Этот сайт использует файлы cookies. Продолжая просмотр страниц сайта, вы соглашаетесь с использованием файлов cookies. Если вам нужна дополнительная информация, пожалуйста, посетите страницу Политика файлов Cookie

Прямой эфир

Русский

English

Войти / Регистрация

Cryptocurrencies: 8427 / Markets: 114587

Market Cap: $ 2 416 187 059 395 / 24h Vol: $ 72 895 712 939 / BTC Dominance: 58.762801112455%

Н Новости

От сигнатур к ML IDS: чему IDS Suricata может научить модель?

В настоящее время для противодействия компьютерным атакам применяются разнообразные средства защиты информации:

межсетевые экраны;
системы обнаружения вторжений уровня сети;
системы обнаружения вторжений уровня хоста;
межсетевые экраны нового поколения (NGFW);
SIEM системы (также называемые – событийные системы обнаружения компьютерных атак);
криптографические средства защиты сетей связи;
и другие классы средств.

Каждое из перечисленных выше средств обладает своими достоинствами и недостатками, а выбор в применяемых средствах конкретной компанией зависит от разных причин: финансовых, инфраструктурных или других.

Системы обнаружения атак уровня сети

Основным способом выявления компьютерных атак остается применение сигнатурного анализа. Главным его недостатком является практически нулевая вероятность обнаружения новых или модифицированных деструктивных сетевых воздействий.

Следовательно, решение задачи обнаружения модифицированных и, желательно, новых компьютерных атак с использованием эвристических или интеллектуальных методов (ML IDS) является актуальной и перспективной.

Формулировки задачи построения ML IDS уровня сети:

Провести классификацию сетевого трафика, разделив его на 2 (или более) класса: «чистый» сетевой трафик и компьютерная атака (деструктивное воздействие). Если есть возможность, то класс компьютерных атак разбивают на подклассы и тогда можно говорить о много классовой классификации.
выявить аномалию (аномальное сетевое соединение / сетевую сессию / сетевой пакет) в сети связи.

Принципиальные отличия в формулировках задач построения ML IDS:

при построении классификатора сетевого трафика для обучения ML IDS требуется размеченный датасет, содержащий образцы (вектора признаков), принадлежащие всем распознаваемым классам, что в «реальной» жизни может быть затруднительно.
Некоторые причины затруднений формирования датасетов: владелец защищаемого ресурса может быть против того, чтобы атаковали его ресурс; невозможно создать точную модель защищаемого ресурса с необходимой инфраструктурой создать затруднительно; множество инструментов атак открытое и «хороший» датасет собрать сложно и другие причины;
при построении системы выявления аномалий исследователю известен только один вид трафика: "чистый" сетевой трафик, не содержащий признаков деструктивных воздействий.

Подробнее про процесс разработки ML IDS, а также атаках на ML IDS можно прочитать в статье "Состязательные атаки против системы обнаружения вторжений, основанной на применении методов машинного обучения".

В данной публикации пойдет речь о построении системы обнаружения вторжений уровня сети с использованием методов машинного обучения (далее ML IDS).

Попыток построить ML IDS уровня сети с использованием классификаторов достаточно много и в статьях результаты зачастую очень хорошие (например, "Синтез модели машинного обучения для обнаружения компьютерных атак на основе набора данных CICIDS2017").

Однако сами авторы признаются, что высокое качество классификации наблюдается исключительно на их стендах (инфраструктуре), там, где происходило обучение моделей, а их перенос на другие сети связи показывает более низкие результаты. Это связано с тем, что наиболее известные инструменты сбора и разметки сетевого трафика для ML IDS уровня сети формируют вектора признаков, содержащих признаки, непосредственно зависящие от физической структуры сети, в которой производился сбор сетевого трафика, настроек сетевого оборудования, а также конкретных реализаций сетевых сервисов. Отличия же в них приводят к возникновению ошибок классификатора и снижению точности модели.

О чем же эта статья?

В связи с вышесказанным у авторов статьи возникли вопросы:

можно ли построить ML IDS уровня сети на уже эксплуатируемой сети связи?
можно ли обучить ML IDS не атакуя защищаемый ресурс намеренно? Другими словами: можно ли обучить ML IDS опираясь на зарегистрированные классическими средствами обнаружения вторжений события (например, IDS Suricata)?
какие возникают при этом трудности?
какое при этом ожидать качество классификации?
какие при этом будут ограничения?

Для ответа на эти вопросы была выдвинута гипотеза о возможности построения ML IDS уровня сети с применением событий безопасности, зарегистрированных IDS Suricata, для разметки датасетов.

Для формирования векторов признаков сетевого трафика был разработан собственный инструмент расчета значений вектора признаков сетевого трафика для каждого сетевого соединения session_analyzer (в проведенном нами исследовании использовался только протокол TCP, в общем случае инструмент позволяет проводить анализ и других протоколов).

Необходимо отметить, что утилита session_analyzer – это аналог инструмента разметки сетевого трафика NTLFlowLyzer (https://github.com/ahlashkari/CICFlowMeter).

Описание процесса функционирования инструмента session_analyzer

Принципы формирования векторов признаков сетевого трафика, реализованный в утилите session_analyzer

Анализу подлежат все сетевые пакеты следующих сетевых протоколов: Ethernet II, MPLS, VLAN, IPv4, TCP, UDP, ICMPv4. Сетевые пакеты других протоколов канального, сетевого и транспортного уровня отбрасываются.
Идентификатором сетевой сессии (Flow ID) является символьная последовательность, состоящая из 5 компонент (5-Tuple): Destination IP-Source IP-Destination Port-Source Port-Proto.
Под сетевой сессией понимается последовательность сетевых пакетов принадлежащих одному TCP соединению, UDP потоку или последовательности ICMP пакетов (ICMP поток).
Идентификация принадлежности пакета к определенной сессии осуществляется по совпадению адресной информации 5-Tuple:
или Destination IP-Source IP-Destination Port-Source Port-Proto;
или Source IP- Destination IP- Source Port-Destination Port-Proto.
Критерий начала сетевой сессии:
– TCP сессия (соединение) регистрируется и для нее производится расчет вектора признаков только в том случае, если в наблюдаемой сессии первым пакетом был сетевой пакет с установленным флагом SYN=1 и флагом ACK = 0 в TCP пакете. По данному пакету определяется направление передачи данных (т.е. какой IP адрес считается источником (отправителем / клиентом) и какой IP адрес считается адресом назначения (сервером);
– UDP / ICMP сессия (поток) регистрируется при появлении первого сетевого пакета с новым идентификатором пакета. По первому пакету определяется направление (инициатор) передачи данных. При таком подходе возможна ошибка определения направления передачи данных (например, session_analyzer в начальный момент времени, сразу после своего запуска может увидеть первым и единственным пакетом DNS ответ, и данный пакет будет проанализирован).
Критерий окончания сетевой сессии:
– для любых сетевых сессий встроен таймаут, таймаут отсчитывается от последнего принятого пакета в сетевой сессии. В конфигурационных файлах задаются 3 таймаута, выраженных в миллисекундах.
Значения по умолчанию:
tcp_session_timeout = 60000 – для TCP сессий;
udp_session_timeout = 60000 – для UDP сессий;
icmp_session_timeout = 60000 – для ICMP пакетов, относящихся к одной сессии.
– дополнительно для TCP сессий отслеживаются пакеты разрыва TCP соединений, предусмотрены ожидание следующих сценариев разрыва соединений:
сценарий 1: клиент или сервер присылает пакет с установленным флагом RST, после такого пакета сессия считается закрытой;
сценарий 2: клиент является инициатором разрыва соединения и посылает пакет с установленным флагом FIN, тогда возможны 2 варианта ответа от сервера:
– если сервер присылает пакет с установленным флагом RST, то сессия считается закрытой;
– если анализатор получает пакет от клиента или сервера с установленным флагом FIN, то анализатор запускает стандартный механизм отслеживания подтверждения получения данных (SeqNumber и AсkNumber) для двух сторон взаимодействия, после подтверждения (установленный файл ACK) обоими сторонами получения пакетов с установленными флагами FIN сессия считается закрытой.
Поток (в названиях признаков – Flow) сетевых пакетов – это строгая (т.е. важен порядок следования) последовательность сетевых пакетов, которые принимает анализатор в рамках одной сетевой сессии. Очевидно, что в данном случае направление передачи данных не учитывается.
Поток сетевых пакетов в направлении Forward (в названиях признаков – Fwd) – это строгая последовательность сетевых пакетов, передаваемых от клиента к серверу, в рамках одной сетевой сессии.
Поток сетевых пакетов в направлении Backward (в названиях признаков – Bwd) – это строгая последовательность сетевых пакетов, передаваемых от сервера к клиенту, в рамках одной сетевой сессии.
Длительность сетевой сессии может быть рассчитана 2 способами:
– от времени первого пакета в сетевой сессии до времени поступления последнего пакета в сетевой сессии (параметр в конфигурационном файле: is_need_calc_duration_by_last_payload = false);
– от времени первого пакета в сетевой сессии до времени поступления последнего пакета с полезными данными (где длина payload > 0) в сетевой сессии (параметр в конфигурационном файле: is_need_calc_duration_by_last_payload = true).
Для оценки «единственности / независимости» текущей сетевой сессии было введено понятие потока сетевых сессий от заданного источника сессий на заданный сетевой ресурс – это множество сетевых сессий созданных между одним хостом (Source IP) и заданным сетевым сервисом (Destination IP + Destination Port + Proto). Т.е. идентификатором потока сетевых сессии является число сформированная конкатенацией четырех чисел:
stream_id = IP-Source | IP-Destination | Port- Destination | Proto.
Для описания «единственности / независимости» текущей сетевой сессии используются различные признаки, которые характеризуют:
– наличие параллельных сетевых сессии для текущего потока сетевых сессии;
– время возникновения текущей сетевой сессии по сравнению с параллельными сетевыми сессиями для данного потока сессий;
– время между появлениями сетевых сессии для данного потока сессий.
Множество признаки данной группы в названиях содержат слово Stream.
Сетевые сессии в потоке считаются «независимыми» – это время между созданием сетевых сессий в потоке превышает заданный порог session_simple_timeout.
По умолчанию, session_simple_timeout = 60000000 микросекунд.
Временной интервал между текущей сессий и предыдущей сессией в потоке сетевых сессий ограничен порогом session_time_prev_absent, если текущая сессия является первой в потоке сессий или время ее создания превышает session_time_prev_absent, то значение соответствующего признака выставляется равным session_time_prev_absent.
По умолчанию, session_time_prev_absent = 60000000 микросекунд.
Временной интервал между текущей сессий и следующей сессией (если такое время можно измерить, т.е. новая сессия создана раньше времени окончания текущей в потоке сессий) в потоке сетевых сессий также ограничен порогом session_time_next_absent, если текущая сессия является последней в потоке сессий или время создания следующей сессии превышает session_time_next_absent, то значение соответствующего признака выставляется равным session_time_next_absent.
По умолчанию, session_time_next_absent = 60000000 микросекунд.
Значения признаков, характеризующих последовательность сетевых пакетов относящихся к одной сетевой сессии, могут быть рассмотрены как случайная величина. Для такой случайной величины рассчитываются следующие характеристики: количество значений в последовательности, минимальной и максимальное значение случайной величины, оценка математического ожидания, несмещенная оценка дисперсии случайной величины и несмещенная оценка среднеквадратичного отклонения случайной величины (таблица 1).
Для описания каждой сетевой сессии формируется вектор из 118 признаков (ниже представлено их описание). Названия ряда нижеперечисленных признаков взяты из перечня признаков инструмента CICFlowMeter, при расчете значений признаков были учтены недостатки, выявленные нами и указанные в статье: "Я больше не верю публичным датасетам".

Расчет значений вектора признаков сетевого трафика, реализованный в утилите session_analyzer

Для расчета некоторых характеристик случайной величины, при классическом способе расчета, необходимо хранить все значения последовательности, для же экономии памяти можно использовать алгоритмы online математики (метод Уэлфорда для расчета оценок математического ожидания, несмещенной оценки дисперсии и несмещенной оценки среднеквадратичного отклонения случайной величины).

Перечень характеристик случайной величины и выражения для из расчета.

Количество значений в последовательности. Сокращение (префикс) добавляемый к названию признака – Count.
Минимальное значение случайной величины в последовательности. Сокращение (префикс) добавляемый к названию признака – Min.
Максимальное значение случайной величины в последовательности. Сокращение (префикс) добавляемый к названию признака – Max.
Оценка математического ожидания случайной величины. Сокращение (префикс) добавляемый к названию признака – Mean.
Классический способ расчета:
$Mean={1\over n}*\displaystyle\sum_{i=1}^n{x_i}$
Online способ расчета:
$Mean_0=0; Mean_i = Mean_{i-1}+{(x_i-Mean_{i-1})\over Count}$
Несмещенная оценка дисперсии случайной величины. Сокращение (префикс) добавляемый к названию признака – Variance.
Классический способ расчета:
$Variance={1\over {n-1}}*\displaystyle\sum_{i=1}^n{{(x_i-Mean)^2}}$
Online способ расчета:
$Var_i=Var_{i-1}+(x_i-Mean_{i-1})*(x_i-Mean_i);$ $При Count>1: Variance={Var_i \over Count}$
Несмещенная оценка среднеквадратичного отклонения случайной величины. Сокращение (префикс) добавляемый к названию признака – Std.

