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
2/16/2012
Page 11 of 21

- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
(C)
2/16/2012
Page 12 of 21
(b) (6), (b) (7)

(C)
- - [21/Sep/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
2/16/2012
Page 13 of 21

- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
(C)
2/16/2012
Page 14 of 21
(b) (6), (b) (7)

(C)
- - [21/Sep/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
2/16/2012
Page 15 of 21

- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
(C)
2/16/2012
Page 16 of 21
(b) (6), (b) (7)

(C)
- - [21/Sep/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
2/16/2012
Page 17 of 21

- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
(C)
2/16/2012
Page 18 of 21
(b) (6), (b) (7)

(C)
- - [21/Sep/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
2/16/2012
Page 19 of 21

- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
(C)
2/16/2012
Page 20 of 21
(b) (6), (b) (7)

(C)
- - [21/Sep/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
2/16/2012
Page 21 of 21

- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
- - [21/Sep/2011:(b) (7)(A) -0400]
(C)
(b) (6), (b) (7)
(C)
2/16/2012
Page 1 of 5
Ticket TICK:57966
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
IR Block (b) (6), (b) (7)(C)

Single IP
Block
Completed
Medium
Netscaler
None
IRblocks@eia.gov
2011/09/21 11:57:08
2011/12/08 03:45:04
None
None
Completed.
- 2011/12/08 03:45:04
Owners
Only:

"Unassigned".

Owners
Only:
Blocked on both netscalers.

08:09:43

Owners
Only:
Ticket Created

POC is (b) (7)(A)
(b) (7)(A)
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
2/16/2012
Page 2 of 5

- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
2/16/2012
Page 3 of 5
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
2/16/2012
Page 4 of 5

- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
2/16/2012
Page 5 of 5
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]

(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [21/Sep/2011:(b) (7)(A) -0400]
2/16/2012
Page 1 of 6
Ticket TICK:58209
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
IR Block (b) (6), (b) (7)(C)

Single IP
Block
Completed
Medium
Netscaler
None
IRblocks@eia.gov
2011/10/05 12:04:49
2011/10/06 10:38:45
None
None
Owners
Only:
Date/Time 2011-10-05 13:16:00 EDT

Tag Name (b) (7)(E)
Severity Low
(b) (7)
Combined Event Count(A)
Cleared Flag false
Target Service http
SourcePort Name 0
Sensor Name IPSdot7
:adapter A
(b) (7)
:blocked-count(A)
:end-time 2011-10-05 13:16:00
:event-type Attack
(b) (7)
:opened(A)
(b)
(7)
:pam(b) (7)(A)
(A)
:Protocol Name TCP
(b)
:repeat-count (7)
(A)
:start-time 2011-10-05 13:16:00
AdapterID A
2/16/2012
Page 2 of 6
BLOCK Default
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7
Date/Time 2011-10-05 13:16:00 EDT
Tag Name (b) (7)(E)
Severity Low
Cleared Flag false
Target Service http
Sensor Name IPSdot7
:adapter A
:blocked-count 1
:event-type Attack
(b)
:opened (7)
(b)
(7)
:pam.(b) (7)(A)
(A)
:Protocol Name TCP
:repeat-count 1
AdapterID A
BLOCK Default
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7
Date/Time 2011-10-05 13:16:00 EDT
Tag Name (b) (7)(E)
Severity Low
Cleared Flag false
Target Service http
2/16/2012
Page 3 of 6

Sensor Name IPSdot7
:adapter A
:blocked-count 1
:event-type Attack
(b)
:(b) (7)(A) (7)
b) (7)
A)
:pam.(b) (7)(A)
:Protocol Name TCP
:repeat-count 1
AdapterID A
BLOCK Default
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7


Owners
Only:
Ticket Created

(b) (7)(A)
poc is ipadmin@
(b)
(7)
(A)
(b) (7)(A)
(b) (6), (b) (7)(C)
- - [05/Oct/2011:(b) (7)(A) -0400]

GET /wpsr/table1.csv HTTP/1.1 200 5940 - (b) (6), (b) (7)(C)
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
2/16/2012
Page 4 of 6
(b) (6), (b) (7)(C)
- - [05/Oct/2011:(b) (7)(A) -0400]

- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
2/16/2012
Page 5 of 6
GET /wpsr/table1.csv HTTP/1.1 503 1403 - - - [05/Oct/2011:(b) (7)(A) -0400]

- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
2/16/2012
Page 6 of 6
(b) (6), (b) (7)(C)
- - [05/Oct/2011:(b) (7)(A) -0400]

- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
2/16/2012
Page 1 of 6
Ticket TICK:58215
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
IR Block (b) (6), (b) (7)(C)

Single IP
Block
Completed
Medium
Netscaler
None
IRblocks@eia.gov
2011/10/05 13:32:55
2011/11/25 03:47:30
None
None

(via email)
Owners
Only:
I am currently out of the office. Please contact the network team

for any network requests.
- 2011/11/25 03:45:02
Owners
Only:
Owners
Only:
Date/Time 2011-10-05 13:16:00 EDT

Tag Name (b) (7)(E)
Severity Low
(b) (7)
Combined Event Count(A)
Cleared Flag false
Target Service http
SourcePort Name 0
Sensor Name IPSdot7
:adapter A
(b)
:blocked-count (7)
(A)
2/16/2012
Page 2 of 6
:end-time 2011-10-05 13:16:00

:event-type Attack
(b)
:(b) (7)(A) (7)
b) (7)
A)
:pam(b) (7)(A)
:Protocol Name TCP
(b)
:repeat-count (7)
(A)
:start-time 2011-10-05 13:16:00
AdapterID A
BLOCK Default
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7
Date/Time 2011-10-05 13:16:00 EDT