$Std=\sqrt{Variance}$

Описание признаков, характеризующих сетевые сессии

№ п/п	Обозначение признака в наборе данных	Описание	Тип данных, пример
1.	Session Index	Индекс сессии	Целое число, 0
2.	SNI	Server Name Indication. Имя сервера, указанное в пакете ClientHello протокола TLS/SSL	Символьная строка, dvwa.isp
3.	Flow ID	Идентификатор сессии	Символьная строка, 172.18.0.2-85.249.84.244-443-41782-6
4.	Source IP	IP адрес источника сетевой сессии	Символьная строка, 85.249.84.244
5.	Source Port	Port транспортного уровня источника сетевой сессии	Целое 16-битное число, 41782
6.	Destination IP	IP адрес назначения сетевой сессии	Символьная строка, 172.18.0.2
7.	Destination Port	Port транспортного уровня назначения сетевой сессии	Целое 16-битное число, 443
8.	Protocol	Протокол транспортного уровня, может принимать следующие значения: 1 – ICMP, 6 – TCP, 17 – UDP	Целое 8 битное число, 6
9.	Timestamp	Метка времени, формат метки: число.месяц.год час:мин.микросекунды	Символьная строка, 16.11.2021 11:41
10.	Flow Duration	Длительность сессии в микросекундах	Целое 64-битное число, 9772334
11.	Total Fwd Packets	Количество сетевых пакетов, переданных в направлении от клиента к серверу	Целое 64-битное число, 13
12.	Total Backward Packets	Количество сетевых пакетов, переданных в направлении от сервера к клиенту	Целое 64-битное число, 11
13.	Total Length of Fwd Packets	Суммарная длина полезных данных (payload) в байтах, переданных от клиента к серверу	Целое 64-битное число, 1929
14.	Total Length of Bwd Packets	Суммарная длина полезных данных (payload) в байтах, переданных от сервера к клиенту	Целое 64-битное число, 3695
Статистические характеристики длин передаваемых полезных данных (payload) в направлении Forward (от клиента к серверу), в байтах
15.	Fwd Packet Length Max	Максимальная длина пакета	Целое 64-битное число, 672
16.	Fwd Packet Length Min	Минимальная длина пакета	Целое 64-битное число, 0
17.	Fwd Packet Length Mean	Оценка математического ожидания длин пакетов (средняя длина пакета)	Вещественное число, 148.38461538
18.	Fwd Packet Length Std	Несмещенная оценка среднеквадратичного отклонения длин пакетов	Вещественное число, 262.28341492
Статистические характеристики длин передаваемых полезных данных (payload) в направлении Backward (от сервера к клиенту), в байтах
19.	Bwd Packet Length Max	Максимальная длина пакета	Целое 64-битное число, 1415
20.	Bwd Packet Length Min	Минимальная длина пакета	Целое 64-битное число, 0
21.	Bwd Packet Length Mean	Оценка математического ожидания длин пакетов (средняя длина пакета)	Вещественное число, 335.90909091
22.	Bwd Packet Length Std	Несмещенная оценка среднеквадратичного отклонения длин пакетов	Вещественное число, 539.65793880
23.	Flow Bytes/s	Отношение суммарной длины переданных полезных данных (payload) (в байтах) к длительности сетевой сессии (в секундах). Длительность сетевой сессии может быть рассчитана 2 способами см. п. 10	Вещественное число, 575.50222905
24.	Flow Packets/s	Отношение общего количества сетевых пакетов в сетевой сессии к длительности сетевой сессии (в секундах). Длительность сетевой сессии может быть рассчитана 2 способами см. п. 10.	Вещественное число, 2.45591278
Статистические характеристики межпакетных интервалов в потоке сетевых пакетов Flow (без учета направления передачи данных), первый пакет сетевой сессии считается началом отсчета времени, первое значение межпакетного интервала рассчитывается при получении второго пакета (не зависимо от направления передачи данных). Межпакетные интервалы измеряются в микросекундах
25.	Flow IAT Mean	Оценка математического ожидания межпакетных интервалов	Вещественное число, 424884.0869565
26.	Flow IAT Std	Несмещенная оценка среднеквадратичного отклонения межпакетных интервалов	Вещественное число, 1349427.122279
27.	Flow IAT Max	Максимальное значение межпакетного интервала	Целое 64-битное число, 4952858
28.	Flow IAT Min	Минимальное значение межпакетного интервала	Целое 64-битное число, 17
Статистические характеристики межпакетных интервалов в потоке сетевых пакетов Forward (от клиента к серверу), первый пакет в направлении Forward считается началом отсчета времени, первое значение межпакетного интервала рассчитывается при получении второго пакета в направлении Forward. Межпакетные интервалы измеряются в микросекундах
29.	Fwd IAT Total	Суммарное значение всех межпакетных интервалов в направлении Forward	Целое 64-битное число, 9772334
30.	Fwd IAT Mean	Оценка математического ожидания межпакетных интервалов в направлении Forward	Вещественное число, 814361.166667
31.	Fwd IAT Std	Несмещенная оценка среднеквадратичного отклонения межпакетных интервалов в направлении Forward	Вещественное число, 1827899.8492
32.	Fwd IAT Max	Максимальное значение межпакетного интервала в направлении Forward	Целое 64-битное число, 5003029
33.	Fwd IAT Min	Минимальное значение межпакетного интервала в направлении Forward	Целое 64-битное число, 255
Статистические характеристики межпакетных интервалов в потоке сетевых пакетов Backward (от сервера к клиенту), первый пакет в направлении Backward считается началом отсчета времени, первое значение межпакетного интервала рассчитывается при получении второго пакета в направлении Forward
34.	Bwd IAT Total	Суммарное значение всех межпакетных интервалов в направлении Backward	Целое 64-битное число, 5247374
35.	Bwd IAT Mean	Оценка математического ожидания межпакетных интервалов в направлении Backward	Вещественное число, 524737.4
36.	Bwd IAT Std	Несмещенная оценка среднеквадратичного отклонения межпакетных интервалов в направлении Backward	Вещественное число, 1573943.9826
37.	Bwd IAT Max	Максимальное значение межпакетного интервала в направлении Backward	Целое 64-битное число, 5002839
38.	Bwd IAT Min	Минимальное значение межпакетного интервала в направлении Backward	Целое 64-битное число, 237
39.	Fwd Header Length	Суммарная длина заголовков транспортного уровня (TCP / UDP) при передаче данных в направлении Forward (от клиента к серверу)	Целое 64-битное число, 424
40.	Bwd Header Length	Суммарная длина заголовков транспортного уровня (TCP / UDP) при передаче данных в направлении Backward (от сервера к клиенту)	Целое 64-битное число, 360
41.	Fwd Packets/s	Отношение общего количества сетевых пакетов, переданных в направлении Forward (от клиента к серверу), к длительности сетевой сессии (в секундах). Длительность сетевой сессии может быть рассчитана 2 способами см. п. 10.	Вещественное число, 1.33028609
42.	Bwd Packets/s	Отношение общего количества сетевых пакетов, переданных в направлении Backward (от сервера к клиенту), к длительности сетевой сессии (в секундах). Длительность сетевой сессии может быть рассчитана 2 способами см. п. 10.	Вещественное число, 1.12562669
Статистические характеристики длин передаваемых полезных данных (payload) без учета направления передачи данных, в байтах
43.	Min Packet Length	Минимальная длина пакета	Целое 64-битное число, 0
44.	Max Packet Length	Максимальная длина пакета	Целое 64-битное число, 1415
45.	Packet Length Mean	Оценка математического ожидания длин пакетов (средняя длина пакета)	Вещественное число, 234.3333
46.	Packet Length Std	Несмещенная оценка среднеквадратичного отклонения длин пакетов	Вещественное число, 414.27492097
47.	Packet Length Variance	Несмещенная оценка дисперсии длин пакетов	Вещественное число, 171623.7101
48.	Average Packet Size	Оценка математического ожидания длин пакетов (средняя длина пакета). Данный признак повторяется и равен значению Packet Length Mean	Вещественное число, 234.3333
Количество сетевых пакетов, переданных в направлении Forward (от клиента к серверу), содержащих заданный флаг равный 1 в заголовке TCP пакета
49.	Fwd FIN Flags	FIN = 1	Целое 64-битное число, 0
50.	Fwd SYN Flags	SYN = 1	Целое 64-битное число, 1
51.	Fwd RST Flags	RST = 1	Целое 64-битное число, 1
52.	Fwd PSH Flags	PSH = 1	Целое 64-битное число, 4
53.	Fwd ACK Flags	ACK = 1	Целое 64-битное число, 12
54.	Fwd URG Flags	URG = 1	Целое 64-битное число, 0
55.	Fwd ECE Flags	ECE = 1	Целое 64-битное число, 0
56.	Fwd CWR Flags	CWR = 1	Целое 64-битное число, 0
57.	Fwd NS Flags	NS = 1	Целое 64-битное число, 0
Количество сетевых пакетов, переданных в направлении Backward (от сервера к клиенту), содержащих заданный флаг равный 1 в заголовке TCP пакета
58.	Bwd FIN Flags	FIN = 1	Целое 64-битное число, 1
59.	Bwd SYN Flags	SYN = 1	Целое 64-битное число, 1
60.	Bwd RST Flags	RST = 1	Целое 64-битное число, 0
61.	Bwd PSH Flags	PSH = 1	Целое 64-битное число, 5
62.	Bwd ACK Flags	ACK = 1	Целое 64-битное число, 11
63.	Bwd URG Flags	URG = 1	Целое 64-битное число, 0
64.	Bwd ECE Flags	ECE = 1	Целое 64-битное число, 0
65.	Bwd CWR Flags	CWR = 1	Целое 64-битное число, 0
66.	Bwd NS Flags	NS = 1	Целое 64-битное число, 0
67.	Stream Session Number	Номер сетевой сессии	Целое 64-битное число, 0
68.	Stream Was Prev Session	Есть ли предыдущая сетевая сессия в потоке?	Целое 8-битное число, 0
69.	Stream Was Next Session	Есть ли следующая сетевая сессия после текущей в потоке?	Целое 8-битное число, 1
70.	Stream Prev Session Time	Время в микросекундах между созданием текущей сетевой сессии и предыдущей сетевой сессией. Ограничение значения данного признака описано в п.12.	Целое 64-битное число, 60000000
71.	Stream Next Session Time	Время в микросекундах между созданием следующей и текущей сетевой сессии. Ограничение значения данного признака описано в п.13.	Целое 64-битное число, 218
72.	Stream Sessions On Start	Число параллельных сетевых сессий в потоке сетевых сессий на момент создания текущей сессии (значение включает текущую сессию)	Целое 64-битное число, 1
73.	Stream Sessions On Close	Число параллельных сетевых сессий в потоке сетевых сессий на момент окончания текущей сессии (значение включает текущую сессию)	Целое 64-битное число, 2
74.	Stream Sessions Max	Максимальное число параллельных сетевых сессий за время существования текущей сетевой сессии (значение включает текущую сессию)	Целое 64-битное число, 3
Статистические характеристики интервалов между созданием сетевых сессий в потоке сессий в микросекундах
75.	Stream Session Intervals Min	Минимальное значение интервала между сетевыми сессиями в потоке	Целое 64-битное число, 218
76.	Stream Session Intervals Max	Максимальное значение интервала между сетевыми сессиями в потоке	Целое 64-битное число, 9769550
77.	Stream Session Intervals Mean	Оценка математического ожидания значения интервала между сетевыми сессиями в потоке (среднее значение интервала между сетевыми сессиями в потоке)	Вещественное число, 4884884.0
78.	Stream Session Intervals Std	Несмещенная оценка среднеквадратичного отклонения значения интервала между сетевыми сессиями в потоке	Вещественное число, 6907960.905
Статистические характеристики длительностей сетевых сессий в потоке сессий в микросекундах
79.	Stream Session Durations Min	Минимальная длительность сетевой сессии в потоке	Целое 64-битное число, 9771073
80.	Stream Session Durations Max	Максимальная длительность сетевой сессии в потоке	Целое 64-битное число, 9772334
81.	Stream Session Durations Mean	Оценка математического ожидания длительностей сетевых сессии (средняя длительность сетевой сессии в потоке)	Вещественное число, 9771703.5
82.	Stream Session Durations Std	Несмещенная оценка среднеквадратичного отклонения длительностей сетевых сессии	Вещественное число, 891.66165108
83.	Stream Prev Session Time/Duration	Отношение времени в микросекундах между созданием текущей сетевой сессии и предыдущей сетевой сессией к длительности текущей сетевой сессии	Вещественное число, 6.13978196
84.	Stream Next Session Time/Duration	Отношение времени в микросекундах между созданием следующей и текущей сетевой сессии к длительности текущей сетевой сессии	Вещественное число, 0.00002231
85.	Stream Session Intervals Min/Duration	Отношение минимального значения интервала между сетевыми сессиями в потоке к длительности текущей сетевой сессии	Вещественное число, 0.00002231
86.	Stream Session Intervals Max/Duration	Отношение максимального значения интервала между сетевыми сессиями в потоке к длительности текущей сетевой сессии	Вещественное число, 0.99971511
87.	Stream Session Intervals Mean/Duration	Отношение среднего значения интервала между сетевыми сессиями в потоке к длительности текущей сетевой сессии	Вещественное число, 0.49986871
88.	Stream Session Intervals Std/Duration	Отношение среднеквадратичного отклонения значения интервала между сетевыми сессиями в потоке к длительности текущей сетевой сессии	Вещественное число, 0.70688956
89.	Stream Session Durations Min/Duration	Отношение минимальной длительности сетевой сессии в потоке к длительности текущей сетевой сессии	Вещественное число, 0.99987096
90.	Stream Session Durations Max/Duration	Отношение максимальной длительности сетевой сессии в потоке к длительности текущей сетевой сессии	Вещественное число, 1.0
91.	Stream Session Durations Mean/Duration	Отношение среднего значения длительности сетевой сессии в потоке к длительности текущей сетевой сессии	Вещественное число, 0.9999
92.	Stream Session Durations Std/Duration	Отношение среднеквадратичного отклонения длительности сетевых сессий в потоке к длительности текущей сетевой сессии	Вещественное число, 0.00009124
Статистические характеристики мгновенных значений скорости передачи данных (учитывается длина полного пакета со всеми заголовками), выраженной в байтах в сек, в направлении Forward (от клиента к серверу)
93.	Fwd Bandwidth Min	Минимальное значение мгновенной скорости	Целое 64-битное число, 13
94.	Fwd Bandwidth Max	Максимальное значение мгновенной скорости	Целое 64-битное число, 2894117
95.	Fwd Bandwidth Mean	Оценка математического ожидания значений мгновенной скорости	Вещественное число, 322671.75
96.	Fwd Bandwidth Std	Несмещенная оценка среднеквадратичного отклонения значений мгновенной скорости	Вещественное число, 845316.235
Статистические характеристики мгновенных значений скорости передачи данных (учитывается длина полного пакета со всеми заголовками), выраженной в байтах в сек, в направлении Backward (от сервера к клиенту)
97.	Bwd Bandwidth Min	Минимальное значение мгновенной скорости	Целое 64-битное число, 19
98.	Bwd Bandwidth Max	Максимальное значение мгновенной скорости	Целое 64-битное число, 929922
99.	Bwd Bandwidth Mean	Оценка математического ожидания значений мгновенной скорости	Вещественное число, 234621.6
100.	Bwd Bandwidth Std	Несмещенная оценка среднеквадратичного отклонения значений мгновенной скорости	Вещественное число, 292243.2465
101.	Fwd Total Length div Duration	Отношение суммарной длина полезных данных (payload) в байтах, переданных от клиента к серверу, к длительности сессии	Вещественное число, 0.00019739
102.	Bwd Total Length div Duration	Отношение суммарной длина полезных данных (payload) в байтах, переданных от сервера к клиенту, к длительности сессии	Вещественное число, 0.00037811
Статистические характеристики межпакетных интервалов в потоке сетевых пакетов Forward (от клиента к серверу) на этапе установления соединения TCP, первый пакет в направлении Forward считается началом отсчета времени, первое значение межпакетного интервала рассчитывается при получении второго пакета в направлении Forward
103.	Fwd IAT Total HandShake	– суммарное значение всех межпакетных интервалов в направлении Forward	Целое 64-битное число, 9130
104.	Fwd IAT Mean HandShake	– оценка математического ожидания межпакетных интервалов в направлении Forward	Вещественное число, 9130.0
105.	Fwd IAT Std HandShake	– несмещенная оценка среднеквадратичного отклонения межпакетных интервалов в направлении Forward	Вещественное число, 0.0
106.	Fwd IAT Max HandShake	– максимальное значение межпакетного интервала в направлении Forward	Целое 64-битное число, 9130
107.	Fwd IAT Min HandShake	– минимальное значение межпакетного интервала в направлении Forward	Целое 64-битное число, 9130
Статистические характеристики межпакетных интервалов в потоке сетевых пакетов Backward (от сервера к клиенту) на этапе установления соединения TCP, первый пакет в направлении Backward считается началом отсчета времени, первое значение межпакетного интервала рассчитывается при получении второго пакета в направлении Backward
108.	Bwd IAT Total HandShake	– суммарное значение всех межпакетных интервалов в направлении Backward	Целое 64-битное число, 0
109.	Bwd IAT Mean HandShake	– оценка математического ожидания межпакетных интервалов в направлении Backward	Вещественное число, 0
110.	Bwd IAT Std HandShake	– несмещенная оценка среднеквадратичного отклонения межпакетных интервалов в направлении Backward	Вещественное число, 0
111.	Bwd IAT Max HandShake	– максимальное значение межпакетного интервала в направлении Backward	Целое 64-битное число, 0
112.	Bwd IAT Min HandShake	– минимальное значение межпакетного интервала в направлении Backward	Целое 64-битное число, 0
Статистические характеристики межпакетных интервалов в сетевой сессии без учета направления передачи пакетов (от сервера к клиенту) на этапе установления соединения TCP, первый пакет в сетевой сессии считается началом отсчета времени, первое значение межпакетного интервала рассчитывается при получении второго пакета
113.	Flow IAT Total HandShake	Суммарное значение всех межпакетных интервалов	Целое 64-битное число, 9130
114.	Flow IAT Mean HandShake	Оценка математического ожидания межпакетных интервалов	Вещественное число, 4565.0
115.	Flow IAT Std HandShake	Несмещенная оценка среднеквадратичного отклонения межпакетных интервалов	Вещественное число, 6380.932
116.	Flow IAT Max HandShake	Максимальное значение межпакетного интервала	Целое 64-битное число, 9077
117.	Flow IAT Min HandShake	Минимальное значение межпакетного интервала	Целое 64-битное число, 53
118.	Http Reqest	Http запрос, который был отправлен на сервер	Символьная строка

Исходные данные исследования

Для проведения эксперимента был развернут стенд на базе одной из известных компаний РФ и проведен натурный эксперимент.

В состав стенда входят два сервера, на которые заведен один и тот же сетевой трафик компании. Данный трафик включает в себя как обмен между пользователями компании (порядка 200 пользователей, выполняющих различные задачи в рамках своих должностных функций), так и выход сотрудников в сеть Интернет.

При этом:

на первом сервере развернут сертифицированный NGFW, в состав которого входит система обнаружения вторжений уровня сети с актуальными решающими правилами (сигнатуры регулярно обновлялись, в том числе в процессе постановки эксперимента). Ядром данной системы обнаружения вторжений является модифицированная IDS Suricata (далее и будет применяться сокращение IDS Suricata);
на втором сервере развернута разработанная нами утилита session_analyzer, на вход которой поступал тот же самый сетевой трафик, что и на IDS Suricata.

Такая схема сбора и анализа сетевого трафика была выбрана по нескольким причинам:

функционирование NGFW и session_analyzer в общем случае является весьма затратной темой (повышенные требования к производительности серверов);
совмещение ML IDS c NGFW – это отдельная сложная и финансово затратная задача, требующая задействования команды разработчиков;
хотелось провести предварительные исследования «малой кровью» и ответить на вопросы, поставленные в публикации, а также выявить «подводные камни» перед внедрением ML IDS уровня сети в NGFW (в том числе, ответить на вопрос: стоит ли вообще внедрять ML IDS уровня сети в NGFW?).

Процесс преобразования данных от чтения сетевого трафика до формирования итогового датасета

Предварительное преобразование csv файла session_analyzer:

из всего множества рассчитываемых признаков извлекается только адресная информация и 10 значимых признаков: columns_x = ['Average Packet Size', 'Flow Bytes/s', 'Max Packet Length', 'Fwd Packet Length Mean', 'Fwd IAT Min', 'Total Length of Fwd Packets', 'Fwd IAT Std', 'Flow IAT Mean', 'Fwd Packet Length Max','Fwd Header Length'];
добавляются 3 колонки:
Label – метка класса (может принимать 2 значения: Benign или Attack);
Origin – источник информации о метке класса (может принимать 2 значения: «session» или «suricata»);
Sid - идентификатор события (в данном случае sid события IDS Suricata или 0, если вектор признаков «чистый» трафик).
В дальнейшем, при обучении ML IDS всем «чистым» векторам будет присвоено численное значение 0 (негативное решение классификатора), атакам – численное значение 1 (позитивное решение классификатора).
проводится сопоставление векторов признаков с зарегистрированными событиями безопасности IDS Suricata и размечается датасет.

Важно! Множество из 10 значимых признаков выбрано на основе исследования, результаты которого представлены в статье "Синтез модели машинного обучения для обнаружения компьютерных атак на основе набора данных CICIDS2017".

Особенности процесса сопоставления векторов признаков с зарегистрированными событиями безопасности IDS Suricata

В общем случае утилиты IDS Suricata и session_analyzer могут быть расположены на разных, физически разнесенных, серверах (как в нашем случае) – это означает, что:

Один и тот же трафик поступает на вход двух утилит в разное время. Эксперименты показали, что разница может составлять несколько мили секунд для двух серверов стоящих в одной стойке рядом друг с другом.
В отдельных случаях может быть такое, что трафик, поступающий на вход утилит анализа, может различаться. Например, в случае, если администратор сети решит «перестраховаться» и на вход одной из утилит попадает трафик, который принимают в двух точках: до шлюза компании и после шлюза, а на вход другой утилиты поступает трафик только с одной точки наблюдения.
В таком случае, при разметке датасета (сопоставлении векторов признаков с зарегистрированными событиями безопасности IDS Suricata), необходимо предусмотреть, что для одного и того же потока данных может быть 2 сетевых соединения (до шлюза и после шлюза). У таких «одинаковых» сетевых соединений будет различаться адресная информации (вступают в силу механизмы трансляции ip адресов и перенаправления портов транспортного уровня). В нашем случае, оказалось, что на session_analyzer поступает трафик с двух точек наблюдения – до и после шлюза компании.
Пример случая, когда одному и тому же сетевому трафику соответствуют два сетевых соединения (до и после шлюза)
Этим двум соединениям до и после шлюза соответствует событие IDS Suricata (лишние поля вырезаны):
2028762,"ET JA3 Hash - [Abuse.ch] Possible Trickbot", "2025-06-27 13:49:45.207703", "TCP", "10.180.180.6", 58557, "81.88.82.245", 443
Время регистрации событий IDS Suricata (время зарегистрированной компьютерной атаки) и время соответствующего соединения (или же даже 2-х соединений) в session_analyzer различные.
Это связано с тем, что в session_analyzer (и аналогичных утилитах) время, указанное в векторе признаков, характеризующих сетевое соединение, измеряется по первому сетевому пакету в потоке данных. В отличии от этого, в IDS Suricata (или других системах обнаружения компьютерных атак уровня сети) время компьютерной атаки обычно соответствует времени пакета, на котором произошло срабатывание анализатора. Эксперименты показали, что для некоторых сетевых атак на практике разница времени между двумя утилитами может превышать 20 секунд (гипотетически для медленной атаки – это время может быть еще больше).

Cбор сетевого трафика и предварительная обработка данных

Сбор и предварительная обработка сетевого трафика выполнялись в несколько этапов.

На 1 этапе две недели с 2025-06-26 по 2025-07-10 параллельно функционировали IDS Suricata и session_analyzer.

Результатом этого этапа стали 2 файла:

лог с зарегистрированными компьютерными атаками IDS Suricata;
лог с векторами признаков всех сетевых соединений сформированный session_analyzer за указанный период времени (каждая строчка лога представляет собой вектор значений признаков соединения и содержит 119 колонок);

На 2 этапе из лога IDS Suricata были извлечены все ip адреса, которые фигурировали в зарегистрированных событиях и из лога session_analyzer были удалены все строки, которые содержали ip адреса не встречающиеся в логах IDS Suricata (по факту в нашем случае – это примерно 25% всех соединений).

В итоге осталось 55548971 сетевых соединений (векторов, характеризующих каждое соединение).

На 3 этапе из лога session_analyzer убрали все лишние столбцы (признаки). Для этого в логе session_analyzer в каждом векторе с описанием сетевых соединений отставили только адресную информацию (время начала соединения и 5-tuple: ip адреса + порты транспортного уровня + номер протокола транспортного уровня) и 10 информативных признаков для синтеза ML модели;

На 4 этапе провели сопоставление двух логов: IDS Suricata и session_analyzer для того, чтобы каждому вектору, характеризующему сетевые соединения указать метку класса: Benign («чистый» трафик) и Attack (компьютерная атака). При этом, была разработана утилита сопоставления, учитывающая все особенности приема сетевого трафика, которые были описаны выше.

Фрагмент итогового размеченного датасета

Таким образом, после предварительной обработки данных и сопоставления 2-х логов датасет содержит 55548971 строк, при этом векторов чистого трафика (Benign) = 55491506, векторов компьютерных атак (Attack) = 57465.

Множество атак содержит 111 различных sid. В таблице ниже представлены атаки и их количество (атаки, которые за весь период наблюдения встречались 1 раз из таблицы убраны).

№ п/п	sid	Описание	Коли-чество
1.	1006217	HolaVPN detected	11988
2.	1006215	HolaVPN detected	11550
3.	1006221	HolaVPN detected	7908
4.	2028762	ET JA3 Hash - [Abuse.ch] Possible Trickbot	7102
5.	1003187	Anonymizer detected	7081
6.	2060504	ET INFO Observed Discord Service Domain (gateway .discord .gg) in TLS SNI	4775
7.	2050884	ET INFO Observed vk .com API Domain (api .vk .com in TLS SNI)	1373
8.	2053282	ET TA_ABUSED_SERVICES Commonly Actor Abused Online Service Domain (syncthing .net)	1296
9.	2014819	ET INFO Packed Executable Download	986
10.	2033967	ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)	728
11.	41560233	HackTool.Nmap.TCP.ServerRequest	547
12.	2047703	ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI	341
13.	65158634	HackTool.Nmap.TCP.ServerRequest	198
14.	2035593	ET INFO DropBox User Content Domain (dl .dropboxusercontent .com in TLS SNI)	197
15.	2041933	ET INFO Observed Telegram Domain (t .me in TLS SNI)	187
16.	2022082	ET INFO External IP Lookup ip-api.com	185
17.	2402000	ET DROP Dshield Block Listed Source group 1	91
18.	28000001	(o)DoH Query for dns.google	85
19.	2035303	ET INFO Observed Chocolatey Windows Package Management Domain (chocolatey .org in TLS SNI)	69
20.	2052581	ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)	62
21.	28000974	(o)DoH Query for httpdns-push.heytapmobile.com	61
22.	2060505	ET INFO Observed Discord Service Domain (discord .com) in TLS SNI	58
23.	2029634	ET HUNTING Suspected Malicious Telegram Communication (POST)	39
24.	2062715	ET INFO Observed UA-CPU Header	36
25.	1006213	MultiProxy Firefox Add-ons	36
26.	2026521	ET USER_AGENTS Suspicious User-Agent (Windows 10)	32
27.	2400009	ET DROP Spamhaus DROP Listed Traffic Inbound group 10	29
28.	1006319	PORT SCAN (NMAP -sA)	28
29.	1006585	Outbound connection to a possible C&C server	27
30.	1006554	IP blocklist	25
31.	1006556	IP blocklist	24
32.	1006555	IP blocklist	22
33.	2057746	ET INFO Observed Cloudflare Page Developer Domain (pages .dev in TLS SNI)	22
34.	1006557	IP blocklist	21
35.	58565362	Trojan-PSW.Agent.HTTP.C&C	14
36.	2029322	ET HUNTING Telegram API Certificate Observed	14
37.	2400059	ET DROP Spamhaus DROP Listed Traffic Inbound group 60	12
38.	2063118	ET INFO Abused Hosting Domain (azurewebsites .net) in TLS SNI	10
39.	2027695	ET INFO Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)	9
40.	1800920	IP blocklist	9
41.	1802600	IP blocklist	9
42.	28000040	(o)DoH Query for mozilla.cloudflare-dns.com	8
43.	28000196	(o)DoH Query for dns.google.com	8
44.	2050633	ET INFO Observed File Hosting Service Domain (zohopublic .eu) in TLS SNI	8
45.	1006258	PlanetVPN	7
46.	1801497	IP blocklist	6
47.	2058779	ET INFO Observed Smart Chain Domain in TLS SNI (bsc-dataseed .binance .org)	6
48.	2027762	ET REMOTE_ACCESS AnyDesk Remote Desktop Software User-Agent	6
49.	2013927	ET INFO HTTP traffic on port 443 (HEAD)	5
50.	2046071	ET INFO Observed Google DNS over HTTPS Domain (dns .google .com in TLS SNI)	5
51.	2017398	ET INFO IP Check Domain (icanhazip. com in HTTP Host)	5
52.	2049202	ET INFO Observed File Hosting Service Domain (files .pythonhosted .org in TLS SNI)	5
53.	2043310	ET HUNTING DDoS-Guard Hosted Content	5
54.	28000002	(o)DoH Query for cloudflare-dns.com	4
55.	2050130	ET INFO Observed Online Application Hosting Domain (supabase .co in TLS SNI)	4
56.	2057036	ET EXPLOIT_KIT Balada Domain in TLS SNI (broworker10s .com)	4
57.	2021701	ET GAMES MINECRAFT Server response inbound	3
58.	1006260	VeePN	3
59.	2049251	ET INFO Observed FingerprintJS Domain (openfpcdn .io in TLS SNI)	3
60.	2063071	ET INFO Observed External IP Lookup Domain (l2 .io) in TLS SNI	3
61.	1803186	IP blocklist	3
62.	2047866	ET INFO Observed Google DNS over HTTPS Domain (dns .google in TLS SNI)	3
63.	36674245	HackTool.Nmap.TLS.C&C	3
64.	2023753	ET SCAN MS Terminal Server Traffic on Non-standard Port	3
65.	1801678	IP blocklist	3
66.	1802605	IP blocklist	3
67.	2400035	ET DROP Spamhaus DROP Listed Traffic Inbound group 36	3
68.	2039595	ET INFO External IP Address Lookup Domain (get .geojs .io) in TLS SNI	2
69.	1800324	IP blocklist	2
70.	1801470	IP blocklist	2
71.	1802765	IP blocklist	2
72.	2054227	ET TA_ABUSED_SERVICES Fingerprinting Service in TLS SNI (customfingerprints .bablosoft .com)	2
73.	2047894	ET INFO Observed Online Collab Tool Domain (figma .com in TLS SNI)	2
74.	1802434	IP blocklist	2
75.	2050282	ET INFO Observed External IP Lookup Domain (ip-info .ff .avast .com) in TLS SNI	2
76.	2400004	ET DROP Spamhaus DROP Listed Traffic Inbound group 5	2
77.	1800572	IP blocklist	2
78.	1800496	IP blocklist	2
79.	1802677	IP blocklist	2
80.	2400060	ET DROP Spamhaus DROP Listed Traffic Inbound group 61	2
81.	1800742	IP blocklist	2
82.	1801285	IP blocklist	2
83.	28000957	(o)DoH Query for httpdns-push.heytapmobile.com	2

55 млн. строк – это достаточно много (с одной стороны по продолжительности сбора данных о сетевом трафике, с другой стороны по требуемому объему оперативной памяти при дальнейшем обучении моделей) и для упрощения анализа при проведении исследования все множество векторов разбиваем на файлы по 10 млн строк.

Все 55 млн. строк сортируем по меткам времени появления вектора признаков, характеризующих сетевые соединения – это позволит ответить на вопрос: сколько времени требуется наблюдать за трафиком компании для обучения и получения качественной ML модели.

Распределение всех векторов по классам и по времени появления представлены ниже в таблице.

Название файла	Количество векторов признаков по метке класса	Период наблюдения
dataset_1.csv	Benign – 9996297 Attack – 3703	2025-06-26 23:47:43 (четверг) 2025-06-29 17:31:35 (воскресенье)
dataset_2.csv	Benign – 9979487 Attack – 20513	2025-06-29 17:31:35 (воскресенье) 2025-07-02 10:55:35 (среда)
dataset_3.csv	Benign – 9983212 Attack – 16788	2025-07-02 10:55:35 (среда) 2025-07-04 22:52:20 (пятница)
dataset_4.csv	Benign – 9999896 Attack – 104	2025-07-02 22:23:49 (пятница) 2025-07-06 02:05:00 (воскресенье)
dataset_5.csv	Benign – 9999893 Attack – 107	2025-07-06 02:05:00 (воскресенье) 2025-07-07 08:10:49 (понедельник)
dataset_6.csv	Benign – 5532721 Attack – 16250	2025-07-07 08:10:49 (понедельник) 2025-07-10 08:25:40 (четверг)

Ура! Датасет готов. Можно попробовать синтезировать ML модель.

Построение ML IDS

Для построения классификатора сетевого трафика была использована библиотека catboost. Количество признаков – 10, все признаки – числовые. Эксперименты проводились на ПЭВМ: Intel(R) Core(TM) i5-3570 CPU @ 3.40GHz, 32 Gb DDR3.

Настройки классификатора при обучении (данные значения настроек использовались во всех экспериментах: значения выбраны эвристически исходя из различных рекомендаций исследователей и разработчиков):

iterations = 1000, depth = 8,
CatBoostClassifier(iterations=iterations, verbose=250, depth=depth,
task_type="CPU", eval_metric='F1').

Важно помнить! Безусловно, надо подбирать рациональные значения всех гиперпараметров ML модели, но в данном исследовании этого не делалось, а упор сделан на все «подводные» камни процесса построения ML IDS в целом!

Эксперимент 1.

Обучили модель на файле dataset_1.csv (2,5 дня наблюдения за сетью, в том числе в рабочие дни: 18 % всех чистых векторов, 6,5% всех атак).

Эксперимент 1. Оценка качества классификатора сетевого трафика

Набор данных	Матрица ошибок	Показатели качества классификации
dataset_1.csv	clear as clear (TN-true negative): 9996239 clear as attack (FP-false positive): 58 attack as clear (FN-false negative): 1612 attack as attack (TP-true positive): 2091	accuracy = 0.9998 precision = 0.9730 recall = 0.5646 f1-score = 0.7146
dataset_2.csv	clear as clear (TN-true negative): 9974887 clear as attack (FP-false positive): 4600 attack as clear (FN-false negative): 16783 attack as attack (TP-true positive): 3730	accuracy = 0.9978 precision = 0.4477 recall = 0.1818 f1-score = 0.2586
dataset_3.csv	clear as clear (TN-true negative): 9980409 clear as attack (FP-false positive): 2803 attack as clear (FN-false negative): 12279 attack as attack (TP-true positive): 4509	accuracy = 0.9984 precision = 0.6166 recall = 0.2685 f1-score = 0.3742
dataset_4.csv	clear as clear (TN-true negative): 9999888 clear as attack (FP-false positive): 8 attack as clear (FN-false negative): 47 attack as attack (TP-true positive): 57	accuracy = 0.9999 precision = 0.8769 recall = 0.5480 f1-score = 0.6745
dataset_5.csv	clear as clear (TN-true negative): 9999889 clear as attack (FP-false positive): 4 attack as clear (FN-false negative): 40 attack as attack (TP-true positive): 67	accuracy = 0.9999 precision = 0.9436 recall = 0.6261 f1-score = 0.7528
dataset_6.csv	clear as clear (TN-true negative): 5530706 clear as attack (FP-false positive): 2015 attack as clear (FN-false negative): 8488 attack as attack (TP-true positive): 7762	accuracy = 0.9981 precision = 0.7939 recall = 0.4776 f1-score = 0.5964

Выводы по эксперименту: пока что, все плохо!

Обучение произведено на файле dataset_1.csv и качество классификации на нем же плохое: слишком много «пропуска цели», а следовательно и значение recall тоже низкое. Т.е. выборки плохо разделимы с использованием выбранного математического аппарата, существующего признакового пространства и/или разметки датасета.
На остальных файлах (участках времени) всё плохо не только с попуском цели, но и достаточно высокий уровень ложных срабатываний, что обычно говорит о том, что в обучающей выборке недостаточно «чистых» векторов, т.е. обучающая выборка не репрезентативна и надо добавить векторов со следующего временного участка. Однако в нашем случае, в явном виде такой вывод сделать нельзя, т.к. на dataset_4.csv и dataset_5.csv (выходные дни и совсем небольшое количество атак) качество классификации «чистого» трафика неплохое.

Что же делать дальше?

Высокий уровень пропуска цели и в целом невозможность разделения векторов на обучающей выборке, в совокупности с применением catboost (одна из лучших в мире реализаций RandomForest) говорит о том, что скорее всего разметка датасета неправильная и есть вектора имеющие одинаковые (или очень близкие) значения признаков, но разные метки классов. Все такие вектора для простоты обозначения будем по тексту публикации называть «плохими» векторами.

Тогда на следующем этапе исследования:

найдем все вектора, расстояние между которыми равны 0, но они относятся к разным классам (это однозначно неправильная разметка датасета);
найдем все вектора, расстояние между которыми имеют «очень маленькое» значение (данное значение было подобрано экспериментально);
проведем анализ: какие именно атаки (sid правил IDS Suricata) попали во множество «плохих»?
заменим метку класса найденных векторов на Benign.

Эксперимент 2.

Для поиска векторов имеющих одинаковые значения признаков, но разные метки классов, воспользуемся расчетом Евклидова расстояния между векторами (не забываем при этом нормализовать значения каждого признака). Поиск осуществляем только на файле dataset_1.csv (он у нас обучающий).

В результате поиска векторов с одинаковыми (или очень близкими) значениями признаков, но разными метками классов было найдено 24 sid (объединим их в логические группы и представим текстовое описание семантики решающего правила).

№п/п	Sid	Короткое описание (описание взято из решающего правила IDS Suricata) и краткое описание семантики решающего правила
1	1003187	"Anonymizer detected", правило находит TLS соединения с заданным значением SNI
2	1006215, 1006217, 1006221	"HolaVPN detected", правила находят TLS соединения с заданными значениями SNI (в одном из sid, есть небольшое контекстное уточнение)
3	1006554, 1006555, 1006556, 1800330, 1800496, 1800742, 1801285, 1801673, 1802363, 1802600, 1802677	"IP blocklist", правила находят сетевые пакеты с заданными IP адресами
4	41560233, 65158634	"HackTool.Nmap.TCP.ServerRequest", правила находят сетевые пакеты с заданными флагами протокола TCP (таких признаков в нашем датасете нет!)
5	2035593	"ET INFO DropBox User Content Domain (dl.dropboxusercontent.com in TLS SNI)", правило находит TLS соединения с заданным значением SNI
6	2047703	"ET INFO External IP Address Lookup Domain (ipify.org) in TLS SNI", правило находит TLS соединения с заданным значением SNI
7	2400009, 2400035, 2400059, 2400060	"ET DROP Spamhaus DROP Listed Traffic Inbound group 10" "ET DROP Spamhaus DROP Listed Traffic Inbound group 36" "ET DROP Spamhaus DROP Listed Traffic Inbound group 60" "ET DROP Spamhaus DROP Listed Traffic Inbound group 61", правила находят сетевые пакеты с заданными IP адресами
8	2402000	"ET DROP Dshield Block Listed Source group 1", правила находят сетевые пакеты с заданными IP адресами

Для практически всех вышеперечисленных компьютерных атак имелись полностью совпадающие вектора из множества «чистых» векторов (т.е. расстояние между ними было равно 0).

Исключения составили события с sid: 1006217, 2035593 и 2047703. Для этих событий минимальное расстояние между векторами было < 0.00005. Что это означает на практике хорошо видно на рисунке ниже (dist = 0.000001).

Пример "близких" векторов

Т.е. небольшая разница была в значениях признаков, которые зависят от времени (задержек в сети, используемых сетевых технологиях и т.п.).

Дополнительным интересным результатом явилось еще и то, что некоторые атаки в принципе имеют практически 0 значения всех признаков (такое возможно при условии, что NGFW заблокировало соединение по первому пакету). Это означает, что для этих атак признаковое пространство необходимо изменять.

Так, например, атаки "HackTool.Nmap.TCP.ServerRequest" и "ET DROP Dshield Block Listed Source group 1" в заданном признаковом пространстве вообще не различимы (см. рисунок ниже). Имеются и другие примеры наблюдаемого явления.

Пример векторов, по которым становится понятным необходимости изменения признакового пространства

Ниже представлены результаты модификации набора данных (путем изменения метки класса на Benign для всех векторов, имеющих «плохие» sid), повторного обучения ML модели и оценки качества классификации. Настройки процедуры обучения ML модели, выбранные значения гиперпараметров модели и используемый набор данных остаются как и в эксперименте 1.

После модификации набора данных векторов с меткой класса Benign – 55531544, векторов с меткой Attack – 17427 (было 57465).

Обучим заново ML IDS и оценим качество полученного классификатора.

Эксперимент 2. Оценка качества классификатора сетевого трафика

Набор данных	Матрица ошибок	Показатели качества классификации
dataset_1.csv	clear as clear (TN-true negative): 9998394 clear as attack (FP-false positive): 10 attack as clear (FN-false negative): 18 attack as attack (TP-true positive): 1578	accuracy = 0.9999 precision = 0.9937 recall = 0.9887 f1-score = 0.9912
dataset_2.csv	clear as clear (TN-true negative): 9996661 clear as attack (FP-false positive): 194 attack as clear (FN-false negative): 587 attack as attack (TP-true positive): 2558	accuracy = 0.9999 precision = 0.9295 recall = 0.8133 f1-score = 0.8675
dataset_3.csv	clear as clear (TN-true negative): 9995458 clear as attack (FP-false positive): 103 attack as clear (FN-false negative): 753 attack as attack (TP-true positive): 3686	accuracy = 0.9999 precision = 0.9728 recall = 0.8303 f1-score = 0.8959
dataset_4.csv	clear as clear (TN-true negative): 9999937 clear as attack (FP-false positive): 5 attack as clear (FN-false negative): 13 attack as attack (TP-true positive): 45	accuracy = 0.9999 precision = 0.9 recall = 0.7758 f1-score = 0.8333
dataset_5.csv	clear as clear (TN-true negative): 9999923 clear as attack (FP-false positive): 3 attack as clear (FN-false negative): 18 attack as attack (TP-true positive): 56	accuracy = 0.9999 precision = 0.9491 recall = 0.7567 f1-score = 0.8421
dataset_6.csv	clear as clear (TN-true negative): 5540606 clear as attack (FP-false positive): 250 attack as clear (FN-false negative): 1549 attack as attack (TP-true positive): 6566	accuracy = 0.9996 precision = 0.9633 recall = 0.8091 f1-score = 0.8795

Время обучения модели 19 мин 36 сек, время классификации 55 млн. векторов – 7 мин 21,4 сек.

Выводы по эксперименту

Не смотря на улучшение качества классификации в целом, уровень «пропуска» цели и ложных срабатываний остается высоким.
При этом, достаточно большое значение «FN-false negative» (и как следствие значение recall) на файлах dataset_2/3/4/5/6.csv показывает, что:

необходимо исследовать: появились ли новые зарегистрированные атаки на временных интервалах, следующих за обучающим интервалом (т.е. на dataset_2/3/4/5/6.csv)?;
объем обучающей выборки с атаками явно недостаточный и требуется переобучить модель с новыми данными.

Исследование состава зарегистрированных событий безопасности IDS Suricata на разных интервалах времени

Для того, чтобы понять какие события правильно классифицируются, а какие нет, была построена таблица, в ней указано, какие атаки встречались на каждом временном участке и сколько из этих атак было НЕ обнаружено (т.е. на примере самой первой строки sid = 2028762, в файле на котором обучались (dataset_1.csv) было таких событий 688 и все обнаружены, на dataset_2 было 1424 атаки из ни не обнаружено 5 и т.д.).

Обозначения. В таблицах ошибок ниже жирным шрифтом выделено плохое качество классификации векторов с признаками.
Для наглядности можно применить раскраску таблицы цветами (к сожалению, сайт не поддерживает раскраску таблиц), становится очень хорошо видно, что отдельные события безопасности хорошо распознаются, другие не в какую не хотят правильно классифицироваться, какие события были в процессе обучения представлены, а какие - нет:
– зеленый цвет – качество классификации приемлемое;
– красный цвет – качество плохое (надо обратить внимание на это решающее правило);
– желтый цвет (только в колонке dataset_1, т.е. на обучающем наборе данных) – sid не встречался в процессе обучения (решающее правило не срабатывало).