Tag Name (b) (7)(E)
Severity Low
Cleared Flag false
Target Service http
Sensor Name IPSdot7
:adapter A
(b)
:blocked-count(7)
(A)
:event-type Attack
(b)
:(b) (7)(A) (7)
(b)
(7)
:pam.(b) (7)(A)
(A)
:Protocol Name TCP
(b)
:repeat-count(7)
(A)
AdapterID A
BLOCK Default
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
2/16/2012
Page 3 of 6
SensorName IPSdot7
Date/Time 2011-10-05 13:16:00 EDT
Tag Name (b) (7)(E)
Severity Low
Cleared Flag false
Target Service http
Sensor Name IPSdot7
:adapter A
:blocked-count 1
:event-type Attack
(b)
:(b) (7)(A) (7)
(b)
(b) (7)(A)
(7)
:pam.
(A)
:Protocol Name TCP
:repeat-count 1
AdapterID A
BLOCK Default
IANAProtocolId 6
LOGEVIDENCE Default
ResponseFilterID 0
SensorName IPSdot7


Owners
Only:
Ticket Created

POC is abuse@turnkeyinternet.net
2/16/2012
Page 4 of 6
(b) (7)
(A)
(b)
(7)
(A)
(b) (7)(A)
(b) (6), (b) (7)(C)
- - [05/Oct/2011:(b) (7)(A) -0400]

- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
2/16/2012
Page 5 of 6

- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
2/16/2012
Page 6 of 6
(b) (6), (b) (7)(C)
- - [05/Oct/2011:(b) (7)(A) -0400]

- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
- - [05/Oct/2011:(b) (7)(A) -0400]
2/16/2012
Page 1 of 3
Ticket TICK:58430
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
IR Block (b) (6), (b) (7)(C)

Single IP
Block
Completed
Medium
Netscaler
None
IRblocks@eia.gov
2011/10/19 14:24:37
2011/10/27 09:24:50
None
None
Block has been applied on both NetScalers.

Owners
Only:
Changed ticket Title from "IR Block (b) (6), (b) (7)(C)
to
"IR Block (b) (6), (b) (7)(C)
Changed ticket Owner from "Somaram, James
(CONTR)" to "Norris, Jonathan (CONTR)".

POC is Fast serv /Upstream
(b) (6), (b) (7)(C)
- - [26/Oct/2011:(b) (7)(A) -0400]

- - [26/Oct/2011:(b) (7)(A) -0400]
- - [26/Oct/2011:(b) (7)(A) -0400]
- - [26/Oct/2011:(b) (7)(A) -0400]
- - [26/Oct/2011:(b) (7)(A) -0400]
- - [26/Oct/2011:(b) (7)(A) -0400]
- - [26/Oct/2011:(b) (7)(A) -0400]
2/16/2012
Page 2 of 3

- - [26/Oct/2011:(b) (7)(A) -0400]
- - [26/Oct/2011:(b) (7)(A) -0400]
- - [26/Oct/2011:(b) (7)(A) -0400]
- - [26/Oct/2011:(b) (7)(A) -0400]
- - [26/Oct/2011:(b) (7)(A) -0400]
- - [26/Oct/2011:(b) (7)(A) -0400]
- - [26/Oct/2011:(b) (7)(A) -0400]
- - [26/Oct/2011:(b) (7)(A) -0400]
- - [26/Oct/2011:(b) (7)(A) -0400]
- - [26/Oct/2011:(b) (7)(A) -0400]
- - [26/Oct/2011:(b) (7)(A) -0400]
- - [26/Oct/2011:(b) (7)(A) -0400]
- - [26/Oct/2011:(b) (7)(A) -0400]
- - [26/Oct/2011:(b) (7)(A) -0400]


Owners
Only:
Ticket Created

POC is abuse@fast-serv.com
(b)
(7)
(A)
(b) (7)(A)
(b) (6), (b) (7)(C)
- - [19/Oct/2011:(b) (7)(A) -0400]

2/16/2012
Page 3 of 3
(b) (6), (b) (7)(C)
- - [19/Oct/2011:(b) (7)(A) -0400]

- - [19/Oct/2011:(b) (7)(A) -0400]
- - [19/Oct/2011:(b) (7)(A) -0400]
- - [19/Oct/2011:(b) (7)(A) -0400]
- - [19/Oct/2011:(b) (7)(A) -0400]
- - [19/Oct/2011:(b) (7)(A) -0400]
- - [19/Oct/2011:(b) (7)(A) -0400]
- - [19/Oct/2011:(b) (7)(A) -0400]
- - [19/Oct/2011:(b) (7)(A) -0400]
- - [19/Oct/2011:(b) (7)(A) -0400]
- - [19/Oct/2011:(b) (7)(A) -0400]
- - [19/Oct/2011:(b) (7)(A) -0400]
- - [19/Oct/2011:(b) (7)(A) -0400]
- - [19/Oct/2011:(b) (7)(A) -0400]
- - [19/Oct/2011:(b) (7)(A) -0400]
- - [19/Oct/2011:(b) (7)(A) -0400]
- - [19/Oct/2011:(b) (7)(A) -0400]
- - [19/Oct/2011:(b) (7)(A) -0400]
- - [19/Oct/2011:(b) (7)(A) -0400]
2/16/2012
Page 1 of 7
Ticket TICK:58543
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
IR Block (b) (6), (b) (7)(C)

Single IP
Block
Completed
Medium
Netscaler
None
IRblocks@eia.gov
2011/10/26 11:17:39
2011/11/25 03:45:02
None
None
Blocks have been applied.
- 2011/11/25 03:45:02
Owners
Only:

Owners
Only:
Ticket Created

POC (b) (7)(A)
(b)
(7)
(A)
(b) (7)(A)
(b) (6), (b) (7)(C)
- - [26/Oct/2011:(b) (7)(A) -0400]