Эксперимент 2. Таблица ошибок "пропуск" цели

№ п/п	sid	Описание	dataset_1	dataset_2	dataset_3	dataset_4	dataset_5	dataset_6
1	2028762	ET JA3 Hash - [Abuse.ch] Possible Trickbot	688\|0	1424\|5	1954\|10	0\|0	0\|0	3036\|11
2	2060504	ET INFO Observed Discord Service Domain (gateway .discord .gg) in TLS SNI	135\|0	534\|10	853\|7	0\|0	0\|0	3253\|669
3	2050884	ET INFO Observed vk .com API Domain (api .vk .com in TLS SNI)	231\|3	303\|261	331\|278	0\|0	0\|0	508\|361
4	2053282	ET TA_ABUSED_SERVICES Commonly Actor Abused Online Service Domain (syncthing .net)	197\|0	222\|14	459\|36	0\|0	0\|0	418\|29
5	2014819	ET INFO Packed Executable Download	145\|1	224\|44	261\|60	31\|2	47\|3	278\|59
6	2033967	ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)	92\|0	172\|26	220\|39	24\|8	12\|2	208\|37
7	2041933	ET INFO Observed Telegram Domain (t .me in TLS SNI)	25\|2	55\|46	53\|48	0\|0	0\|0	54\|40
8	2022082	ET INFO External IP Lookup ip-api.com	0\|0	46\|46	66\|66	0\|0	0\|0	73\|73
9	28000001	(o)DoH Query for dns.google	0\|0	2\|2	82\|82	0\|0	0\|0	1\|1
10	2035303	ET INFO Observed Chocolatey Windows Package Management Domain (chocolatey .org in TLS SNI)	19\|0	18\|0	27\|1	0\|0	0\|0	5\|0
11	2052581	ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)	0\|0	3\|3	0\|0	0\|0	0\|0	59\|59
12	28000974	(o)DoH Query for httpdns-push.heytapmobile.com	0\|0	0\|0	0\|0	0\|0	0\|0	61\|61
13	2060505	ET INFO Observed Discord Service Domain (discord .com) in TLS SNI	0\|0	13\|13	21\|21	0\|0	0\|0	24\|24
14	2029634	ET HUNTING Suspected Malicious Telegram Communication (POST)	5\|0	13\|13	6\|6	0\|0	0\|0	15\|13
15	1006213	MultiProxy Firefox Add-ons	33\|0	3\|2	0\|0	0\|0	0\|0	0\|0
16	2062715	ET INFO Observed UA-CPU Header	2\|1	7\|7	12\|12	0\|0	7\|7	8\|8
17	2026521	ET USER_AGENTS Suspicious User-Agent (Windows 10)	0\|0	26\|26	6\|6	0\|0	0\|0	0\|0
18	1006319	PORT SCAN (NMAP -sA)	0\|0	8\|8	4\|4	0\|0	0\|0	16\|16
19	1006585	Outbound connection to a possible C&C server	0\|0	4\|4	1\|1	0\|0	0\|0	22\|22
20	2057746	ET INFO Observed Cloudflare Page Developer Domain (pages .dev in TLS SNI)	3\|3	3\|3	7\|7	0\|0	0\|0	9\|9
21	1006557	IP blocklist	2\|2	4\|4	5\|5	1\|1	2\|2	7\|7
22	2029322	ET HUNTING Telegram API Certificate Observed	3\|0	3\|1	2\|1	1\|1	2\|1	3\|1
23	58565362	Trojan-PSW.Agent.HTTP.C&C	0\|0	8\|8	5\|5	0\|0	0\|0	1\|1
24	2063118	ET INFO Abused Hosting Domain (azurewebsites .net) in TLS SNI	1\|0	1\|1	2\|2	0\|0	0\|0	6\|6
25	2027695	ET INFO Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)	0\|0	1\|0	4\|0	0\|0	0\|0	4\|0
26	1800920	IP blocklist	0\|0	0\|0	9\|9	0\|0	0\|0	0\|0
27	2050633	ET INFO Observed File Hosting Service Domain (zohopublic .eu) in TLS SNI	8\|0	0\|0	0\|0	0\|0	0\|0	0\|0
28	28000196	(o)DoH Query for dns.google.com	1\|1	3\|3	4\|4	0\|0	0\|0	0\|0
29	28000040	(o)DoH Query for mozilla.cloudflare-dns.com	1\|0	4\|0	1\|0	0\|0	1\|0	1\|0
30	1006258	PlanetVPN	0\|0	3\|1	1\|1	0\|0	0\|0	3\|1
31	1801497	IP blocklist	0\|0	3\|3	2\|2	0\|0	1\|1	0\|0
32	2058779	ET INFO Observed Smart Chain Domain in TLS SNI (bsc-dataseed .binance .org)	0\|0	2\|2	4\|4	0\|0	0\|0	0\|0
33	2027762	ET REMOTE_ACCESS AnyDesk Remote Desktop Software User-Agent	0\|0	0\|0	2\|2	0\|0	0\|0	4\|4
34	2013927	ET INFO HTTP traffic on port 443 (HEAD)	0\|0	2\|2	2\|2	0\|0	0\|0	1\|1
35	2046071	ET INFO Observed Google DNS over HTTPS Domain (dns .google .com in TLS SNI)	0\|0	2\|2	1\|1	0\|0	0\|0	2\|2
36	2017398	ET INFO IP Check Domain (icanhazip. com in HTTP Host)	0\|0	0\|0	3\|3	0\|0	0\|0	2\|2
37	2049202	ET INFO Observed File Hosting Service Domain (files .pythonhosted .org in TLS SNI)	0\|0	0\|0	3\|3	0\|0	0\|0	2\|2
38	2043310	ET HUNTING DDoS-Guard Hosted Content	0\|0	0\|0	4\|4	0\|0	0\|0	1\|1
39	28000002	(o)DoH Query for cloudflare-dns.com	0\|0	2\|0	1\|0	0\|0	0\|0	1\|0
40	2050130	ET INFO Observed Online Application Hosting Domain (supabase .co in TLS SNI)	0\|0	2\|2	2\|2	0\|0	0\|0	0\|0
41	2057036	ET EXPLOIT_KIT Balada Domain in TLS SNI (broworker10s .com)	0\|0	4\|4	0\|0	0\|0	0\|0	0\|0
42	1801678	IP blocklist	1\|1	1\|1	0\|0	0\|0	0\|0	1\|1
43	1802605	IP blocklist	1\|1	0\|0	1\|1	1\|1	0\|0	0\|0
44	2021701	ET GAMES MINECRAFT Server response inbound	0\|0	3\|3	0\|0	0\|0	0\|0	0\|0
45	1006260	VeePN	0\|0	3\|3	0\|0	0\|0	0\|0	0\|0
46	2049251	ET INFO Observed FingerprintJS Domain (openfpcdn .io in TLS SNI)	0\|0	2\|2	1\|1	0\|0	0\|0	0\|0
47	2063071	ET INFO Observed External IP Lookup Domain (l2 .io) in TLS SNI	0\|0	0\|0	1\|1	0\|0	0\|0	2\|2
48	1803186	IP blocklist	0\|0	0\|0	1\|1	0\|0	0\|0	2\|2
49	2047866	ET INFO Observed Google DNS over HTTPS Domain (dns .google in TLS SNI)	0\|0	0\|0	3\|3	0\|0	0\|0	0\|0
50	36674245	HackTool.Nmap.TLS.C&C	0\|0	0\|0	0\|0	0\|0	0\|0	3\|3
51	2023753	ET SCAN MS Terminal Server Traffic on Non-standard Port	0\|0	0\|0	0\|0	0\|0	0\|0	3\|3
52	28000957	(o)DoH Query for httpdns-push.heytapmobile.com	2\|2	0\|0	0\|0	0\|0	0\|0	0\|0
53	1800572	IP blocklist	1\|1	0\|0	0\|0	0\|0	1\|1	0\|0
54	2039595	ET INFO External IP Address Lookup Domain (get .geojs .io) in TLS SNI	0\|0	2\|2	0\|0	0\|0	0\|0	0\|0
55	1800324	IP blocklist	0\|0	1\|1	0\|0	0\|0	0\|0	1\|1
56	1801470	IP blocklist	0\|0	1\|1	0\|0	0\|0	0\|0	1\|1
57	1802765	IP blocklist	0\|0	1\|1	0\|0	0\|0	0\|0	1\|1
58	2054227	ET TA_ABUSED_SERVICES Fingerprinting Service in TLS SNI (customfingerprints .bablosoft .com)	0\|0	0\|0	2\|2	0\|0	0\|0	0\|0
59	1802434	IP blocklist	0\|0	0\|0	0\|0	0\|0	0\|0	2\|2
60	2050282	ET INFO Observed External IP Lookup Domain (ip-info .ff .avast .com) in TLS SNI	0\|0	0\|0	0\|0	0\|0	0\|0	2\|2
61	2400004	ET DROP Spamhaus DROP Listed Traffic Inbound group 5	0\|0	0\|0	0\|0	0\|0	0\|0	2\|2

Выводы по исследованию состава зарегистрированных событий безопасности IDS Suricata на разных интервалах времени:

не все атаки хорошо распознаются на обучающем наборе данных, и необходимо провести анализ каким образом срабатывают такие правила (дальнейший анализ показал, что большинство из красных областей – это срабатывания решающих правил, основанных на адресной информации);
ряд атак на обучающем наборе данных классифицируются правильно с хорошим качеством, а на остальных участках времени – плохо. Для того, чтобы понять почему так бывает можно рассмотреть правило строка 5: sid = 2014819; краткое описание: «ET INFO Packed Executable Download», если посмотреть на него, то видно, что критерий принятия решения – это все файлы формата PE, причем откомпилирован не в Visual Studio и то с ограничениями. Очевидно, что ложных срабатываний в таком случае будет огромное количество, что и видно на практике;
плохая обобщающая способность. Библиотека catboost – это реализация RandomForest и это сказывается в случае, если ряд признаков (как в нашем случае) в датасете связаны с временем. На практике это означает, что ряд атак, в нашем случае – почти все, которые отсутствовали на обучающем наборе данных либо плохо (плохая обобщающая способность), либо вообще не распознаются и требуется переобучение модели, чтобы обучающая выборка была «репрезентативной» (строки 8, 9, 11, 13, 14 и многие другие).

Что же делать?

На следующем шаге исследования обратим внимание на правила из "красной" зоны и заново обучим модель на первом и втором временном интервале. Таким образом, с точки зрения практики, первого временного интервала для обучения не достаточно (выборка не репрезентативна, если посмотреть выше на таблицу, то первый временной интервал - это всего лишь один рабочий день - пятница и потом наступают выходные), увеличим временной интервал для сбора сетевого трафика.

Эксперимент 3.

Предварительная обработка данных: убрать все адресные решающие правила (т.е. правила, критерием срабатывания которых является обращение по конкретному ip адресу или диапазону адресов, или обращение к TLS серверам с конкретным SNI (или SNI префиксом).

Перечислим sid «плохих» для построения ML модели правил:

2060504,2050884,28000001,2041933,28000974,2052581,1006585,2060505,2057746,2053282,2033967,2063118,2046071,2049202,1006554,1006556,1006555,1006557,1800920,1802600,1801497,1803186,1801678,1802605,1800324,1801470,1802765,1802434,1800572,1800496,1802677,1800742,1801285,1801368,1802634,1801601,1800766,1801379,1802764,1800722,1802174,1802654,1800213,1803394,1803583,1801944,1801673,1802363,1800330,1006258,1006260,1006557,1800324,1800766,1801368,1801379,1801470,1801497,1801601,1801678,1802634,1802765,2029634,2033967,2050884,2062715 – это правила с адресной информацией.

После модификации набора данных векторов с меткой класса Benign – 55540391, векторов с меткой Attack – 8580 (первоначально было 57465).

При обучении объединим два временных диапазона dataset_1.csv и dataset_2.csv, т.е. обучение осуществлялось в течение 6 дней (включая трафик выходных дней).

Эксперимент 3. Оценка качества классификатора сетевого трафика.

Набор данных	Матрица ошибок	Показатели качества классификации
dataset_1.csv	clear as clear (TN-true negative): 9999094 clear as attack (FP-false positive): 6 attack as clear (FN-false negative): 13 attack as attack (TP-true positive): 887	accuracy = 0.9999 precision = 0.9932 recall = 0.9855 f1-score = 0.9894
dataset_2.csv	clear as clear (TN-true negative): 9998210 clear as attack (FP-false positive): 1 attack as clear (FN-false negative): 47 attack as attack (TP-true positive): 1742	accuracy = 0.9999 precision = 0.9994 recall = 0.9737 f1-score = 0.9864
dataset_3.csv	clear as clear (TN-true negative): 9997626 clear as attack (FP-false positive): 7 attack as clear (FN-false negative): 110 attack as attack (TP-true positive): 2257	accuracy = 0.9999 precision = 0.9969 recall = 0.9535 f1-score = 0.9747
dataset_4.csv	clear as clear (TN-true negative): 9999966 clear as attack (FP-false positive): 2 attack as clear (FN-false negative): 1 attack as attack (TP-true positive): 31	accuracy = 0.9999 precision = 0.9393 recall = 0.9687 f1-score = 0.9538
dataset_5.csv	clear as clear (TN-true negative): 9999949 clear as attack (FP-false positive): 1 attack as clear (FN-false negative): 4 attack as attack (TP-true positive): 46	accuracy = 0.9999 precision = 0.9787 recall = 0.92 f1-score = 0.9484
dataset_6.csv	clear as clear (TN-true negative): 5545503 clear as attack (FP-false positive): 26 attack as clear (FN-false negative): 92 attack as attack (TP-true positive): 3350	accuracy = 0.9999 precision = 0.9922 recall = 0.9732 f1-score = 0.9826

Время обучения модели 39 мин 49 сек, время классификации 55 млн. векторов – 8 мин 41,6 сек.

Эксперимент 3. Таблица ошибок "пропуска" цели

№ п/п	sid	Описание	dataset_1	dataset_2	dataset_3	dataset_4	dataset_5	dataset_6
1	2028762	ET JA3 Hash - [Abuse.ch] Possible Trickbot	688\|0	1424\|0	1954\|9	0\|0	0\|0	3036\|6
2	2014819	ET INFO Packed Executable Download	145\|0	224\|0	261\|42	31\|0	47\|1	278\|37
3	2022082	ET INFO External IP Lookup ip-api.com	0\|0	46\|0	66\|5	0\|0	0\|0	73\|0
4	2035303	ET INFO Observed Chocolatey Windows Package Management Domain (chocolatey .org in TLS SNI)	19\|0	18\|0	27\|2	0\|0	0\|0	5\|0
5	1006213	MultiProxy Firefox Add-ons	33\|4	3\|0	0\|0	0\|0	0\|0	0\|0
6	2026521	ET USER_AGENTS Suspicious User-Agent (Windows 10)	0\|0	26\|26	6\|6	0\|0	0\|0	0\|0
7	1006319	PORT SCAN (NMAP -sA)	0\|0	8\|0	4\|3	0\|0	0\|0	16\|16
8	2029322	ET HUNTING Telegram API Certificate Observed	3\|0	3\|1	2\|1	1\|1	2\|2	3\|3
9	58565362	Trojan-PSW.Agent.HTTP.C&C	0\|0	8\|0	5\|0	0\|0	0\|0	1\|0
10	2027695	ET INFO Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)	0\|0	1\|1	4\|4	0\|0	0\|0	4\|4
11	2050633	ET INFO Observed File Hosting Service Domain (zohopublic .eu) in TLS SNI	8\|5	0\|0	0\|0	0\|0	0\|0	0\|0
12	28000196	(o)DoH Query for dns.google.com	1\|1	3\|3	4\|4	0\|0	0\|0	0\|0
13	28000040	(o)DoH Query for mozilla.cloudflare-dns.com	1\|1	4\|4	1\|1	0\|0	1\|1	1\|1
14	2058779	ET INFO Observed Smart Chain Domain in TLS SNI (bsc-dataseed .binance .org)	0\|0	2\|1	4\|4	0\|0	0\|0	0\|0
15	2027762	ET REMOTE_ACCESS AnyDesk Remote Desktop Software User-Agent	0\|0	0\|0	2\|2	0\|0	0\|0	4\|4
16	2017398	ET INFO IP Check Domain (icanhazip. com in HTTP Host)	0\|0	0\|0	3\|3	0\|0	0\|0	2\|2
17	2043310	ET HUNTING DDoS-Guard Hosted Content	0\|0	0\|0	4\|4	0\|0	0\|0	1\|1
18	28000002	(o)DoH Query for cloudflare-dns.com	0\|0	2\|2	1\|1	0\|0	0\|0	1\|1
19	2050130	ET INFO Observed Online Application Hosting Domain (supabase .co in TLS SNI)	0\|0	2\|2	2\|2	0\|0	0\|0	0\|0
20	2057036	ET EXPLOIT_KIT Balada Domain in TLS SNI (broworker10s .com)	0\|0	4\|4	0\|0	0\|0	0\|0	0\|0
21	2021701	ET GAMES MINECRAFT Server response inbound	0\|0	3\|0	0\|0	0\|0	0\|0	0\|0
22	2049251	ET INFO Observed FingerprintJS Domain (openfpcdn .io in TLS SNI)	0\|0	2\|1	1\|1	0\|0	0\|0	0\|0
23	2063071	ET INFO Observed External IP Lookup Domain (l2 .io) in TLS SNI	0\|0	0\|0	1\|1	0\|0	0\|0	2\|2
24	2047866	ET INFO Observed Google DNS over HTTPS Domain (dns .google in TLS SNI)	0\|0	0\|0	3\|3	0\|0	0\|0	0\|0
25	36674245	HackTool.Nmap.TLS.C&C	0\|0	0\|0	0\|0	0\|0	0\|0	3\|3
26	2023753	ET SCAN MS Terminal Server Traffic on Non-standard Port	0\|0	0\|0	0\|0	0\|0	0\|0	3\|3
27	28000957	(o)DoH Query for httpdns-push.heytapmobile.com	2\|2	0\|0	0\|0	0\|0	0\|0	0\|0
28	2039595	ET INFO External IP Address Lookup Domain (get .geojs .io) in TLS SNI	0\|0	2\|2	0\|0	0\|0	0\|0	0\|0
29	2054227	ET TA_ABUSED_SERVICES Fingerprinting Service in TLS SNI (customfingerprints .bablosoft .com)	0\|0	0\|0	2\|2	0\|0	0\|0	0\|0
30	2047894	ET INFO Observed Online Collab Tool Domain (figma .com in TLS SNI)	0\|0	0\|0	1\|1	0\|0	0\|0	1\|1
31	2050282	ET INFO Observed External IP Lookup Domain (ip-info .ff .avast .com) in TLS SNI	0\|0	0\|0	0\|0	0\|0	0\|0	2\|2
32	2400004	ET DROP Spamhaus DROP Listed Traffic Inbound group 5	0\|0	0\|0	0\|0	0\|0	0\|0	2\|2
33	2054246	ET ATTACK_RESPONSE Eval Hex Obfuscated JS Inbound	0\|0	1\|0	0\|0	0\|0	0\|0	0\|0
34	2038967	ET INFO SSH-2.0-Go version string Observed in Network Traffic	0\|0	1\|0	0\|0	0\|0	0\|0	0\|0
35	1006206	Browsec-VPN	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
36	2060251	ET INFO Go-http-client User-Agent Observed Outbound	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
37	2014788	ET DYN_DNS DYNAMIC_DNS HTTP Request to a 3322.net Domain *.3322.net	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
38	2017499	ET ATTACK_RESPONSE Probably Evil Long Unicode string only string and unescape 1	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
39	1006914	Possible trojan activity, base64-encoded content	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
40	1003302	Anonymizer detected	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
41	2018383	ET EXPLOIT Possible OpenSSL HeartBleed Large HeartBeat Response from Common SSL Port (Outbound from Client)	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
42	2012252	ET SHELLCODE Common 0a0a0a0a Heap Spray String	0\|0	0\|0	0\|0	0\|0	0\|0	1\|1
43	2048493	ET INFO ISO File Downloaded	0\|0	0\|0	0\|0	0\|0	0\|0	1\|1
44	2024833	ET INFO Observed IP Lookup Domain (l2 .io in TLS SNI)	0\|0	0\|0	0\|0	0\|0	0\|0	1\|1

Выводы по эксперименту:

качество модели стало лучше, но с датасетом надо еще работать. «Глазами» изучить с первого раза все 111 решающих правил IDS Suricata у автора не получилось и скорее всего адресные правила удалены были не все (т.к. «пропуск» цели достаточно большой на файлах dataset_3.csv и dataset_6.csv, а на файле dataset_2.csv много ошибок обучения).

Эксперимент 4.

Предварительная обработка данных такая же как и в предыдущем эксперименте – убрать все адресные решающие правила (т.е. правила, критерием срабатывания которых является обращение по конкретному ip адресу или диапазону адресов, или обращение к TLS серверам с конкретным SNI (или SNI префиксом).

Анализ перечисленных выше в эксперименте 3 ошибок «пропуска цели» выявили следующие категории «плохих» sid:

поиск SNI: 2058779, 2039595, 2054227, 2047894, 2050282, 2024833;
поиск SNI с опцией dotprefix: 2027695, 2050633, 2063071, 2047866;
поиск сертификата с конкретными данными: 2029322, 28000196, 28000040, 28000002, 28000957;
поиск конкретных IP адресов: 2400004;
анализ TCP Flags: 1006319.

Остальные решающие правила исключать нельзя – они опираются на поиск контекстный поиск внутри данных TCP соединения (анализ заголовков http, анализ содержимого передаваемых по протоколу http файлов и т.п.).

После модификации набора данных векторов с меткой класса Benign – 55540495, векторов с меткой Attack – 8476 (первоначально было 57465).

Эксперимент 4. Оценка качества классификатора сетевого трафика.

Набор данных	Матрица ошибок	Показатели качества классификации
dataset_1.csv	clear as clear (TN-true negative): 9999112 clear as attack (FP-false positive): 3 attack as clear (FN-false negative): 5 attack as attack (TP-true positive): 880	accuracy = 0.9999 precision = 0.9966 recall = 0.9943 f1-score = 0.9954
dataset_2.csv	clear as clear (TN-true negative): 9998235 clear as attack (FP-false positive): 1 attack as clear (FN-false negative): 34 attack as attack (TP-true positive): 1730	accuracy = 0.9999 precision = 0.9994 recall = 0.9807 f1-score = 0.9899
dataset_3.csv	clear as clear (TN-true negative): 9997651 clear as attack (FP-false positive): 9 attack as clear (FN-false negative): 83 attack as attack (TP-true positive): 2257	accuracy = 0.9999 precision = 0.9960 recall = 0.9645 f1-score = 0.98
dataset_4.csv	clear as clear (TN-true negative): 9999968 clear as attack (FP-false positive): 1 attack as clear (FN-false negative): 0 attack as attack (TP-true positive): 31	accuracy = 0.9999 precision = 0.9687 recall = 1.0 f1-score = 0.9841
dataset_5.csv	clear as clear (TN-true negative): 9999952 clear as attack (FP-false positive): 1 attack as clear (FN-false negative): 1 attack as attack (TP-true positive): 46	accuracy = 0.9999 precision = 0.9787 recall = 0.9787 f1-score = 0.9787
dataset_6.csv	clear as clear (TN-true negative): 5545538 clear as attack (FP-false positive): 24 attack as clear (FN-false negative): 56 attack as attack (TP-true positive): 3353	accuracy = 0.9999 precision = 0.9928 recall = 0.9835 f1-score = 0.9882

Время обучения модели 39 мин 58 сек, время классификации 55 млн. векторов – 7 мин 56 сек.

Эксперимент 4. Таблица ошибок «пропуска» цели.

№ п/п	sid	Описание	dataset_1	dataset_2	dataset_3	dataset_4	dataset_5	dataset_6
1	2028762	ET JA3 Hash - [Abuse.ch] Possible Trickbot	688\|0	1424\|0	1954\|11	0\|0	0\|0	3036\|8
2	2014819	ET INFO Packed Executable Download	145\|0	224\|0	261\|37	31\|0	47\|1	278\|30
3	2022082	ET INFO External IP Lookup ip-api.com	0\|0	46\|0	66\|6	0\|0	0\|0	73\|2
4	2035303	ET INFO Observed Chocolatey Windows Package Management Domain (chocolatey .org in TLS SNI)	19\|0	18\|0	27\|2	0\|0	0\|0	5\|0
5	1006213	MultiProxy Firefox Add-ons	33\|5	3\|1	0\|0	0\|0	0\|0	0\|0
6	2026521	ET USER_AGENTS Suspicious User-Agent (Windows 10)	0\|0	26\|26	6\|6	0\|0	0\|0	0\|0
7	58565362	Trojan-PSW.Agent.HTTP.C&C	0\|0	8\|0	5\|0	0\|0	0\|0	1\|0
8	2027762	ET REMOTE_ACCESS AnyDesk Remote Desktop Software User-Agent	0\|0	0\|0	2\|2	0\|0	0\|0	4\|4
9	2013927	ET INFO HTTP traffic on port 443 (HEAD)	0\|0	2\|0	2\|2	0\|0	0\|0	1\|1
10	2017398	ET INFO IP Check Domain (icanhazip. com in HTTP Host)	0\|0	0\|0	3\|3	0\|0	0\|0	2\|2
11	2043310	ET HUNTING DDoS-Guard Hosted Content	0\|0	0\|0	4\|4	0\|0	0\|0	1\|1
12	2050130	ET INFO Observed Online Application Hosting Domain (supabase .co in TLS SNI)	0\|0	2\|2	2\|2	0\|0	0\|0	0\|0
13	2057036	ET EXPLOIT_KIT Balada Domain in TLS SNI (broworker10s .com)	0\|0	4\|4	0\|0	0\|0	0\|0	0\|0
14	2021701	ET GAMES MINECRAFT Server response inbound	0\|0	3\|0	0\|0	0\|0	0\|0	0\|0
15	2049251	ET INFO Observed FingerprintJS Domain (openfpcdn .io in TLS SNI)	0\|0	2\|0	1\|1	0\|0	0\|0	0\|0
16	36674245	HackTool.Nmap.TLS.C&C	0\|0	0\|0	0\|0	0\|0	0\|0	3\|3
17	2023753	ET SCAN MS Terminal Server Traffic on Non-standard Port	0\|0	0\|0	0\|0	0\|0	0\|0	3\|3
18	2054246	ET ATTACK_RESPONSE Eval Hex Obfuscated JS Inbound	0\|0	1\|0	0\|0	0\|0	0\|0	0\|0
19	2038967	ET INFO SSH-2.0-Go version string Observed in Network Traffic	0\|0	1\|1	0\|0	0\|0	0\|0	0\|0
20	1006206	Browsec-VPN	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
21	2060251	ET INFO Go-http-client User-Agent Observed Outbound	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
22	2014788	ET DYN_DNS DYNAMIC_DNS HTTP Request to a 3322.net Domain *.3322.net	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
23	2017499	ET ATTACK_RESPONSE Probably Evil Long Unicode string only string and unescape 1	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
24	1006914	Possible trojan activity (base64-encoded content)	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
25	1003302	Anonymizer detected	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
26	2018383	ET EXPLOIT Possible OpenSSL HeartBleed Large HeartBeat Response from Common SSL Port (Outbound from Client)	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
27	2012252	ET SHELLCODE Common 0a0a0a0a Heap Spray String	0\|0	0\|0	0\|0	0\|0	0\|0	1\|1
28	2048493	ET INFO ISO File Downloaded	0\|0	0\|0	0\|0	0\|0	0\|0	1\|1

Выводы по эксперименту:

на третьем временном интервале появились новые события безопасности, на которых обучения ML IDS не проводилось и классификатор из не "видит". В качестве эксперимента попробуем переобучить систему и добавить ошибочные вектора из файла dataset_3.

Эксперимент 5.

Исходными данными для эксперимента возьмем датасеты эксперимента 4 + добавим только ошибочные вектора (вектора с "пропуском" цели) из файла dataset_3.

Эксперимент 5. Оценка качества классификатора сетевого трафика.

Набор данных	Матрица ошибок	Показатели качества классификации
dataset_1.csv	clear as clear (TN-true negative): 9999111 clear as attack (FP-false positive): 4 attack as clear (FN-false negative): 3 attack as attack (TP-true positive): 882	accuracy = 0.9999 precision = 0.9954 recall = 0.9966 f1-score = 0.9960
dataset_2.csv	clear as clear (TN-true negative): 9998235 clear as attack (FP-false positive): 1 attack as clear (FN-false negative): 32 attack as attack (TP-true positive): 1732	accuracy = 0.9999 precision = 0.9994 recall = 0.9818 f1-score = 0.9905
dataset_3.csv	clear as clear (TN-true negative): 9997641 clear as attack (FP-false positive): 19 attack as clear (FN-false negative): 24 attack as attack (TP-true positive): 2316	accuracy = 0.9999 precision = 0.9918 recall = 0.9897 f1-score = 0.9908
dataset_4.csv	clear as clear (TN-true negative): 9999967 clear as attack (FP-false positive): 2 attack as clear (FN-false negative): 0 attack as attack (TP-true positive): 31	accuracy = 0.9999 precision = 0.9393 recall = 1.0 f1-score = 0.9687
dataset_5.csv	clear as clear (TN-true negative): 9999951 clear as attack (FP-false positive): 2 attack as clear (FN-false negative): 0 attack as attack (TP-true positive): 47	accuracy = 0.9999 precision = 0.9591 recall = 1.0 f1-score = 0.9791
dataset_6.csv	clear as clear (TN-true negative): 5545527 clear as attack (FP-false positive): 35 attack as clear (FN-false negative): 45 attack as attack (TP-true positive): 3364	accuracy = 0.9999 precision = 0.9897 recall = 0.9867 f1-score = 0.9882

Время обучения модели 39 мин 38 сек, время классификации 55 млн. векторов – 8 мин 12 сек.

Эксперимент 5. Таблица ошибок «пропуска» цели.

№ п/п	sid	Описание	dataset_1	dataset_2	dataset_3	dataset_4	dataset_5	dataset_6
1	2028762	ET JA3 Hash - [Abuse.ch] Possible Trickbot	688\|0	1424\|0	1954\|0	0\|0	0\|0	3036\|2
2	2014819	ET INFO Packed Executable Download	145\|0	224\|1	261\|5	31\|0	47\|0	278\|29
3	2022082	ET INFO External IP Lookup ip-api.com	0\|0	46\|0	66\|6	0\|0	0\|0	73\|2
4	2035303	ET INFO Observed Chocolatey Windows Package Management Domain (chocolatey .org in TLS SNI)	19\|0	18\|0	27\|1	0\|0	0\|0	5\|0
5	1006213	MultiProxy Firefox Add-ons	33\|3	3\|0	0\|0	0\|0	0\|0	0\|0
6	2026521	ET USER_AGENTS Suspicious User-Agent (Windows 10)	0\|0	26\|26	6\|6	0\|0	0\|0	0\|0
7	58565362	Trojan-PSW.Agent.HTTP.C&C	0\|0	8\|0	5\|0	0\|0	0\|0	1\|0
8	2027762	ET REMOTE_ACCESS AnyDesk Remote Desktop Software User-Agent	0\|0	0\|0	2\|1	0\|0	0\|0	4\|2
9	2013927	ET INFO HTTP traffic on port 443 (HEAD)	0\|0	2\|0	2\|0	0\|0	0\|0	1\|0
10	2017398	ET INFO IP Check Domain (icanhazip. com in HTTP Host)	0\|0	0\|0	3\|1	0\|0	0\|0	2\|1
11	2043310	ET HUNTING DDoS-Guard Hosted Content	0\|0	0\|0	4\|0	0\|0	0\|0	1\|1
12	2050130	ET INFO Observed Online Application Hosting Domain (supabase .co in TLS SNI)	0\|0	2\|0	2\|0	0\|0	0\|0	0\|0
13	2057036	ET EXPLOIT_KIT Balada Domain in TLS SNI (broworker10s .com)	0\|0	4\|4	0\|0	0\|0	0\|0	0\|0
14	2021701	ET GAMES MINECRAFT Server response inbound	0\|0	3\|0	0\|0	0\|0	0\|0	0\|0
15	2049251	ET INFO Observed FingerprintJS Domain (openfpcdn .io in TLS SNI)	0\|0	2\|0	1\|1	0\|0	0\|0	0\|0
16	36674245	HackTool.Nmap.TLS.C&C	0\|0	0\|0	0\|0	0\|0	0\|0	3\|3
17	2023753	ET SCAN MS Terminal Server Traffic on Non-standard Port	0\|0	0\|0	0\|0	0\|0	0\|0	3\|3
18	2054246	ET ATTACK_RESPONSE Eval Hex Obfuscated JS Inbound	0\|0	1\|0	0\|0	0\|0	0\|0	0\|0
19	2038967	ET INFO SSH-2.0-Go version string Observed in Network Traffic	0\|0	1\|1	0\|0	0\|0	0\|0	0\|0
20	1006206	Browsec-VPN	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
21	2060251	ET INFO Go-http-client User-Agent Observed Outbound	0\|0	0\|0	1\|0	0\|0	0\|0	0\|0
22	2014788	ET DYN_DNS DYNAMIC_DNS HTTP Request to a 3322.net Domain *.3322.net	0\|0	0\|0	1\|0	0\|0	0\|0	0\|0
23	2017499	ET ATTACK_RESPONSE Probably Evil Long Unicode string only string and unescape 1	0\|0	0\|0	1\|0	0\|0	0\|0	0\|0
24	1006914	Possible trojan activity (base64-encoded content)	0\|0	0\|0	1\|0	0\|0	0\|0	0\|0
25	1003302	Anonymizer detected	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
26	2018383	ET EXPLOIT Possible OpenSSL HeartBleed Large HeartBeat Response from Common SSL Port (Outbound from Client)	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
27	2012252	ET SHELLCODE Common 0a0a0a0a Heap Spray String	0\|0	0\|0	0\|0	0\|0	0\|0	1\|1
28	2048493	ET INFO ISO File Downloaded	0\|0	0\|0	0\|0	0\|0	0\|0	1\|1

Выводы по эксперименту 5:

добавление в обучающую выборку новых векторов атак, которые ранее не встречались, может приводить к положительному результату (строки 10, 11, 21, 22, 23, 24) однако могут появляться дополнительные ложные срабатывания (для выяснения причин необходимо оценить близость новых векторов до «чистых»);
иногда добавление информации об атаках не приносит ни какого результата или качество распознавания этих атак не высокое (строки 8, 20, 25, 26);
интересная для анализа строка 2 (событие «ET INFO Packed Executable Download», суть данного правила раскрыта выше). Добавление новой информации о такой атаке с одной стороны позволяет уменьшить пропуск цели на обучающей выборке, а вот обобщающая способность совсем не высокая (ошибки в последнем столбце). При этом, скорее всего, такие правила добавляют ложные срабатывания;
как бы не проходило обучение, но есть атаки, которые все равно не распознаются (например, строки 6, 8). По идеи их необходимо убирать из датасета (устанавливать метку класса Benign).

Общие выводы по проведенному исследованию

ML IDS уровня сети можно построить на уже эксплуатируемой сети связи, опираясь при этом на события безопасности, зарегистрированные с помощью IDS Suricata.
Разметка датасетов с использованием данных срабатываний сигнатурных анализаторов (IDS Suricata / Snort и т.п.) имеет преимущество – тонкая настройка решающих правил сигнатурных анализаторов позволяет убрать большое количество «ложных» срабатываний, на которые операторы систем обнаружения вторжений не «обращают» внимание.
Не все срабатывания IDS Suracata (sid зарегистрированных атак) можно использовать для разметки датасетов:
– много решающих правил сигнатурных анализаторов опираются на поиск исключительно адресной информации: SNI TLS соединений, конкретные IP адреса, обращения к конкретным веб-страницам. Если при разметке датасета будут применены такие sid очень высокая вероятность появления дополнительных «ложных» срабатываний и «пропуска» цели ML IDS;
– для качественного распознавания некоторых атак (sid) необходимо изменение признакового пространства (в проведенном выше исследовании, к таким атакам были отнесены различные способы сканирования портов).
На этапе разметки датасета важно проводить оценку близости векторов признаков сетевых соединений, имеющих разные метки классов. Появление векторов с одинаковыми, или очень близкими значениями векторов признаков, но разными метками классов приводит к существенному ухудшению точности ML моделей. Одной из причин появления одинаковых значениями признаков в векторах, но разными метками классов является несовершенство самого признаковое пространства (т.е. требуется изменения признаков).
Обучающая выборка должна была репрезентативной. ML модель возможно необходимо обучить заново в следующих ситуациях:
– появление новых типов (sid) компьютерных атак;
– модификация или удаление решающих правил сигнатурных анализаторов (раньше был sid и были вектора им соответствующие в датасете, теперь такие же вектора будут иметь другую метку класса);
– изменение количества сотрудников в компании или изменение их трудовых функций (изменение сетевой нагрузки и как следствие влияние трафика пользователей на задержки, маршрутизацию / балансировку трафика в сети и т.п.);
– изменение сетевого оборудования или набора локальных сетевых сервисов компании (изменение задержек в сети связи, маршрутизации / балансировки трафика в сети и т.п.).
Для качественного обучения ML IDS, в нашем случае, требуется 1 недели наблюдения за сетевым трафиком компании (включая, выходные и рабочие дни).
На этапе оценки качества обученной ML модели важно провести анализ ошибок классификации.
Причины ошибок:
– некачественные решающие правила сигнатурных анализаторов (IDS Suricata);
– состязательные атаки на ML модель.
Набор значимых признаков для распознавания разных типов компьютерных атак различный (очевидно, что для распознавания атак типа brute force и для распознавания сканирования портов признаки, отличающие их друг от друга, будут различные).
При сопоставлении событий безопасности IDS Suricata с векторами, характеризующими соответствующие сетевые соединения (session_analyzer или аналогичные утилиты) необходимо учесть следующее:
– метка времени срабатывания решающего правила IDS Suricata чаще всего не совпадает со временем начала сетевого соединения;
– одному и тому же событию безопасности IDS Suricata может соответствовать 2 сетевых соединения – это зависит от точки наблюдения за трафиком (например, session_analyzer может наблюдать за трафиком как до, так и после шлюза). Подробнее можно посмотреть выше в подразделе «Особенности приема сетевого трафика».
Качество ML IDS классификатора по метрики F1-меры при должной разметке датасета может достигать 0.98.

Недостатки проведенного исследования

Использование бинарной классификации при построении ML IDS, что в при практическом внедрении в существующие средства NGFW является на наш взгляд не приемлемым. Нельзя ответить на вопрос – какой класс атаки был зарегистрирован и как реагировать на такое событие?
При построении ML IDS защищаемым объектом была пользовательская сеть, а не конкретный ресурс, по этому на основании полученных результатов невозможно ответить на вопрос: какие классы атак на реальный объект защиты (например, web-сервер) возможно обнаруживать с помощью технологии ML IDS уровня сети.

В наших будущих публикациях постараемся ответить Вам, дорогие читатели, на эти вопросы. До скорой встречи!

Источник

Теги

ICO

Категория

Новости

Дата

26 мар. 2026 г.

18.02.26 00:01 Lilyfox

GENERAL HACKING AND CRYPTO RECOVERY SERVICES These group of CYBER GURUS below helped my family in recovering stolen bitcoin worth of $168,000 USD by scammers and they also helped me in securing a university title in one of the best university in the world I'm saying a very big thank you to them contact them now ; [email protected] or WhatsApp +447476606228 -Recovery of funds from fake platform/BINARY TRADING - Retrieval of fraudulent funds - Bank Transfer service - BITCOIN TOP UP - Money, recovery from any country in the world - Change of university degrees - Spying of all social media account within - Sales of Blank ATM and Credit Cards - Sales of university Titles originals. - Clearing of bank debts - University title offer and so many others ... Despite all odds these internet gurus have proven themselves worthy to be called a professional Cyber genius ... once again i beat up my chest to confess that these group of cyber gurus are reliable and satisfactory with 100% reliability.....
18.02.26 03:23 walterlindahi9

This past January, my world came crashing down. I lost nearly $42,000 of my hard-earned savings to a sophisticated Solana-based crypto scam. At first, it all seemed legitimate: sleek website, professional whitepaper, even glowing testimonials from “investors.” I’d done my homework, or so I thought. The promise of high returns in a volatile market felt like my ticket to financial freedom. For the first few months, everything appeared to be working. My portfolio showed steady gains. I remember checking my wallet balance daily, feeling a mix of pride and relief. I’ve cracked the code to building real wealth. Then, without warning, the platform vanished. Wallet addresses went dead. Support channels disappeared, and my funds were gone in an instant. The emotional fallout was worse than the financial loss. Sleepless nights became the norm. Anxiety gnawed at me constantly. I replayed every decision in my head, blaming myself for being naive. I vowed never to trust anyone again, not influencers, not experts, not even my own judgment. But giving up wasn’t an option. I owed it to myself and to my future to fight back. So I began digging. I scoured Reddit threads, filed reports with blockchain analytics firms, and even contacted local authorities (though they offered little help). The more I searched, the more overwhelmed I became, lost in a labyrinth of technical jargon, dead ends, and predatory recovery services asking for upfront fees. Then, through a survivor’s forum, I stumbled upon TechY Force Cyber Retrieval. Skeptical but desperate, I reached out. What set them apart wasn’t just their expertise; it was their empathy. They didn’t make wild promises. Instead, they walked me through how crypto tracing works, what success looks like, and what realistic timelines are. No pressure. No false hope. Within weeks, their forensic team identified transaction trails linked to the scam wallet. Using on-chain analysis and coordination with exchanges, they flagged suspicious activity and initiated recovery protocols. It wasn’t magic, but it was methodical, transparent, and grounded in real blockchain intelligence. Today, I’m cautiously optimistic. While not all funds have been recovered yet, TechY Force has already secured a significant portion and, more importantly, restored my sense of agency. I’m sleeping again. I’m healing. If you’ve been scammed, know this: you’re not alone, and you’re not foolish. Crypto fraud preys on hope, but that same hope can fuel your comeback. Don’t suffer in silence. Reach out. Ask questions. And never let a scammer steal your future along with your funds. WhatsApp +1(561) 726 3697 Mail. Techyforcecyberretrieval(@)consultant(.)com Telegram (@)TechCyberforc
22.02.26 03:48 harristhomas7376