GET /wpsr/app/js_timer.jsp HTTP/1.1 200 2072
http://ir.eia.gov/wpsr/overview.pdf Mozilla/4.0 (compatible; MSIE
7.0; MSBrowserIE7; Windows NT 5.1; msie6xpv1; .NET CLR
1.0.3705; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR
3.0.4506.2152; .NET CLR 3.5.30729; MS-RTC LM 8; InfoPath.1;
2/16/2012
Page 2 of 7
.NET4.0C; .NET4.0E; mty:p; ssx:NonCitrix; dmx:m;

slx:we.pu.na)
(b) (6), (b) (7)(C)
- - [26/Oct/2011:(b) (7)(A) -0400]
slx:we.pu.na)
(b) (6), (b) (7)(C)
- - [26/Oct/2011:(b) (7)(A) -0400]
slx:we.pu.na)
(b) (6), (b) (7)(C)
- - [26/Oct/2011:(b) (7)(A) -0400]
slx:we.pu.na)
(b) (6), (b) (7)(C)
- - [26/Oct/2011:(b) (7)(A) -0400]
slx:we.pu.na)
(b) (6), (b) (7)(C)
- - [26/Oct/2011:(b) (7)(A) -0400]
slx:we.pu.na)
(b) (6), (b) (7)(C)
- - [26/Oct/2011:(b) (7)(A) -0400]
slx:we.pu.na)
(b) (6), (b) (7)(C)
- - [26/Oct/2011:(b) (7)(A) -0400]
2/16/2012
Page 3 of 7

slx:we.pu.na)
(b) (6), (b) (7)(C)
- - [26/Oct/2011:(b) (7)(A) -0400]
slx:we.pu.na)
(b) (6), (b) (7)(C)
- - [26/Oct/2011:(b) (7)(A) -0400]
slx:we.pu.na)
(b) (6), (b) (7)(C)
- - [26/Oct/2011:(b) (7)(A) -0400]
slx:we.pu.na)
(b) (6), (b) (7)(C)
- - [26/Oct/2011:(b) (7)(A) -0400]
slx:we.pu.na)
(b) (6), (b) (7)(C)
- - [26/Oct/2011:(b) (7)(A) -0400]
slx:we.pu.na)
(b) (6), (b) (7)(C)
- - [26/Oct/2011:(b) (7)(A) -0400]
2/16/2012
Page 4 of 7

slx:we.pu.na)
(b) (6), (b) (7)(C)
- - [26/Oct/2011:(b) (7)(A) -0400]
GET /wpsr/overview.pdf HTTP/1.1 503 1695 - Mozilla/4.0
(compatible; MSIE 7.0; MSBrowserIE7; Windows NT 5.1;
msie6xpv1; .NET CLR 1.0.3705; .NET CLR 1.1.4322; .NET CLR
2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; MSRTC LM 8; InfoPath.1; .NET4.0C; .NET4.0E; mty:p;
ssx:NonCitrix; dmx:m; slx:we.pu.na)
(b) (6), (b) (7)(C)
- - [26/Oct/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [26/Oct/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [26/Oct/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [26/Oct/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [26/Oct/2011:(b) (7)(A) -0400]
slx:we.pu.na)
(b) (6), (b) (7)(C)
- - [26/Oct/2011:(b) (7)(A) -0400]
2/16/2012
Page 5 of 7

slx:we.pu.na)
(b) (6), (b) (7)(C)
- - [26/Oct/2011:(b) (7)(A) -0400]
slx:we.pu.na)
(b) (6), (b) (7)(C)
- - [26/Oct/2011:(b) (7)(A) -0400]
slx:we.pu.na)
(b) (6), (b) (7)(C)
- - [26/Oct/2011:(b) (7)(A) -0400]
slx:we.pu.na)
(b) (6), (b) (7)(C)
- - [26/Oct/2011:(b) (7)(A) -0400]
slx:we.pu.na)
(b) (6), (b) (7)(C)
- - [26/Oct/2011:(b) (7)(A) -0400]
slx:we.pu.na)
(b) (6), (b) (7)(C)
- - [26/Oct/2011:(b) (7)(A) -0400]
2/16/2012
Page 6 of 7
slx:we.pu.na)
(b) (6), (b) (7)(C)
- - [26/Oct/2011:(b) (7)(A) -0400]

slx:we.pu.na)
(b) (6), (b) (7)(C)
- - [26/Oct/2011:(b) (7)(A) -0400]
slx:we.pu.na)
(b) (6), (b) (7)(C)
- - [26/Oct/2011:(b) (7)(A) -0400]
slx:we.pu.na)
(b) (6), (b) (7)(C)
- - [26/Oct/2011:(b) (7)(A) -0400]
slx:we.pu.na)
(b) (6), (b) (7)(C)
- - [26/Oct/2011:(b) (7)(A) -0400]
slx:we.pu.na)
(b) (6), (b) (7)(C)
- - [26/Oct/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [26/Oct/2011:(b) (7)(A) -0400]
2/16/2012
Page 7 of 7

(b) (6), (b) (7)(C)
- - [26/Oct/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [26/Oct/2011:(b) (7)(A) -0400]
(b) (6), (b) (7)(C)
- - [26/Oct/2011:(b) (7)(A) -0400]
2/16/2012
Page 1 of 1
Ticket TICK:58726
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
Block (b) (6), (b) (7)(C)

Single IP
Block
Completed
High
Netscaler
None
Glenn.Bily@eia.gov, Erik.Saulkalns@eia.gov,
Marvin.Atchley@eia.gov, Prashanth.Narayanan@eia.gov
2011/11/07 11:14:44
2011/11/07 14:38:16
None
None
Bily, Glenn (CONTR) - 2011/11/07 11:20:57
Owners
Only:
Is this for the Netscaler?

(6), (b) (7)
Because (b)
is not behind the Netscaler this will have
(C)
limited effectiveness.

Owners
Only:
Ticket Created
(b) (6), (b) (7)(C)
incident please block (b) (6), (b) (7)(C)
I will add incident # when I have it
2/16/2012
Page 1 of 3
Ticket TICK:59026
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
IR block (b) (6), (b) (7)(C)

Single IP
Block
Completed
High
Netscaler
None
IRblocks@eia.gov
2011/11/23 10:53:45
2011/11/30 08:51:33
None
None
added to both netsclaers

08:51:33


11:09:03 (via email)
Owners
Only:
Applied to both netscalers

-----Original Message----From: Block List [mailto:BlockList@kbox.eia.doe.gov]
Sent: Wednesday, November 23, 2011 10:58 AM
Subject: IR Blocks Ticket [TICK:59026] IR block
(b) (6), (b) (7)(C)
Ticket [TICK:59026] IR block (b) (6), (b) (7)(C)
updated.
----- Change by Norris, Jonathan (CONTR) at 2011-11-23

10:55:40 ----Changed ticket Owner from "Norris, Jonathan (CONTR)" to
"Narayanan,
Prashanth (CONTR)".

Owners
Only:
2/16/2012
Page 2 of 3
Date/Time 2011-11-23 03:14:15 EST

Tag Name (b) (7)(E)
Severity High
(b)
(A)
Cleared Flag false
Target Service http
Sensor Name IPSdot7
:adapter A
:arg configdir=|echo;echo%20YYYAAZ;uname;id;echo%
20YYY;echo|
(b)
:blocked-count(7)
(A)
:event-type Attack
:Protocol Name TCP
(b)
:repeat-count(7)
(A)
:server ir.eia.doe.gov
:URL /awstats/awstats.pl
:verdict attack_failed
AdapterID A
BLOCK Default
IANAProtocolId 6
ResponseFilterID 0
SensorName IPSdot7
Date/Time 2011-11-23 03:14:15 EST
Tag Name (b) (7)(E)
Severity High
(b)
(A)
Cleared Flag false
Target Service http
Sensor Name IPSdot7
2/16/2012
Page 3 of 3
:adapter A
20YYY;echo|
(b)
:blocked-count(7)
(A)
:event-type Attack
:Protocol Name TCP
:repeat-count 1
:server ir.eia.gov
AdapterID A
BLOCK Default
IANAProtocolId 6
ResponseFilterID 0
SensorName IPSdot7
Owners
Only:
Ticket Created

POC is (b) (7)(A)
2/16/2012
Page 1 of 30
Ticket TICK:59084
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
IR Block (b) (6), (b) (7)(C)

Single IP
Block
Completed
Medium
Netscaler
None
IRblocks@eia.gov
2011/11/29 11:37:34
2011/11/30 08:51:16
None
None
added to both netscalers

08:51:16
Owners
Only:

added to both netscalers

Owners
Only:
Ticket Created

POC abuse@packetexchange.net
(b) (7)
(A)
(b)
(7)
(A)
(b) (7)(A)
(b) (6), (b) (7)(C)
- - [23/Nov/2011:(b) (7)(A) -0500]

- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
2/16/2012
Page 2 of 30
(b) (6), (b) (7)(C)
- - [23/Nov/2011:(b) (7)(A) -0500]

- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
2/16/2012
Page 3 of 30
GET /wpsr/table1.csv HTTP/1.1 503 1404 - - - [23/Nov/2011:(b) (7)(A) -0500]

- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
2/16/2012
Page 4 of 30
(b) (6), (b) (7)(C)
- - [23/Nov/2011:(b) (7)(A) -0500]

- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
2/16/2012
Page 5 of 30

- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
2/16/2012
Page 6 of 30
(b) (6), (b) (7)(C)
- - [23/Nov/2011:(b) (7)(A) -0500]

- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
2/16/2012
Page 7 of 30

- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
2/16/2012
Page 8 of 30
(b) (6), (b) (7)(C)
- - [23/Nov/2011:(b) (7)(A) -0500]

- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
2/16/2012
Page 9 of 30

- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
2/16/2012
Page 10 of 30
(b) (6), (b) (7)(C)
- - [23/Nov/2011:(b) (7)(A) -0500]

- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
2/16/2012
Page 11 of 30

- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
2/16/2012
Page 12 of 30
(b) (6), (b) (7)(C)
- - [23/Nov/2011:(b) (7)(A) -0500]

- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
2/16/2012
Page 13 of 30

- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
2/16/2012
Page 14 of 30
(b) (6), (b) (7)(C)
- - [23/Nov/2011:(b) (7)(A) -0500]

- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
2/16/2012
Page 15 of 30

- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
2/16/2012
Page 16 of 30
(b) (6), (b) (7)(C)
- - [23/Nov/2011:(b) (7)(A) -0500]

- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
2/16/2012
Page 17 of 30

- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
2/16/2012
Page 18 of 30
(b) (6), (b) (7)(C)
- - [23/Nov/2011:(b) (7)(A) -0500]

- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
2/16/2012
Page 19 of 30

- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
2/16/2012
Page 20 of 30
(b) (6), (b) (7)(C)
- - [23/Nov/2011:(b) (7)(A) -0500]

- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
2/16/2012
Page 21 of 30

- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
2/16/2012
Page 22 of 30
(b) (6), (b) (7)(C)
- - [23/Nov/2011:(b) (7)(A) -0500]

- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
2/16/2012
Page 23 of 30

- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
2/16/2012
Page 24 of 30
(b) (6), (b) (7)(C)
- - [23/Nov/2011:(b) (7)(A) -0500]

- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
2/16/2012
Page 25 of 30

- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
2/16/2012
Page 26 of 30
(b) (6), (b) (7)(C)
- - [23/Nov/2011:(b) (7)(A) -0500]

- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
2/16/2012
Page 27 of 30

- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
2/16/2012
Page 28 of 30
(b) (6), (b) (7)(C)
- - [23/Nov/2011:(b) (7)(A) -0500]

- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
2/16/2012
Page 29 of 30

- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
2/16/2012
Page 30 of 30
(b) (6), (b) (7)(C)
- - [23/Nov/2011:(b) (7)(A) -0500]

- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
- - [23/Nov/2011:(b) (7)(A) -0500]
--
2/16/2012
Page 1 of 5
Ticket TICK:59216
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
IR block
Single IP
Block
Completed
Medium
Netscaler
None
IRblocks@eia.gov
2011/12/06 16:09:27
2011/12/07 08:44:05
None
None


Owners
Only:
Ticket Created

POC (b) (7)(A)
(b)
(7)
(A)
(b) (7)(A)
(b) (7)(A)
(b) (6), (b) (7)(C)
- - [01/Dec/2011:(b) (7)(A) -0500]

http://ir.eia.gov/ngs/ngs.html Mozilla/5.0 (X11; U; Linux x86_64;
en-US; rv:1.9.2.14) Gecko/20110221 Red Hat/3.6.14-4.el6_0
Firefox/3.6.14
(b) (6), (b) (7)(C)
- - [01/Dec/2011:(b) (7)(A) -0500]
Firefox/3.6.14
(b) (6), (b) (7)(C)
- - [01/Dec/2011:(b) (7)(A) -0500]
2/16/2012
Page 2 of 5
Firefox/3.6.14
- - [01/Dec/2011:(b) (7)(A) -0500]
Firefox/3.6.14
(b) (6), (b) (7)(C)
- - [01/Dec/2011:(b) (7)(A) -0500]
Firefox/3.6.14
(b) (6), (b) (7)(C)
- - [01/Dec/2011:(b) (7)(A) -0500]
Firefox/3.6.14
(b) (6), (b) (7)(C)
- - [01/Dec/2011:(b) (7)(A) -0500]
Firefox/3.6.14
(b) (6), (b) (7)(C)
- - [01/Dec/2011:(b) (7)(A) -0500]
Firefox/3.6.14
(b) (6), (b) (7)(C)
- - [01/Dec/2011:(b) (7)(A) -0500]
Firefox/3.6.14
(b) (6), (b) (7)(C)
- - [01/Dec/2011:(b) (7)(A) -0500]
Firefox/3.6.14
(b) (6), (b) (7)(C)
- - [01/Dec/2011:(b) (7)(A) -0500]
Firefox/3.6.14
(b) (6), (b) (7)(C)
- - [01/Dec/2011:(b) (7)(A) -0500]
Firefox/3.6.14
(b) (6), (b) (7)(C)
- - [01/Dec/2011:(b) (7)(A) -0500]
Firefox/3.6.14
(b) (6), (b) (7)(C)
2/16/2012
Page 3 of 5
(b) (6), (b) (7)(C)
- - [01/Dec/2011:(b) (7)(A) -0500]

Firefox/3.6.14
(b) (6), (b) (7)(C)
- - [01/Dec/2011:(b) (7)(A) -0500]
Firefox/3.6.14
(b) (6), (b) (7)(C)
- - [01/Dec/2011:(b) (7)(A) -0500]
GET /ngs/ngs.html HTTP/1.1 503 1399 - Mozilla/5.0 (X11; U;
Linux x86_64; en-US; rv:1.9.2.14) Gecko/20110221 Red
Hat/3.6.14-4.el6_0 Firefox/3.6.14
(b) (6), (b) (7)(C)
- - [01/Dec/2011:(b) (7)(A) -0500]
Hat/3.6.14-4.el6_0 Firefox/3.6.14
(b) (6), (b) (7)(C)
- - [01/Dec/2011:(b) (7)(A) -0500]
Hat/3.6.14-4.el6_0 Firefox/3.6.14
(b) (6), (b) (7)(C)
- - [01/Dec/2011:(b) (7)(A) -0500]
Hat/3.6.14-4.el6_0 Firefox/3.6.14
(b) (6), (b) (7)(C)
- - [01/Dec/2011:(b) (7)(A) -0500]
Hat/3.6.14-4.el6_0 Firefox/3.6.14
(b) (6), (b) (7)(C)
- - [01/Dec/2011:(b) (7)(A) -0500]
Firefox/3.6.14
(b) (6), (b) (7)(C)
- - [01/Dec/2011:(b) (7)(A) -0500]
Firefox/3.6.14
(b) (6), (b) (7)(C)
- - [01/Dec/2011:(b) (7)(A) -0500]
Firefox/3.6.14
(b) (6), (b) (7)(C)
- - [01/Dec/2011:(b) (7)(A) -0500]
Firefox/3.6.14
(b) (6), (b) (7)(C)
- - [01/Dec/2011:(b) (7)(A) -0500]
2/16/2012
Page 4 of 5

Firefox/3.6.14
(b) (6), (b) (7)(C)
- - [01/Dec/2011:(b) (7)(A) -0500]
Firefox/3.6.14
(b) (6), (b) (7)(C)
- - [01/Dec/2011:(b) (7)(A) -0500]
Firefox/3.6.14
(b) (6), (b) (7)(C)
- - [01/Dec/2011:(b) (7)(A) -0500]
Firefox/3.6.14
(b) (6), (b) (7)(C)
- - [01/Dec/2011:(b) (7)(A) -0500]
Firefox/3.6.14
(b) (6), (b) (7)(C)
- - [01/Dec/2011:(b) (7)(A) -0500]
Firefox/3.6.14
(b) (6), (b) (7)(C)
- - [01/Dec/2011:(b) (7)(A) -0500]
Firefox/3.6.14
(b) (6), (b) (7)(C)
- - [01/Dec/2011:(b) (7)(A) -0500]
Firefox/3.6.14
(b) (6), (b) (7)(C)
- - [01/Dec/2011:(b) (7)(A) -0500]
Firefox/3.6.14
(b) (6), (b) (7)(C)
- - [01/Dec/2011:(b) (7)(A) -0500]
Firefox/3.6.14
(b) (6), (b) (7)(C)
- - [01/Dec/2011:(b) (7)(A) -0500]
2/16/2012
Page 5 of 5