"In the crypto world, this is great news I want to share. Last year, I fell victim to a scam disguised as a safe investment option. I have invested in crypto trading platforms for about 10yrs thinking I was ensuring myself a retirement income, only to find that all my assets were either frozen, I believed my assets were secure — until I discovered that my BTC funds had been frozen and withdrawals were impossible. It was a devastating moment when I realized I had been scammed, and I thought my Bitcoin was gone forever, Everything changed when a close friend recommended the Capital Crypto Recover Service. Their professionalism, expertise, and dedication enabled me to recover my lost Bitcoin funds back — more than €560.000 DEM to my BTC wallet. What once felt impossible became a reality thanks to their support. If you have lost Bitcoin through scams, hacking, failed withdrawals, or similar challenges, don’t lose hope. I strongly recommend Capital Crypto Recover Service to anyone seeking a reliable and effective solution for recovering any wallet assets. They have a proven track record of successful reputation in recovering lost password assets for their clients and can help you navigate the process of recovering your funds. Don’t let scammers get away with your hard-earned money – contact Email: [email protected] Phone CALL/Text Number: +1 (336) 390-6684 Contact: [email protected] Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
22.02.26 03:49 harristhomas7376

"In the crypto world, this is great news I want to share. Last year, I fell victim to a scam disguised as a safe investment option. I have invested in crypto trading platforms for about 10yrs thinking I was ensuring myself a retirement income, only to find that all my assets were either frozen, I believed my assets were secure — until I discovered that my BTC funds had been frozen and withdrawals were impossible. It was a devastating moment when I realized I had been scammed, and I thought my Bitcoin was gone forever, Everything changed when a close friend recommended the Capital Crypto Recover Service. Their professionalism, expertise, and dedication enabled me to recover my lost Bitcoin funds back — more than €560.000 DEM to my BTC wallet. What once felt impossible became a reality thanks to their support. If you have lost Bitcoin through scams, hacking, failed withdrawals, or similar challenges, don’t lose hope. I strongly recommend Capital Crypto Recover Service to anyone seeking a reliable and effective solution for recovering any wallet assets. They have a proven track record of successful reputation in recovering lost password assets for their clients and can help you navigate the process of recovering your funds. Don’t let scammers get away with your hard-earned money – contact Email: [email protected] Phone CALL/Text Number: +1 (336) 390-6684 Contact: [email protected] Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
22.02.26 18:58 Natasha Williams

I am Natasha Williams from Dallas. I want to share my testimony to encourage anyone who has ever fallen victim to a scam or fraud. Some time ago, I was defrauded by some fraudulent cryptocurrency investment organization online, I was a victim and I lost a huge amount of money, $382,000. I felt angry, disappointed and helpless but I refused to give up and stay calm. I came across this agency, GREAT WHIP RECOVERY CYBER SERVICES.. who helped people recover their money from scammers and the testimonies I saw were quite amazing. And I decided to contact them. I gathered every piece of evidence, chats, receipts, account details, and messages and reported the case to the agency, GREAT WHIP RECOVERY CYBER SERVICES. After 73hours of follow up and not losing faith, the fraudster was traced and held accountable and I recovered all my money back. I highly recommend, GREAT WHIP RECOVERY CYBER SERVICES agency if you have ever fallen victim to scammers, you can contact them. Website: https://greatwhiprecoveryc.wixsite.com/greatwhip-site email: [email protected] Call Line: +1(406)2729101
22.02.26 19:00 Natasha Williams

I am Natasha Williams from Dallas. I want to share my testimony to encourage anyone who has ever fallen victim to a scam or fraud. Some time ago, I was defrauded by some fraudulent cryptocurrency investment organization online, I was a victim and I lost a huge amount of money, $382,000. I felt angry, disappointed and helpless but I refused to give up and stay calm. I came across this agency, GREAT WHIP RECOVERY CYBER SERVICES.. who helped people recover their money from scammers and the testimonies I saw were quite amazing. And I decided to contact them. I gathered every piece of evidence, chats, receipts, account details, and messages and reported the case to the agency, GREAT WHIP RECOVERY CYBER SERVICES. After 73hours of follow up and not losing faith, the fraudster was traced and held accountable and I recovered all my money back. I highly recommend, GREAT WHIP RECOVERY CYBER SERVICES agency if you have ever fallen victim to scammers, you can contact them. Website: https://greatwhiprecoveryc.wixsite.com/greatwhip-site email: [email protected] Call Line: +1(406)2729101
23.02.26 23:26 chongfook

As cryptocurrencies continue to reshape global finance in 2026, the risks have never been higher. From sophisticated phishing campaigns to fake wallet apps and investment scams, millions of investors face the devastating reality of lost or stolen digital assets. When your crypto vanishes, panic sets in—and that's when fraudsters strike again, posing as "recovery experts" to exploit your vulnerability. CONTACTS US Techyforcecyberretrieval(@)consultant(.)com https(://)techyforcecyberretrieval(.)com But there's a legitimate path forward. TECHY FORCE CYBER RETRIEVAL stands as the industry's most trusted crypto recovery company, combining advanced blockchain forensics, global partnerships, and a client-centric approach to help victims reclaim what was stolen. --- Why Recovery Is Possible—With the Right Team Cryptocurrency's decentralized, pseudonymous nature makes asset recovery complex—but not impossible. The blockchain is transparent. Every transaction leaves a trail. The challenge isn't finding the funds—it's having the expertise to follow that trail through mixers, bridges, and exchange deposits before they disappear forever. That's where TECHY FORCE CYBER RETRIEVAL excels. --- Our Proven Recovery Framework We don't believe in shortcuts, false promises, or upfront fees. Our process is built on transparency, forensic precision, and real results. Here's how we work: 1. Case Intake & Initial Assessment You begin by submitting a detailed report: compromised wallet addresses, transaction IDs, timestamps, and any communication with scammers. Our intake team reviews your case within hours to determine immediate next steps. 2. Blockchain Forensic Analysis Our specialists deploy proprietary tracking tools to map the movement of your stolen assets across multiple blockchains. We identify laundering patterns, exchange deposit addresses, and potential freezing points—building a clear investigative roadmap. 3. Global Partner Coordination Through established relationships with regulated exchanges, DeFi protocols, and compliance teams worldwide, we initiate direct communication to flag suspicious transactions and request asset freezes where legally permissible. 4. Legal & Regulatory Engagement When necessary, we collaborate with legal partners and law enforcement agencies to strengthen recovery efforts—especially in cases involving large-scale hacks or organized fraud rings. 5. Recovery Execution & Fund Return Once assets are secured, they're transferred directly to a new, secure wallet of your choice. We never hold your funds. And critically, we operate on a success-only model. You pay nothing unless we recover your assets. 6. Post-Recovery Security Guidance Recovery is only half the battle. We provide personalized recommendations to secure your remaining holdings—from hardware wallet setup to phishing awareness training—so you can move forward with confidence. --- What Sets TECHY FORCE CYBER RETRIEVAL Apart While countless "recovery services" flood the internet, few deliver legitimate results. Here's why we're consistently rated the best crypto recovery company in 2026: - Zero Upfront Fees – We only succeed when you do. No hidden charges. No bait-and-switch tactics. - Advanced Blockchain Intelligence – Our forensic tools track assets across Bitcoin, Ethereum, Solana, and 50+ other networks. - Global Reach – Partnerships with exchanges and regulatory bodies in North America, Europe, and Asia maximize recovery odds. - Client-First Communication – Weekly updates. Clear timelines. No ghosting. - Proven Track Record – Hundreds of successful recoveries in 2025–2026, with millions returned to rightful owners. --- Emerging Trends in 2026: What Victims Need to Know The threat landscape evolves constantly. This year's biggest risks include: - AI-Powered Phishing: Scammers now use deepfake voice and video to impersonate support staff. - Cross-Chain Bridge Exploits: Funds moved between networks are increasingly targeted. - Fake Recovery Services: Fraudsters pose as legitimate firms—always verify credentials before sharing information. TECHY FORCE CYBER RETRIEVAL stays ahead of these threats, continuously updating our tools and strategies to protect and serve our clients. CONTACTS US Techyforcecyberretrieval(@)consultant(.)com https(://)techyforcecyberretrieval(.)com --- Your Next Step If you've lost crypto to a scam, hack, or forgotten credentials, don't let despair—or another fraudster—steal your second chance. TECHY FORCE CYBER RETRIEVAL is accessible, transparent, and ready to help. Reach out today. Let our experts assess your case—and show you that even in 2026, stolen crypto doesn't have to stay lost forever. — TECHY FORCE CYBER RETRIEVAL Advanced Forensics. Global Reach. Your Recovery.
24.02.26 15:31 [email protected]`

Like many others, I was drawn in by the allure of cryptocurrency and the promise of financial freedom. When I encountered a self-proclaimed "crypto guru" online, his confidence and flashy lifestyle convinced me that he held the key to success. Eager to learn, I parted with $15,000 for his exclusive course, believing it would grant me access to an elite trading group and lucrative market insights. Initially, my excitement was palpable; I truly thought I was on the verge of a breakthrough. However, that enthusiasm quickly curdled into dread. Once inside the group, the dynamic shifted from education to aggressive exploitation. Instead of genuine mentorship, members were relentlessly upsold on fake trading signals that yielded nothing but losses. The pressure escalated when we were encouraged to invest in a supposed "private pool," which required an additional, staggering access fee of $60,000. It was only as I began to notice glaring inconsistencies and a complete lack of real results among the members that the fog lifted. I realized I hadn't joined a community of traders; I had walked into a sophisticated trap designed specifically to prey on newcomers like myself. The realization that the promises of wealth and insider knowledge were nothing more than a façade left me feeling vulnerable, deceived, and financially devastated. The dream of easy returns had turned into a heavy burden of regret. Desperate for a solution and refusing to let the fraudsters win, I began searching for help. That is when I discovered DIGITAL LIGHT SOLUTION, a firm specializing in online fraud investigations. Reaching out to them was the turning point. Their team approached my case with professionalism and empathy, immediately understanding the complexity of the scam. They guided me through the investigation process, uncovering the layers of deception used by the "guru" and his network. Thanks to their expertise and relentless pursuit of justice, I was able to navigate the aftermath of this ordeal with clarity rather than confusion. While the experience was a harsh lesson, connecting with DIGITAL LIGHT SOLUTION restored my hope and proved that there are still allies ready to fight against online exploitation. If you find yourself in a similar situation, do not lose hope—seek professional help immediately. Contact them directly Website https://digitallightsolution.com/ Email — Digitallightsolution(At)qualityservice(DOT)com What's App — https://wa.link/989vlf
24.02.26 15:32 [email protected]`

Like many others, I was drawn in by the allure of cryptocurrency and the promise of financial freedom. When I encountered a self-proclaimed "crypto guru" online, his confidence and flashy lifestyle convinced me that he held the key to success. Eager to learn, I parted with $15,000 for his exclusive course, believing it would grant me access to an elite trading group and lucrative market insights. Initially, my excitement was palpable; I truly thought I was on the verge of a breakthrough. However, that enthusiasm quickly curdled into dread. Once inside the group, the dynamic shifted from education to aggressive exploitation. Instead of genuine mentorship, members were relentlessly upsold on fake trading signals that yielded nothing but losses. The pressure escalated when we were encouraged to invest in a supposed "private pool," which required an additional, staggering access fee of $60,000. It was only as I began to notice glaring inconsistencies and a complete lack of real results among the members that the fog lifted. I realized I hadn't joined a community of traders; I had walked into a sophisticated trap designed specifically to prey on newcomers like myself. The realization that the promises of wealth and insider knowledge were nothing more than a façade left me feeling vulnerable, deceived, and financially devastated. The dream of easy returns had turned into a heavy burden of regret. Desperate for a solution and refusing to let the fraudsters win, I began searching for help. That is when I discovered DIGITAL LIGHT SOLUTION, a firm specializing in online fraud investigations. Reaching out to them was the turning point. Their team approached my case with professionalism and empathy, immediately understanding the complexity of the scam. They guided me through the investigation process, uncovering the layers of deception used by the "guru" and his network. Thanks to their expertise and relentless pursuit of justice, I was able to navigate the aftermath of this ordeal with clarity rather than confusion. While the experience was a harsh lesson, connecting with DIGITAL LIGHT SOLUTION restored my hope and proved that there are still allies ready to fight against online exploitation. If you find yourself in a similar situation, do not lose hope—seek professional help immediately. Contact them directly Website https://digitallightsolution.com/ Email — Digitallightsolution(At)qualityservice(DOT)com What's App — https://wa.link/989vlf
26.02.26 16:29 michaeldavenport238

I was recently scammed out of $53,000 by a fraudulent Bitcoin investment scheme, which added significant stress to my already difficult health issues, as I was also facing cancer surgery expenses. Desperate to recover my funds, I spent hours researching and consulting other victims, which led me to discover the excellent reputation of Capital Crypto Recover, I came across a Google post It was only after spending many hours researching and asking other victims for advice that I discovered Capital Crypto Recovery’s stellar reputation. I decided to contact them because of their successful recovery record and encouraging client testimonials. I had no idea that this would be the pivotal moment in my fight against cryptocurrency theft. Thanks to their expert team, I was able to recover my lost cryptocurrency back. The process was intricate, but Capital Crypto Recovery's commitment to utilizing the latest technology ensured a successful outcome. I highly recommend their services to anyone who has fallen victim to cryptocurrency fraud. For assistance contact [email protected] and on Telegram OR Call Number +1 (336)390-6684 via email: [email protected] you can visit his website: https://recovercapital.wixsite.com/capital-crypto-rec-1
26.02.26 16:29 michaeldavenport238

I was recently scammed out of $53,000 by a fraudulent Bitcoin investment scheme, which added significant stress to my already difficult health issues, as I was also facing cancer surgery expenses. Desperate to recover my funds, I spent hours researching and consulting other victims, which led me to discover the excellent reputation of Capital Crypto Recover, I came across a Google post It was only after spending many hours researching and asking other victims for advice that I discovered Capital Crypto Recovery’s stellar reputation. I decided to contact them because of their successful recovery record and encouraging client testimonials. I had no idea that this would be the pivotal moment in my fight against cryptocurrency theft. Thanks to their expert team, I was able to recover my lost cryptocurrency back. The process was intricate, but Capital Crypto Recovery's commitment to utilizing the latest technology ensured a successful outcome. I highly recommend their services to anyone who has fallen victim to cryptocurrency fraud. For assistance contact [email protected] and on Telegram OR Call Number +1 (336)390-6684 via email: [email protected] you can visit his website: https://recovercapital.wixsite.com/capital-crypto-rec-1
27.02.26 00:08 sanayoliver

I spend my days studying the mysteries of the universe, delving into black holes, quantum mechanics, and the nature of time itself. But apparently, the real black hole I should have been concerned about was my own memory. I encrypted my Bitcoin wallet to keep it as secure as possible. The problem? I promptly forgot the password. Classic, right? It didn't help that this wasn't just pocket change I was dealing with. No, I had $190,000 in Bitcoin sitting in that wallet, and my mind had decided to take a vacation, leaving me with absolutely no idea what that password was. The panic set in fast. My brain, which could solve some of the most complex physics equations, couldn't remember a 12-character password. It felt like my entire financial future was being sucked into a black hole, one I'd created myself. Desperate, I tried everything. I thought I could outsmart the system, using every trick I could think of. I tried variations of passwords I thought I might have used, analyzing them through the lens of my own behavioral patterns. I even resorted to good ol' brute force, typing random combinations for hours, hoping that maybe, just maybe, my subconscious would strike gold. Spoiler alert: it didn't. Each failed attempt made me feel more and more like a genius who'd locked themselves out of their own universe. In a final act of desperation, admitting that theoretical physics couldn't crack my own encryption, I contacted TechY Force Cyber Retrieval. From the moment I reached out, the difference was night and day. While I had been flailing in the dark, they approached my case with a precision that rivaled the calculations I do daily. They didn't promise miracles; they promised a methodical, advanced recovery process. Within a surprisingly short timeframe, they utilized specialized tools to bypass the mental block I couldn't overcome. When they finally recovered the wallet and confirmed the full $190,000 was intact and accessible, the relief was indescribable. It was as if I had pulled my financial future back from the event horizon just before it was lost forever. To anyone thinking they are too smart to lose their keys, or too logical to make such a mistake: don't wait until you are staring into the abyss. If you find yourself in a situation where your own memory has become your greatest enemy, trust the experts at TechY Force Cyber Retrieval. They turned my personal black hole into a success story, proving that sometimes, even the brightest minds need a little help to find the light. REACH OUT TO THEM ON MAIL [email protected]
27.02.26 02:04 elizabethmadison

My name is Elizabeth Madison currently living in New York. There was a time I felt completely broken. I had trusted a fraudulent bitcoin investment organization, who turned out to be a fraudster. I sent money, believing their sweet words and promises on the interest rate I will get back in return, only to realize later that I’ve been scammed. On the day of withdrawal there was no money in my account. The pain hit deep. I couldn’t sleep, I kept asking myself how I could have been so careless, meanwhile my mom was battling with a stroke and the expenses were too much. For days, I cried and blamed myself. The betrayal, the disappointment and my mom's health issues all of this stress made me want to give up on life. But one day, I decided that sitting in pain wouldn’t solve anything. I picked myself up and chose to fight for what I lost then I came across GREAT WHIP RECOVERY CYBER SERVICES and saw how he helped people recover their funds from online fraud. I emailed all the transactions and paperwork I had with the fraudulent organization and they helped me recover all my lost money in just five days. If you have ever fallen victim to scammers, contact GREAT WHIP RECOVERY CYBER SERVICES to help you recover every penny you have lost. (Text +1(406)2729101) (Website https://greatwhiprecoveryc.wixsite.com/greatwhip-site) (Email [email protected])
27.02.26 02:04 elizabethmadison

My name is Elizabeth Madison currently living in New York. There was a time I felt completely broken. I had trusted a fraudulent bitcoin investment organization, who turned out to be a fraudster. I sent money, believing their sweet words and promises on the interest rate I will get back in return, only to realize later that I’ve been scammed. On the day of withdrawal there was no money in my account. The pain hit deep. I couldn’t sleep, I kept asking myself how I could have been so careless, meanwhile my mom was battling with a stroke and the expenses were too much. For days, I cried and blamed myself. The betrayal, the disappointment and my mom's health issues all of this stress made me want to give up on life. But one day, I decided that sitting in pain wouldn’t solve anything. I picked myself up and chose to fight for what I lost then I came across GREAT WHIP RECOVERY CYBER SERVICES and saw how he helped people recover their funds from online fraud. I emailed all the transactions and paperwork I had with the fraudulent organization and they helped me recover all my lost money in just five days. If you have ever fallen victim to scammers, contact GREAT WHIP RECOVERY CYBER SERVICES to help you recover every penny you have lost. (Text +1(406)2729101) (Website https://greatwhiprecoveryc.wixsite.com/greatwhip-site) (Email [email protected])
27.02.26 15:57 luciajessy3

Don’t be deceived by different testimonies online that is most likely wrong. I have made use of several recovery options that got me disappointed at the end of the day but I must confess that the tech genius I eventually found is the best out here. It’s better you devise your time to find the valid professional that can help you recover your stolen or lost crypto such as bitcoins rather than falling victim of other amateur hackers that cannot get the job done. ADAMWILSON . TRADING @ CONSULTANT COM / is the most reliable and authentic blockchain tech expert you can work with to recover what you lost to scammers. They helped me get back on my feet and I’m very grateful for that. Contact their email today to recover your lost coins ASAP…
27.02.26 15:59 wendytaylor015

My name is Wendy Taylor, I'm from Los Angeles, i want to announce to you Viewer how Capital Crypto Recover help me to restore my Lost Bitcoin, I invested with a Crypto broker without proper research to know what I was hoarding my hard-earned money into scammers, i lost access to my crypto wallet or had your funds stolen? Don’t worry Capital Crypto Recover is here to help you recover your cryptocurrency with cutting-edge technical expertise, With years of experience in the crypto world, Capital Crypto Recover employs the best latest tools and ethical hacking techniques to help you recover lost assets, unlock hacked accounts, Whether it’s a forgotten password, Capital Crypto Recover has the expertise to help you get your crypto back. a security company service that has a 100% success rate in the recovery of crypto assets, i lost wallet and hacked accounts. I provided them the information they requested and they began their investigation. To my surprise, Capital Crypto Recover was able to trace and recover my crypto assets successfully within 24hours. Thank you for your service in helping me recover my $647,734 worth of crypto funds and I highly recommend their recovery services, they are reliable and a trusted company to any individuals looking to recover lost money. Contact email [email protected] OR Telegram @Capitalcryptorecover Call/Text Number +1 (336)390-6684 his contact: [email protected] His website: https://recovercapital.wixsite.com/capital-crypto-rec-1
27.02.26 15:59 wendytaylor015