Firefox/3.6.14
(b) (6), (b) (7)(C)
- - [01/Dec/2011:(b) (7)(A) -0500]
Hat/3.6.14-4.el6_0 Firefox/3.6.14
(b) (6), (b) (7)(C)
- - [01/Dec/2011:(b) (7)(A) -0500]
Hat/3.6.14-4.el6_0 Firefox/3.6.14
(b) (6), (b) (7)(C)
- - [01/Dec/2011:(b) (7)(A) -0500]
Hat/3.6.14-4.el6_0 Firefox/3.6.14
(b) (6), (b) (7)(C)
- - [01/Dec/2011:(b) (7)(A) -0500]
Hat/3.6.14-4.el6_0 Firefox/3.6.14
(b) (6), (b) (7)(C)
- - [01/Dec/2011:(b) (7)(A) -0500]
Hat/3.6.14-4.el6_0 Firefox/3.6.14
2/16/2012
Page 1 of 2
Ticket TICK:59226
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
IR Block (b) (6), (b) (7)(C)

Single IP
Block
Completed
Medium
Netscaler
None
IRblocks@eia.gov
2011/12/07 10:53:17
2011/12/08 09:03:00
None
None


Owners
Only:
Date/Time 2011-12-07 04:30:22 EST

Tag Name (b) (7)(E)
Severity High
(b)
(A)
Cleared Flag false
Target Service http
Sensor Name IPSdot7
:adapter A
20YYY;echo|
(b)
:blocked-count(7)
(A)
:event-type Attack
:Protocol Name TCP
(b)
:repeat-count(7)
(A)
:server 205.254.135.25
2/16/2012
Page 2 of 2
AdapterID A
BLOCK Default
IANAProtocolId 6
ResponseFilterID 0
SensorName IPSdot7
Owners
Only:
Ticket Created

POC (b) (7)(A)
2/16/2012
Page 1 of 8
Ticket TICK:59320
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
Please Block (b) (6), (b) (7)(C) EIA.gov

Single IP
Block
Completed
Medium
Netscaler
None
None
2011/12/12 14:48:38
2011/12/12 16:05:13
None
None
blocks have been applied on both netscalers.
Changed ticket Owner from "Norris, Jonathan (CONTR)" to "Somaram, James (CONTR)".
Ticket Created
Added attachment "ex111205.www2.2011.12.05.16.[23].to[4][0-2].log.filtered.with.(b) (6), (b) (7)(C) zip"
(b) (6), (b) (7)(C)
is sending Exessive traffic ti www.EIA.gov
POC is North Carolina Resaerch Triangle

(b) (7)(A)
log exerpt
2011-12-05 (b) (7)(A) GET /styles/eia_header.js - - (b) (6), (b) (7)(C) Mozilla/4.0+
(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.4506.2152;+.NET+CLR+3.5.30729;+.NET4.0
- http://www.eia.gov/energy_in_brief/ 200 232600 937
2011-12-05 (b) (7)(A) GET /global/scripts/ga_head.js - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/images/icons/teachers.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
__utma=165580587.2108855905.1323102330.1323102330.1323102330.1;+__utmb=165580587.1.10.1323102330;+__utmc=165580587;+__utmz=165580587.1323102330
(direct)|utmccn=(direct)|utmcmd=(none) http://www.eia.gov/404r.cfm?v=http://www.eia.gov/energy_in_bref 200 2107 140
2011-12-05 (b) (7)(A) GET /global/images/bg/header_bg.jpg - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /energy_in_brief/images/eiblogo-wtagline-final.jpg - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /energy_in_brief/images/thumbnails/libby-thumb.jpg - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /energy_in_brief/images/thumbnails/major-sources-users-thumb.jpg - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/images/bg/footer_bg.jpg - - (b) (6), (b) (7)(C) Mozilla/4.0+
(direct)|utmccn=(direct)|utmcmd=(none) http://www.eia.gov/energy_in_brief/ 200 1471 234
2011-12-05 (b) (7)(A) GET /energy_in_brief/images/thumbnails/shale-thumb.jpg - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /energy_in_brief/images/thumbnails/oil-tanker-thumb.jpg - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /energy_in_brief/images/thumbnails/ghg-thumb.jpg - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /energy_in_brief/images/thumbnails/wind-thumb.jpg - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/images/logos/eia_address.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/images/btns/rs_submit.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
2/16/2012
Page 2 of 8
2011-12-05 (b) (7)(A) GET /energy_in_brief/images/thumbnails/coal-thumb.jpg - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/images/fancybox/blank.gif - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /energy_in_brief/images/thumbnails/nuclear-industry-thumb.jpg - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /energy_in_brief/images/thumbnails/renewables-thumb.jpg - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /energy_in_brief/images/thumbnails/RPS-EIB-thumb.jpg - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /energy_in_brief/images/email-this.jpg - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /CFusionMX7/global/data/whatsnew.htm - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/images/fancybox/fancybox.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/images/btns/close.jpg - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /favicon.ico - - (b) (6), (b) (7)(C) Mozilla/4.0+
+chromeframe/5.0.317.0
(direct)|utmccn=(direct)|utmcmd=(none) - 200 1454 250
2011-12-05 (b) (7)(A) GET /energy_in_brief/images/thumbnails/elec_generators-thumb.jpg - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /energy_in_brief/images/thumbnails/cap-trade-thumb.jpg - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /energy_in_brief/images/thumbnails/world-oil-thumb.jpg - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /energy_in_brief/images/thumbnails/comparing-energy-consumption-thumb.jpg - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /energy_in_brief/images/thumbnails/high-voltage-thumb.jpg - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /energy_in_brief/images/Share-this.jpg - - (b) (6), (b) (7)(C) Mozilla/4.0+
__utma=165580587.18341550.1323102331.1323102331.1323102331.1;+__utmb=165580587.1.10.1323102331;+__utmc=165580587;+__utmz=165580587.1323102331.1.
2011-12-05 (b) (7)(A) GET /global/images/nav/es_over.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/images/icons/energy_kids.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /energy_in_brief/images/spacer.jpg - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /images/rss_icon.jpg - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /images-homepage/email-icon.jpg - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /energy_in_brief/images/HorizontalGrayFade.jpg - - (b) (6), (b) (7)(C) Mozilla/4.0+
2/16/2012
Page 3 of 8
2011-12-05 (b) (7)(A) GET /global/includes/eia_header_flat.htm - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /energy_in_brief/images/sqgreybullet.gif - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/images/fancybox/fancy_shadow_n.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/images/fancybox/fancy_shadow_ne.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/includes/eia_footer_flat.htm - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /energy_in_brief - - (b) (6), (b) (7)(C) Mozilla/4.0+
+chromeframe/5.0.317.0 - - 301 380 203
2011-12-05 (b) (7)(A) GET /global/images/logos/eia_logo_print.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/images/fancybox/fancy_shadow_e.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/images/btns/arrow_go.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/images/logos/eia_logo.jpg - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/images/fancybox/fancy_shadow_se.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/images/nav/es_off.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/images/fancybox/fancy_shadow_s.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/images/nav/topics_off.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/images/nav/geo_off.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
2/16/2012
Page 4 of 8
2011-12-05 (b) (7)(A) GET /global/images/fancybox/fancy_shadow_sw.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/images/nav/tools_dropdown.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/images/fancybox/fancy_shadow_w.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/images/nav/learn_dropdown.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/images/nav/topics_dropdown.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/images/nav/news_dropdown.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/images/nav/geo_dropdown.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/images/nav/tools_off.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/images/nav/es_dropdown.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/images/fancybox/fancy_shadow_nw.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/images/nav/news_off.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/images/nav/learn_off.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/images/nav/az_off.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /energy_in_brief/email-this-page.js - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /energy_in_brief/ - - (b) (6), (b) (7)(C) Mozilla/4.0+
+chromeframe/5.0.317.0 - - 200 22028 203
2011-12-05 (b) (7)(A) GET /styles/eia_footer.js - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /energy_in_brief - - (b) (6), (b) (7)(C) Mozilla/4.0+
+chromeframe/5.0.317.0 - - 301 380 203
2011-12-05 (b) (7)(A) GET /CFIDE/scripts/masks.js - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/images/icons/arrow_gr_r.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /CFIDE/scripts/cfform.js - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/images/icons/twitter.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
2/16/2012
Page 5 of 8
2011-12-05 (b) (7)(A) GET /global/images/icons/email.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/images/icons/rss.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/images/logos/eia_address.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/images/nav/a-z_dropdown.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /energy_in_brief/EIB.css - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /energy_in_brief/EIB-print.css - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /styles/eia_sitewideF.css - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /energy_in_brief/bookmarks.js - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /energy_in_brief/email-this-page.js - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /energy_in_brief/ - - (b) (6), (b) (7)(C) Mozilla/4.0+
+chromeframe/5.0.317.0 - - 200 22028 187
2011-12-05 (b) (7)(A) GET /CFIDE/scripts/masks.js - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /energy_in_brief/EIB.css - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /styles/eia_footer.js - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /CFIDE/scripts/cfform.js - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /energy_in_brief/EIB-print.css - - (b) (6), (b) (7)(C) Mozilla/4.0+
2/16/2012
Page 6 of 8
2011-12-05 (b) (7)(A) GET /energy_in_brief/images/thumbnails/RPS-EIB-thumb.jpg - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /styles/eia_sitewideF.css - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /images-homepage/email-icon.jpg - - (b) (6), (b) (7)(C) Mozilla/4.0+
__utma=165580587.968129143.1323102333.1323102333.1323102333.1;+__utmb=165580587.1.10.1323102333;+__utmc=165580587;+__utmz=165580587.1323102333.1
2011-12-05 (b) (7)(A) GET /images/rss_icon.jpg - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /energy_in_brief/images/spacer.jpg - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /energy_in_brief/images/HorizontalGrayFade.jpg - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /energy_in_brief/images/sqgreybullet.gif - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/includes/eia_footer_flat.htm - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/images/logos/eia_logo_print.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
2/16/2012
Page 7 of 8
2011-12-05 (b) (7)(A) GET /global/images/btns/arrow_go.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/images/logos/eia_logo.jpg - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/images/nav/es_off.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/images/nav/topics_off.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/images/nav/learn_dropdown.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/images/nav/tools_dropdown.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/images/nav/geo_off.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/images/nav/topics_dropdown.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/images/nav/news_dropdown.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
2/16/2012
Page 8 of 8
2011-12-05 (b) (7)(A) GET /global/images/nav/es_dropdown.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/images/nav/tools_off.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/images/nav/a-z_dropdown.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
2011-12-05 (b) (7)(A) GET /global/images/nav/news_off.png - - (b) (6), (b) (7)(C) Mozilla/4.0+
__utma=165580587.968129143.1323102333.1323102333.1323102333.1;+__utmb=165580
Attachment: ex111205.www2.2011.12.05.16.[23].to[4][0-2].log.filtered.with.(b) (6), (b) (7)(C) zip (182.47 KB)
2/16/2012
Page 1 of 1
Ticket TICK:59561
Title:
Type:
Action:
Status:
Priority:
Technician:
Asset:
Due Date:
CC List:
Created:
Modified:
Submitter:
See Also:
Referrers:
Resolution:
block (b) (6), (b) (7)(C)