My name is Wendy Taylor, I'm from Los Angeles, i want to announce to you Viewer how Capital Crypto Recover help me to restore my Lost Bitcoin, I invested with a Crypto broker without proper research to know what I was hoarding my hard-earned money into scammers, i lost access to my crypto wallet or had your funds stolen? Don’t worry Capital Crypto Recover is here to help you recover your cryptocurrency with cutting-edge technical expertise, With years of experience in the crypto world, Capital Crypto Recover employs the best latest tools and ethical hacking techniques to help you recover lost assets, unlock hacked accounts, Whether it’s a forgotten password, Capital Crypto Recover has the expertise to help you get your crypto back. a security company service that has a 100% success rate in the recovery of crypto assets, i lost wallet and hacked accounts. I provided them the information they requested and they began their investigation. To my surprise, Capital Crypto Recover was able to trace and recover my crypto assets successfully within 24hours. Thank you for your service in helping me recover my $647,734 worth of crypto funds and I highly recommend their recovery services, they are reliable and a trusted company to any individuals looking to recover lost money. Contact email [email protected] OR Telegram @Capitalcryptorecover Call/Text Number +1 (336)390-6684 his contact: [email protected] His website: https://recovercapital.wixsite.com/capital-crypto-rec-1
27.02.26 16:00 wendytaylor015

My name is Wendy Taylor, I'm from Los Angeles, i want to announce to you Viewer how Capital Crypto Recover help me to restore my Lost Bitcoin, I invested with a Crypto broker without proper research to know what I was hoarding my hard-earned money into scammers, i lost access to my crypto wallet or had your funds stolen? Don’t worry Capital Crypto Recover is here to help you recover your cryptocurrency with cutting-edge technical expertise, With years of experience in the crypto world, Capital Crypto Recover employs the best latest tools and ethical hacking techniques to help you recover lost assets, unlock hacked accounts, Whether it’s a forgotten password, Capital Crypto Recover has the expertise to help you get your crypto back. a security company service that has a 100% success rate in the recovery of crypto assets, i lost wallet and hacked accounts. I provided them the information they requested and they began their investigation. To my surprise, Capital Crypto Recover was able to trace and recover my crypto assets successfully within 24hours. Thank you for your service in helping me recover my $647,734 worth of crypto funds and I highly recommend their recovery services, they are reliable and a trusted company to any individuals looking to recover lost money. Contact email [email protected] OR Telegram @Capitalcryptorecover Call/Text Number +1 (336)390-6684 his contact: [email protected] His website: https://recovercapital.wixsite.com/capital-crypto-rec-1
27.02.26 16:01 luciajessy3

Don’t be deceived by different testimonies online that is most likely wrong. I have made use of several recovery options that got me disappointed at the end of the day but I must confess that the tech genius I eventually found is the best out here. It’s better you devise your time to find the valid professional that can help you recover your stolen or lost crypto such as bitcoins rather than falling victim of other amateur hackers that cannot get the job done. ADAMWILSON . TRADING @ CONSULTANT COM / is the most reliable and authentic blockchain tech expert you can work with to recover what you lost to scammers. They helped me get back on my feet and I’m very grateful for that. Contact their email today to recover your lost coins ASAP…
27.02.26 16:01 luciajessy3

Don’t be deceived by different testimonies online that is most likely wrong. I have made use of several recovery options that got me disappointed at the end of the day but I must confess that the tech genius I eventually found is the best out here. It’s better you devise your time to find the valid professional that can help you recover your stolen or lost crypto such as bitcoins rather than falling victim of other amateur hackers that cannot get the job done. ADAMWILSON . TRADING @ CONSULTANT COM / is the most reliable and authentic blockchain tech expert you can work with to recover what you lost to scammers. They helped me get back on my feet and I’m very grateful for that. Contact their email today to recover your lost coins ASAP…
27.02.26 16:01 luciajessy3

Don’t be deceived by different testimonies online that is most likely wrong. I have made use of several recovery options that got me disappointed at the end of the day but I must confess that the tech genius I eventually found is the best out here. It’s better you devise your time to find the valid professional that can help you recover your stolen or lost crypto such as bitcoins rather than falling victim of other amateur hackers that cannot get the job done. ADAMWILSON . TRADING @ CONSULTANT COM / is the most reliable and authentic blockchain tech expert you can work with to recover what you lost to scammers. They helped me get back on my feet and I’m very grateful for that. Contact their email today to recover your lost coins ASAP…
01.03.26 10:48 marcushenderson624

Bitcoin Recovery Testimonial After falling victim to a cryptocurrency scam group, I lost $354,000 worth of USDT. I thought all hope was lost from the experience of losing my hard-earned money to scammers. I was devastated and believed there was no way to recover my funds. Fortunately, I started searching for help to recover my stolen funds and I came across a lot of testimonials online about Capital Crypto Recovery, an agent who helps in recovery of lost bitcoin funds, I contacted Capital Crypto Recover Service, and with their expertise, they successfully traced and recovered my stolen assets. Their team was professional, kept me updated throughout the process, and demonstrated a deep understanding of blockchain transactions and recovery protocols. They are trusted and very reliable with a 100% successful rate record Recovery bitcoin, I’m grateful for their help and highly recommend their services to anyone seeking assistance with lost crypto. Contact: [email protected] Phone CALL/Text Number: +1 (336) 390-6684 Email: [email protected] Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
01.03.26 10:48 marcushenderson624

Bitcoin Recovery Testimonial After falling victim to a cryptocurrency scam group, I lost $354,000 worth of USDT. I thought all hope was lost from the experience of losing my hard-earned money to scammers. I was devastated and believed there was no way to recover my funds. Fortunately, I started searching for help to recover my stolen funds and I came across a lot of testimonials online about Capital Crypto Recovery, an agent who helps in recovery of lost bitcoin funds, I contacted Capital Crypto Recover Service, and with their expertise, they successfully traced and recovered my stolen assets. Their team was professional, kept me updated throughout the process, and demonstrated a deep understanding of blockchain transactions and recovery protocols. They are trusted and very reliable with a 100% successful rate record Recovery bitcoin, I’m grateful for their help and highly recommend their services to anyone seeking assistance with lost crypto. Contact: [email protected] Phone CALL/Text Number: +1 (336) 390-6684 Email: [email protected] Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
03.03.26 14:09 Thomas Muller

YOU CAN REACH OUT TO GREAT WHIP RECOVERY CYBER SERVICES FOR HELP TO RECOVER YOUR STOLEN BTC OR ETH BACK CALL:+1(406)2729101 I once fell victim to online investment scheme that cost me a devastating €254,000. I’m Thomas Muller from Berlin, Germany. The person I trusted turned out to be a fraud, and the moment I realized I’d been deceived, my entire world stopped. I immediately began searching for legitimate ways to recover my funds and hold the scammer accountable. During my search, I came across several testimonies of how Great Whip Recovery Cyber Services helped some people recover money they lost to cyber fraud, I contacted Great Whip Recovery Cyber Service team and provided all the evidence I had. Within about 36 hours, the experts traced the digital trail left by the fraudster, the individual was eventually tracked down and I recovered all my money back. You can contact them with, website https://greatwhiprecoveryc.wixsite.com/greatwhip-site text +1(406)2729101 email [email protected]
03.03.26 14:09 Thomas Muller

YOU CAN REACH OUT TO GREAT WHIP RECOVERY CYBER SERVICES FOR HELP TO RECOVER YOUR STOLEN BTC OR ETH BACK CALL:+1(406)2729101 I once fell victim to online investment scheme that cost me a devastating €254,000. I’m Thomas Muller from Berlin, Germany. The person I trusted turned out to be a fraud, and the moment I realized I’d been deceived, my entire world stopped. I immediately began searching for legitimate ways to recover my funds and hold the scammer accountable. During my search, I came across several testimonies of how Great Whip Recovery Cyber Services helped some people recover money they lost to cyber fraud, I contacted Great Whip Recovery Cyber Service team and provided all the evidence I had. Within about 36 hours, the experts traced the digital trail left by the fraudster, the individual was eventually tracked down and I recovered all my money back. You can contact them with, website https://greatwhiprecoveryc.wixsite.com/greatwhip-site text +1(406)2729101 email [email protected]
04.03.26 07:21 Jane4

I lost about $600k Bitcoin last year, I searched around and tried to work with some recovery firm unfortunately I was scammed as well. This happened for months until I came across [email protected] They came to my rescue and all my funds were recovered within few days I'm so happy right now .
04.03.26 07:22 Jane4

I lost about $600k Bitcoin last year, I searched around and tried to work with some recovery firm unfortunately I was scammed as well. This happened for months until I came across [email protected] They came to my rescue and all my funds were recovered within few days I'm so happy right now .
04.03.26 12:25 patricialovick86

How To Recover Your Bitcoin Without Falling Victim To Scams: A Testimony Experience With Capital Crypto Recover Services, Contact Telegram: @Capitalcryptorecover Dear Everyone, I would like to take a moment to share my positive experience with Capital Crypto Recover Services. Initially, I was unsure if it would be possible to recover my stolen bitcoins. However, with their expertise and professionalism, I was able to fully recover my funds. Unfortunately, many individuals fall victim to scams in the cryptocurrency space, especially those involving fraudulent investment platforms. However, I advise caution, as not all recovery services are legitimate. I personally lost $273,000 worth of Bitcoin from my Binance account due to a deceptive platform. If you have suffered a similar loss, you may be considering crypto recovery, The Capital Crypto Recover is the most knowledgeable and effective Capital Crypto Recovery Services assisted me in recovering my stolen funds within 24 hours, after getting access to my wallet. Their service was not only prompt but also highly professional and effective, and many recovery services may not be trustworthy. Therefore, I highly recommend Capital Crypto Recover to you. i do always research and see reviews about their service, For assistance finding your misplaced cryptocurrency, get in touch with them, They do their jobs quickly and excellently, Stay safe and vigilant in the crypto world. Contact: [email protected] You can reach them via email at [email protected] OR Call/Text Number +1 (336)390-6684 his contact website: https://recovercapital.wixsite.com/capital-crypto-rec-1
04.03.26 12:25 patricialovick86

How To Recover Your Bitcoin Without Falling Victim To Scams: A Testimony Experience With Capital Crypto Recover Services, Contact Telegram: @Capitalcryptorecover Dear Everyone, I would like to take a moment to share my positive experience with Capital Crypto Recover Services. Initially, I was unsure if it would be possible to recover my stolen bitcoins. However, with their expertise and professionalism, I was able to fully recover my funds. Unfortunately, many individuals fall victim to scams in the cryptocurrency space, especially those involving fraudulent investment platforms. However, I advise caution, as not all recovery services are legitimate. I personally lost $273,000 worth of Bitcoin from my Binance account due to a deceptive platform. If you have suffered a similar loss, you may be considering crypto recovery, The Capital Crypto Recover is the most knowledgeable and effective Capital Crypto Recovery Services assisted me in recovering my stolen funds within 24 hours, after getting access to my wallet. Their service was not only prompt but also highly professional and effective, and many recovery services may not be trustworthy. Therefore, I highly recommend Capital Crypto Recover to you. i do always research and see reviews about their service, For assistance finding your misplaced cryptocurrency, get in touch with them, They do their jobs quickly and excellently, Stay safe and vigilant in the crypto world. Contact: [email protected] You can reach them via email at [email protected] OR Call/Text Number +1 (336)390-6684 his contact website: https://recovercapital.wixsite.com/capital-crypto-rec-1
06.03.26 13:36 CARL9090

In January, my life shifted in a way I never expected. I clicked a trading link given to me by someone I found on Telegram, believing it was legitimate. It looked professional. It felt secure. I trusted it. Until I tried to withdraw my money. Within seconds, everything was gone, transferred into a wallet claiming account without a trace. That was the moment the truth hit me: I had been scammed. The emotional fallout was brutal. For weeks, I couldn’t even speak about it. I thought people would judge me. I thought they’d say I should have known better. Then someone stepped in who changed everything Agent Jasmine Lopez ,She listened without judgment. She treated my fear as real and valid. She traced patterns, uncovered off-chain indicators, and identified wallet clusters linked to a larger scam network. She showed me that what happened wasn’t random it was organized and intentional. For the first time, I felt hope. Hearing that students, parents, and hardworking people had been targeted the same way made me realize this wasn’t stupidity. It was predation. We weren’t careless we were deliberately targeted and manipulated I’m still healing. The experience changed me. But it also reminded me that even in your darkest moment, there can be someone willing to shine a light. Contact her at [email protected] WHATSAPP +44 7478077894
07.03.26 07:46 Jane4

I lost about $600k Bitcoin last year, I searched around and tried to work with some recovery firm unfortunately I was scammed as well. This happened for months until I came across [email protected] They came to my rescue and all my funds were recovered within few days I'm so happy right now .
07.03.26 07:46 Jane4

I lost about $600k Bitcoin last year, I searched around and tried to work with some recovery firm unfortunately I was scammed as well. This happened for months until I came across [email protected] They came to my rescue and all my funds were recovered within few days I'm so happy right now .
07.03.26 08:39 Jane4

I lost about $600k Bitcoin last year, I searched around and tried to work with some recovery firm unfortunately I was scammed as well. This happened for months until I came across [email protected] They came to my rescue and all my funds were recovered within few days I'm so happy right now .
07.03.26 08:55 Jane4

I lost about $600k Bitcoin last year, I searched around and tried to work with some recovery firm unfortunately I was scammed as well. This happened for months until I came across [email protected] They came to my rescue and all my funds were recovered within few days I'm so happy right now .
07.03.26 09:40 Alena76

Most people have been scammed severally and they give up on their funds I'm saying these because I was a victim too After loosing 745,000 USD I lose my mind until I read about COIN HACK RECOVERY I decided to contact the company on: [email protected] and I'm glad I made the decision not to give up. they helped me to recover all my lost funds within two days.
07.03.26 10:37 Alena76

Most people have been scammed severally and they give up on their funds I'm saying these because I was a victim too After loosing 745,000 USD I lose my mind until I read about COIN HACK RECOVERY I decided to contact the company on: [email protected] and I'm glad I made the decision not to give up. they helped me to recover all my lost funds within two days.
07.03.26 10:37 Alena76

Most people have been scammed severally and they give up on their funds I'm saying these because I was a victim too After loosing 745,000 USD I lose my mind until I read about COIN HACK RECOVERY I decided to contact the company on: [email protected] and I'm glad I made the decision not to give up. they helped me to recover all my lost funds within two days.
07.03.26 17:49 Natasha Williams

I am Natasha Williams from Dallas. I want to share my testimony to encourage anyone who has ever fallen victim to a scam or fraud. Some time ago, I was defrauded by some fraudulent cryptocurrency investment organization online, I was a victim and I lost a huge amount of money, $382,000. I felt angry, disappointed and helpless but I refused to give up and stay calm. I came across this agency, GREAT WHIP RECOVERY CYBER SERVICES.. who helped people recover their money from scammers and the testimonies I saw were quite amazing. And I decided to contact them. I gathered every piece of evidence, chats, receipts, account details, and messages and reported the case to the agency, GREAT WHIP RECOVERY CYBER SERVICES. After 73hours of follow up and not losing faith, the fraudster was traced and held accountable and I recovered all my money back. I highly recommend, GREAT WHIP RECOVERY CYBER SERVICES agency if you have ever fallen victim to scammers, you can contact them. Website: https://greatwhiprecoveryc.wixsite.com/greatwhip-site email: [email protected] Call Line: +1(406)2729101
07.03.26 20:10 ericbank61

I never thought I’d be the one writing one of these stories. You hear about crypto scams, hacks, and lost fortunes, and you think, “That’s for other people. The careless ones.” I was careful. Or so I believed. It started with a sophisticated phishing attack. An email that looked identical to a legitimate exchange notification, a link to “verify my wallet security,” and a moment of distracted panic. I clicked. Within hours, my life savings in Bitcoin—a sum I’d been accumulating for five years—vanished from my private wallet. The transaction hash was a cold, unfeeling tombstone on the blockchain. My stomach dropped into a void. I felt physically ill. The police filed a report, but their knowledge ended at the edge of traditional finance. The exchange offered sympathy but no solutions. I was adrift, utterly hopeless. After weeks of despair, scouring forums in the dead of night, I found a thread mentioning Mighty Hacker Recovery. The name sounded almost too bold, like something from a cheesy movie. But the testimonials were detailed, sober, and from people who sounded just like me: desperate, betrayed, and out of options. With nothing left to lose, I reached out. Their intake process was professional but guarded. They asked for transaction IDs, wallet addresses, and a detailed timeline—no promises, just facts. A consultant named Leo became my point of contact. He had a calm, analytical voice that cut through my panic. “We don’t hack *into* systems,” he explained. “We follow the digital trail. We analyze the attack vector, trace the flow of funds through the blockchain’s transparency, and identify the weak points in the scammer’s own security. Sometimes, it’s about speed and outmaneuvering them before they can launder the assets.” What followed was a tense, silent partnership. I provided every shred of information I had, while Leo’s team worked in the shadows. There were days of silence that felt like years. Then, an update: they’d traced my BTC to a mixing service, a tool scammers use to obfuscate the trail. Mighty Hacker Recovery used advanced blockchain forensic techniques to peel back those layers. They discovered the scammer had made a critical error—a small portion of the funds was sent to a KYC-compliant exchange wallet. That was the chink in the armor. Using the immutable evidence from the blockchain and legal pressure channels they’d established with certain international platforms, they initiated a recovery claim. The process was complex, involving digital affidavits and proof of illicit origin. Three weeks after my first desperate email, Leo called. “We’ve secured a freeze on the destination wallet. The exchange is cooperating. We’re initiating the reversal.” I didn’t dare believe it until I saw it. Two days later, my wallet balance updated. My Bitcoin, minus Mighty Hacker Recovery’s contingency fee, was back. The relief wasn’t euphoric; it was a deep, trembling exhaustion, like waking up from a nightmare. They didn’t perform magic. They applied intense expertise, relentless persistence, and an intricate understanding of both the blockchain’s weaknesses and a scammer’s psychology. They gave me back more than my crypto; they gave me back a sense of agency in a landscape designed to make victims feel powerless. If you’re reading this from your own private hell of loss, know this: the trail never truly disappears. You just need the right team to follow it. For me, that was Mighty Hacker Recovery.
07.03.26 22:44 robertalfred175

CRYPTO SCAM RECOVERY SUCCESSFUL – A TESTIMONIAL OF LOST PASSWORD TO YOUR DIGITAL WALLET BACK. My name is Robert Alfred, Am from Australia. I’m sharing my experience in the hope that it helps others who have been victims of crypto scams. A few months ago, I fell victim to a fraudulent crypto investment scheme linked to a broker company. I had invested heavily during a time when Bitcoin prices were rising, thinking it was a good opportunity. Unfortunately, I was scammed out of $120,000 AUD and the broker denied me access to my digital wallet and assets. It was a devastating experience that caused many sleepless nights. Crypto scams are increasingly common and often involve fake trading platforms, phishing attacks, and misleading investment opportunities. In my desperation, a friend from the crypto community recommended Capital Crypto Recovery Service, known for helping victims recover lost or stolen funds. After doing some research and reading multiple positive reviews, I reached out to Capital Crypto Recovery. I provided all the necessary information—wallet addresses, transaction history, and communication logs. Their expert team responded immediately and began investigating. Using advanced blockchain tracking techniques, they were able to trace the stolen Dogecoin, identify the scammer’s wallet, and coordinate with relevant authorities to freeze the funds before they could be moved. Incredibly, within 24 hours, Capital Crypto Recovery successfully recovered the majority of my stolen crypto assets. I was beyond relieved and truly grateful. Their professionalism, transparency, and constant communication throughout the process gave me hope during a very difficult time. If you’ve been a victim of a crypto scam, I highly recommend them with full confidence contacting: Email: [email protected] Telegram: @Capitalcryptorecover Contact: [email protected] Call/Text: +1 (336) 390-6684 Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
07.03.26 22:44 robertalfred175