Single IP
Block
Requested
Medium
Netscaler
None
None
2011/12/22 08:52:10
2011/12/22 08:52:36
None
None
None

Owners
Only:
Ticket Created
please block (b) (6), (b) (7)(C) it is attacking EIA.gov

Amsterdam
(b) (7)
(b)
The (b) (6), (b) (7)(C) IP address hit www2 (A) times in a (7)
second
(A) (b)
(b)
(7) am),
period this morning (12/21/11 - 4:13:(7)
am
through
4:13:
(A)
(A)
(b) (7)
(b) (7)
(A)
(A)
and
times in the second period starting then. Also, I noticed
that the Referer is (b) (6), (b) (7)(C)
which according
to my lookups is a non-existant domain. The traffic itself did not
appear to be malicious, but I would like to have this IP blocked if
possible.
2/16/2012

DOE Letter and FOIA Release To CNBC

Încărcat de

Informații document

Titlu original

Drepturi de autor

Formate disponibile

Partajați acest document

Partajați sau inserați document

Opțiuni de partajare

Vi se pare util acest document?

Este necorespunzător acest conținut?

Drepturi de autor:

Formate disponibile

DOE Letter and FOIA Release To CNBC

Încărcat de

Drepturi de autor:

Formate disponibile

Page 1 of 4

Changed ticket Machine from "ma43969" to "Unassigned".

Machine "ma43969" was deleted.

Norris, Jonathan (CONTR) - 2011/02/02 12:36:51

From: (b)(6),(b)(7)(C) [mailto(b)(6),(b)(7)(C)

"Lead, Follow, or Get Out Of The Way..."

Norris, Jonathan (CONTR) - 2011/01/28 16:46:10

(b)(6),(b)(7)(C) Network Engineer (b) (7)(A)

(b)(6),(b)(7)(C) Fax: (b)(6),(b)(7)(C) (b)(6),(b)(7)(C)

"Norris, Jonathan (CONTR)" <Jonathan.Norris@eia.gov>

Luu, Quan (CONTR) - 2011/01/20 08:16:29

Added resolution text.

Norris, Jonathan (CONTR) - 2011/01/19 22:16:40

Norris, Jonathan (CONTR) - 2011/01/19 11:14:20

(b) (b) (7)(E)

Norris, Jonathan (CONTR) - 2011/01/19 11:11:12

Please Block (b)(6),(b)(7)(C)

Block (b)(6), (b)(7)(C)

Changed ticket Machine from "ma43969" to

Machine "ma43969" was deleted.

Luu, Quan (CONTR) - 2011/01/26 08:28:03

Added resolution text.

Norris, Jonathan (CONTR) - 2011/01/25 16:37:32

Changed ticket Owner from "Norris, Jonathan (CONTR)"

Norris, Jonathan (CONTR) - 2011/01/20 16:14:26

Changed ticket CC list from "" to "IRblocks@eia.gov".

Norris, Jonathan (CONTR) - 2011/01/20 16:13:10

Please Block Ip (b)(6), (b)(7)(C)

- - [20/Jan/2011:(b) (7)(A) -0500]

- - [20/Jan/2011:(b) (7)(A) -0500]

GET /ngs/blackberry.txt HTTP/1.0 503 1404 - - - [20/Jan/2011:(b) (7)(A) -0500]

- - [20/Jan/2011:(b) (7)(A) -0500]

GET /ngs/blackberry.txt HTTP/1.0 503 1404 - - - [20/Jan/2011:(b) (7)(A) -0500]

- - [20/Jan/2011:(b) (7)(A) -0500]

GET /ngs/blackberry.txt HTTP/1.0 503 1404 - - - [20/Jan/2011:(b) (7)(A) -0500]

- - [20/Jan/2011:(b) (7)(A) -0500]

Block (b)(6), (b)(7)(C)

Changed ticket Machine from "ma43969" to "Unassigned".

Machine "ma43969" was deleted.

Luu, Quan (CONTR) - 2011/01/26 08:26:58

Added resolution text.

Norris, Jonathan (CONTR) - 2011/01/25 16:37:11

Changed ticket Owner from "Norris, Jonathan (CONTR)" to

Norris, Jonathan (CONTR) - 2011/01/20 16:29:00

Please block IP (b)(6), (b)(7)(C)

- - [20/Jan/2011:(b) (7)(A) -0500] GET /ngs/ngs.html

Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; MS-RTC LM 8;

unBlock (b)(6), (b)(7)(C)

Changed ticket Machine from "ma43969" to "Unassigned".

Machine "ma43969" was deleted.

Luu, Quan (CONTR) - 2011/02/09 08:36:58

Changed ticket Status from "Requested" to "Completed".

Norris, Jonathan (CONTR) - 2011/02/04 11:42:22

Changed ticket Owner from "Norris, Jonathan (CONTR)" to

Norris, Jonathan (CONTR) - 2011/02/04 11:41:59

Changed ticket Title from "Block (b)(6), (b)(7)(C) to

From: (b)(6), (b)(7)(C)

requests per second.

Please let me know what to tell my team in regards to when we

Chief Technology Officer

Office: (b)(6), (b)(7)(C)

Chief Technology Officer

Office: (b)(6), (b)(7)(C)