CRYPTO SCAM RECOVERY SUCCESSFUL – A TESTIMONIAL OF LOST PASSWORD TO YOUR DIGITAL WALLET BACK. My name is Robert Alfred, Am from Australia. I’m sharing my experience in the hope that it helps others who have been victims of crypto scams. A few months ago, I fell victim to a fraudulent crypto investment scheme linked to a broker company. I had invested heavily during a time when Bitcoin prices were rising, thinking it was a good opportunity. Unfortunately, I was scammed out of $120,000 AUD and the broker denied me access to my digital wallet and assets. It was a devastating experience that caused many sleepless nights. Crypto scams are increasingly common and often involve fake trading platforms, phishing attacks, and misleading investment opportunities. In my desperation, a friend from the crypto community recommended Capital Crypto Recovery Service, known for helping victims recover lost or stolen funds. After doing some research and reading multiple positive reviews, I reached out to Capital Crypto Recovery. I provided all the necessary information—wallet addresses, transaction history, and communication logs. Their expert team responded immediately and began investigating. Using advanced blockchain tracking techniques, they were able to trace the stolen Dogecoin, identify the scammer’s wallet, and coordinate with relevant authorities to freeze the funds before they could be moved. Incredibly, within 24 hours, Capital Crypto Recovery successfully recovered the majority of my stolen crypto assets. I was beyond relieved and truly grateful. Their professionalism, transparency, and constant communication throughout the process gave me hope during a very difficult time. If you’ve been a victim of a crypto scam, I highly recommend them with full confidence contacting: Email: [email protected] Telegram: @Capitalcryptorecover Contact: [email protected] Call/Text: +1 (336) 390-6684 Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
11.03.26 19:43 Michael Jensen

With the help and expertise of CapitalNode Analytics, i was able to get back my digital tokens from a fake investment platform. They are swift, precise and transparent in their operations.
12.03.26 15:04 Mike Franz

I recently ran into a serious issue with my cryptocurrency account that left me unable to access my bitcoin wallet. After several failed login attempts and repeated blocks from the system, I began to worry that I might lose access to my $415,000 permanently. Determined to fix the problem, After spending hours reading a review of GREAT WHIP RECOVERY CYBER SERVICES, on how they successfully assisted countless individuals in similar situations as mine. The process was stressful, but eventually the issue was resolved and I was able to regain access to my bitcoin wallet account. I’m immensely grateful to GREAT WHIP RECOVERY CYBER SERVICES for their incredible work, for those who need help, you can contact through the following channels: Phone Call: +1(406)2729101 Website: https://greatwhiprecoveryc.wixsite.com/greatwhip-site Mail: [email protected]
12.03.26 15:05 Mike Franz

I recently ran into a serious issue with my cryptocurrency account that left me unable to access my bitcoin wallet. After several failed login attempts and repeated blocks from the system, I began to worry that I might lose access to my $415,000 permanently. Determined to fix the problem, After spending hours reading a review of GREAT WHIP RECOVERY CYBER SERVICES, on how they successfully assisted countless individuals in similar situations as mine. The process was stressful, but eventually the issue was resolved and I was able to regain access to my bitcoin wallet account. I’m immensely grateful to GREAT WHIP RECOVERY CYBER SERVICES for their incredible work, for those who need help, you can contact through the following channels: Phone Call: +1(406)2729101 Website: https://greatwhiprecoveryc.wixsite.com/greatwhip-site Mail: [email protected]
15.03.26 20:22 harristhomas7376

"In the crypto world, this is great news I want to share. Last year, I fell victim to a scam disguised as a safe investment option. I have invested in crypto trading platforms for about 10yrs thinking I was ensuring myself a retirement income, only to find that all my assets were either frozen, I believed my assets were secure — until I discovered that my BTC funds had been frozen and withdrawals were impossible. It was a devastating moment when I realized I had been scammed, and I thought my Bitcoin was gone forever, Everything changed when a close friend recommended the Capital Crypto Recover Service. Their professionalism, expertise, and dedication enabled me to recover my lost Bitcoin funds back — more than €560.000 DEM to my BTC wallet. What once felt impossible became a reality thanks to their support. If you have lost Bitcoin through scams, hacking, failed withdrawals, or similar challenges, don’t lose hope. I strongly recommend Capital Crypto Recover Service to anyone seeking a reliable and effective solution for recovering any wallet assets. They have a proven track record of successful reputation in recovering lost password assets for their clients and can help you navigate the process of recovering your funds. Don’t let scammers get away with your hard-earned money – contact Email: [email protected] Phone CALL/Text Number: +1 (336) 390-6684 Contact: [email protected] Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
15.03.26 20:22 harristhomas7376

"In the crypto world, this is great news I want to share. Last year, I fell victim to a scam disguised as a safe investment option. I have invested in crypto trading platforms for about 10yrs thinking I was ensuring myself a retirement income, only to find that all my assets were either frozen, I believed my assets were secure — until I discovered that my BTC funds had been frozen and withdrawals were impossible. It was a devastating moment when I realized I had been scammed, and I thought my Bitcoin was gone forever, Everything changed when a close friend recommended the Capital Crypto Recover Service. Their professionalism, expertise, and dedication enabled me to recover my lost Bitcoin funds back — more than €560.000 DEM to my BTC wallet. What once felt impossible became a reality thanks to their support. If you have lost Bitcoin through scams, hacking, failed withdrawals, or similar challenges, don’t lose hope. I strongly recommend Capital Crypto Recover Service to anyone seeking a reliable and effective solution for recovering any wallet assets. They have a proven track record of successful reputation in recovering lost password assets for their clients and can help you navigate the process of recovering your funds. Don’t let scammers get away with your hard-earned money – contact Email: [email protected] Phone CALL/Text Number: +1 (336) 390-6684 Contact: [email protected] Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
15.03.26 20:22 harristhomas7376

"In the crypto world, this is great news I want to share. Last year, I fell victim to a scam disguised as a safe investment option. I have invested in crypto trading platforms for about 10yrs thinking I was ensuring myself a retirement income, only to find that all my assets were either frozen, I believed my assets were secure — until I discovered that my BTC funds had been frozen and withdrawals were impossible. It was a devastating moment when I realized I had been scammed, and I thought my Bitcoin was gone forever, Everything changed when a close friend recommended the Capital Crypto Recover Service. Their professionalism, expertise, and dedication enabled me to recover my lost Bitcoin funds back — more than €560.000 DEM to my BTC wallet. What once felt impossible became a reality thanks to their support. If you have lost Bitcoin through scams, hacking, failed withdrawals, or similar challenges, don’t lose hope. I strongly recommend Capital Crypto Recover Service to anyone seeking a reliable and effective solution for recovering any wallet assets. They have a proven track record of successful reputation in recovering lost password assets for their clients and can help you navigate the process of recovering your funds. Don’t let scammers get away with your hard-earned money – contact Email: [email protected] Phone CALL/Text Number: +1 (336) 390-6684 Contact: [email protected] Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
16.03.26 12:01 [email protected]

I would like to highly recommend TOP RECOVERY EXPERT, the best in cryptocurrency recovery. I want the world to know how exceptional their services are. For years, I faced a very difficult time after being scammed out of $453,000 in Ethereum. It was devastating to realize that someone could steal from me without remorse after I trusted them. Determined to recover my funds legally, I began searching for reliable help and came across TOP RECOVERY EXPERT, the most professional recovery service I have ever found. With their expertise and support, I was able to recover my entire Ethereum wallet. I now understand that while many investment opportunities can seem too good to be true, professional guidance can make all the difference. Thanks to TOP RECOVERY EXPERT, I have regained not only my assets ETH but also my peace of mind and happiness. Their dedication and professionalism have truly changed my life. I am now the happiest person I have ever been, all because of their help. If you have been a victim of a crypto scam, I strongly advise you to reach out to TOP RECOVERY EXPERT. Contact Information: Text/Call: +1 (346) 980-9102 Email: [email protected] For more information visit his website: https://toprecoveryexpert2.wixsite.com/consultant
16.03.26 13:20 luciajessy3

There are many recommendations online, but not all of them are trustworthy. Unfortunately, some so-called “recovery services” are scams themselves and may try to take advantage of people who have already lost money. If you’ve been scammed, be extremely cautious about anyone promising guaranteed recovery — especially if they ask for upfront fees. Always do thorough research, verify credentials, and consider reporting the incident to. Cyberrefundexperts {A} Consultant {.} Com , Stay alert and protect yourself.
16.03.26 13:20 luciajessy3

There are many recommendations online, but not all of them are trustworthy. Unfortunately, some so-called “recovery services” are scams themselves and may try to take advantage of people who have already lost money. If you’ve been scammed, be extremely cautious about anyone promising guaranteed recovery — especially if they ask for upfront fees. Always do thorough research, verify credentials, and consider reporting the incident to. Cyberrefundexperts @ Consultant . Com , Stay alert and protect yourself.
18.03.26 15:27 keithwilson9899

ETHEREUM RECOVERY ASSISTANCE: CAPITAL CRYPTO RECOVER HELPED ME RECOVER $98,000 WORTH OF LOST ETH In cases of cryptocurrency scams, having accurate information and trusted support is essential. I would like to recommend Capital Crypto Recover Service, a professional team that specializes in assisting individuals with the recovery of lost or stolen Bitcoin and Ethereum (ETH). Their experienced experts are dedicated to helping victims of digital asset fraud by carefully analyzing each case, developing strategic recovery plans, Capital Crypto Recover Service knowledgeable team's primary goals are to satisfy clients and offer significant support and working diligently toward fund retrieval. The team is committed to providing reliable assistance and maintaining a high level of client satisfaction. Based on my assessment, their reputation professionalism and a strong commitment to their clients. If you have experienced a cryptocurrency loss, you can contacting them for further assistance Phone (Call/Text): +1 (336) 390-6684 Email: [email protected] Alternate Email: [email protected] Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
18.03.26 15:27 keithwilson9899

ETHEREUM RECOVERY ASSISTANCE: CAPITAL CRYPTO RECOVER HELPED ME RECOVER $98,000 WORTH OF LOST ETH In cases of cryptocurrency scams, having accurate information and trusted support is essential. I would like to recommend Capital Crypto Recover Service, a professional team that specializes in assisting individuals with the recovery of lost or stolen Bitcoin and Ethereum (ETH). Their experienced experts are dedicated to helping victims of digital asset fraud by carefully analyzing each case, developing strategic recovery plans, Capital Crypto Recover Service knowledgeable team's primary goals are to satisfy clients and offer significant support and working diligently toward fund retrieval. The team is committed to providing reliable assistance and maintaining a high level of client satisfaction. Based on my assessment, their reputation professionalism and a strong commitment to their clients. If you have experienced a cryptocurrency loss, you can contacting them for further assistance Phone (Call/Text): +1 (336) 390-6684 Email: [email protected] Alternate Email: [email protected] Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
19.03.26 08:03 Alena76

Most people have been scammed severally and they give up on their funds I'm saying these because I was a victim too After loosing 745,000 USD I lose my mind until I read about COIN HACK RECOVERY I decided to contact the company on: [email protected] and I'm glad I made the decision not to give up. they helped me to recover all my lost funds within two days.
19.03.26 08:04 Alena76

Most people have been scammed severally and they give up on their funds I'm saying these because I was a victim too After loosing 745,000 USD I lose my mind until I read about COIN HACK RECOVERY I decided to contact the company on: [email protected] and I'm glad I made the decision not to give up. they helped me to recover all my lost funds within two days.
19.03.26 08:15 Alena76

Most people have been scammed severally and they give up on their funds I'm saying these because I was a victim too After loosing 745,000 USD I lose my mind until I read about COIN HACK RECOVERY I decided to contact the company on: [email protected] and I'm glad I made the decision not to give up. they helped me to recover all my lost funds within two days.
20.03.26 03:30 robertalfred175

CRYPTO SCAM RECOVERY SUCCESSFUL – A TESTIMONIAL OF LOST PASSWORD TO YOUR DIGITAL WALLET BACK. My name is Robert Alfred, Am from Australia. I’m sharing my experience in the hope that it helps others who have been victims of crypto scams. A few months ago, I fell victim to a fraudulent crypto investment scheme linked to a broker company. I had invested heavily during a time when Bitcoin prices were rising, thinking it was a good opportunity. Unfortunately, I was scammed out of $120,000 AUD and the broker denied me access to my digital wallet and assets. It was a devastating experience that caused many sleepless nights. Crypto scams are increasingly common and often involve fake trading platforms, phishing attacks, and misleading investment opportunities. In my desperation, a friend from the crypto community recommended Capital Crypto Recovery Service, known for helping victims recover lost or stolen funds. After doing some research and reading multiple positive reviews, I reached out to Capital Crypto Recovery. I provided all the necessary information—wallet addresses, transaction history, and communication logs. Their expert team responded immediately and began investigating. Using advanced blockchain tracking techniques, they were able to trace the stolen Dogecoin, identify the scammer’s wallet, and coordinate with relevant authorities to freeze the funds before they could be moved. Incredibly, within 24 hours, Capital Crypto Recovery successfully recovered the majority of my stolen crypto assets. I was beyond relieved and truly grateful. Their professionalism, transparency, and constant communication throughout the process gave me hope during a very difficult time. If you’ve been a victim of a crypto scam, I highly recommend them with full confidence contacting: Email: [email protected] Telegram: @Capitalcryptorecover Contact: [email protected] Call/Text: +1 (336) 390-6684 Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
20.03.26 03:30 robertalfred175

CRYPTO SCAM RECOVERY SUCCESSFUL – A TESTIMONIAL OF LOST PASSWORD TO YOUR DIGITAL WALLET BACK. My name is Robert Alfred, Am from Australia. I’m sharing my experience in the hope that it helps others who have been victims of crypto scams. A few months ago, I fell victim to a fraudulent crypto investment scheme linked to a broker company. I had invested heavily during a time when Bitcoin prices were rising, thinking it was a good opportunity. Unfortunately, I was scammed out of $120,000 AUD and the broker denied me access to my digital wallet and assets. It was a devastating experience that caused many sleepless nights. Crypto scams are increasingly common and often involve fake trading platforms, phishing attacks, and misleading investment opportunities. In my desperation, a friend from the crypto community recommended Capital Crypto Recovery Service, known for helping victims recover lost or stolen funds. After doing some research and reading multiple positive reviews, I reached out to Capital Crypto Recovery. I provided all the necessary information—wallet addresses, transaction history, and communication logs. Their expert team responded immediately and began investigating. Using advanced blockchain tracking techniques, they were able to trace the stolen Dogecoin, identify the scammer’s wallet, and coordinate with relevant authorities to freeze the funds before they could be moved. Incredibly, within 24 hours, Capital Crypto Recovery successfully recovered the majority of my stolen crypto assets. I was beyond relieved and truly grateful. Their professionalism, transparency, and constant communication throughout the process gave me hope during a very difficult time. If you’ve been a victim of a crypto scam, I highly recommend them with full confidence contacting: Email: [email protected] Telegram: @Capitalcryptorecover Contact: [email protected] Call/Text: +1 (336) 390-6684 Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
20.03.26 10:10 Jane4

I lost about $600k Bitcoin last year, I searched around and tried to work with some recovery firm unfortunately I was scammed as well. This happened for months until I came across [email protected] They came to my rescue and all my funds were recovered within few days I'm so happy right now .
20.03.26 10:10 Jane4

I lost about $600k Bitcoin last year, I searched around and tried to work with some recovery firm unfortunately I was scammed as well. This happened for months until I came across [email protected] They came to my rescue and all my funds were recovered within few days I'm so happy right now .
20.03.26 13:57 keithwilson9899

ETHEREUM RECOVERY ASSISTANCE: CAPITAL CRYPTO RECOVER HELPED ME RECOVER $98,000 WORTH OF LOST ETH In cases of cryptocurrency scams, having accurate information and trusted support is essential. I would like to recommend Capital Crypto Recover Service, a professional team that specializes in assisting individuals with the recovery of lost or stolen Bitcoin and Ethereum (ETH). Their experienced experts are dedicated to helping victims of digital asset fraud by carefully analyzing each case, developing strategic recovery plans, Capital Crypto Recover Service knowledgeable team's primary goals are to satisfy clients and offer significant support and working diligently toward fund retrieval. The team is committed to providing reliable assistance and maintaining a high level of client satisfaction. Based on my assessment, their reputation professionalism and a strong commitment to their clients. If you have experienced a cryptocurrency loss, you can contacting them for further assistance Phone (Call/Text): +1 (336) 390-6684 Email: [email protected] Alternate Email: [email protected] Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
20.03.26 13:57 keithwilson9899

ETHEREUM RECOVERY ASSISTANCE: CAPITAL CRYPTO RECOVER HELPED ME RECOVER $98,000 WORTH OF LOST ETH In cases of cryptocurrency scams, having accurate information and trusted support is essential. I would like to recommend Capital Crypto Recover Service, a professional team that specializes in assisting individuals with the recovery of lost or stolen Bitcoin and Ethereum (ETH). Their experienced experts are dedicated to helping victims of digital asset fraud by carefully analyzing each case, developing strategic recovery plans, Capital Crypto Recover Service knowledgeable team's primary goals are to satisfy clients and offer significant support and working diligently toward fund retrieval. The team is committed to providing reliable assistance and maintaining a high level of client satisfaction. Based on my assessment, their reputation professionalism and a strong commitment to their clients. If you have experienced a cryptocurrency loss, you can contacting them for further assistance Phone (Call/Text): +1 (336) 390-6684 Email: [email protected] Alternate Email: [email protected] Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
24.03.26 14:12 Ralf Boruta

GREAT WHIP RECOVERY CYBER SERVICES TRUSTED EXPERTS IN ONLINE RECOVERY SOLUTIONS PHONE CALL:+1(406)2729101 I was unfortunately deceived and scammed out of $88,000 by someone I trusted to manage my funds during a transaction we carried out together. The experience left me deeply disappointed and hurt, realizing that someone could betray that level of trust without any remorse. Determined to seek justice and recover what was stolen, I began searching for legal assistance and came across numerous testimonials about GREAT WHIP RECOVERY CYBER SERVICES, a group known for helping victims recover lost funds. From what I learned, they have successfully assisted many people facing similar situations, returning stolen funds to their rightful owners in a remarkably short time. In my case, the GREAT WHIP RECOVERY CYBER SERVICES were able to recover my funds within just 48 hours, which was truly unbelievable. Even more reassuring was the fact that the scammer was identified, located, and eventually arrested by local authorities in his region. That outcome brought a great sense of relief and closure. I hope this information helps others who have lost their hard-earned money due to misplaced trust. If you’re in a similar situation, you can contact them through their info below to seek help in recovering your stolen funds. Email: [email protected] Website https://greatwhiprecoveryc.wixsite.com/greatwhip-site Phone Call:+1(406)2729101
24.03.26 14:12 Ralf Boruta

GREAT WHIP RECOVERY CYBER SERVICES TRUSTED EXPERTS IN ONLINE RECOVERY SOLUTIONS PHONE CALL:+1(406)2729101 I was unfortunately deceived and scammed out of $88,000 by someone I trusted to manage my funds during a transaction we carried out together. The experience left me deeply disappointed and hurt, realizing that someone could betray that level of trust without any remorse. Determined to seek justice and recover what was stolen, I began searching for legal assistance and came across numerous testimonials about GREAT WHIP RECOVERY CYBER SERVICES, a group known for helping victims recover lost funds. From what I learned, they have successfully assisted many people facing similar situations, returning stolen funds to their rightful owners in a remarkably short time. In my case, the GREAT WHIP RECOVERY CYBER SERVICES were able to recover my funds within just 48 hours, which was truly unbelievable. Even more reassuring was the fact that the scammer was identified, located, and eventually arrested by local authorities in his region. That outcome brought a great sense of relief and closure. I hope this information helps others who have lost their hard-earned money due to misplaced trust. If you’re in a similar situation, you can contact them through their info below to seek help in recovering your stolen funds. Email: [email protected] Website https://greatwhiprecoveryc.wixsite.com/greatwhip-site Phone Call:+1(406)2729101
24.03.26 21:21 michaeldavenport238

I was recently scammed out of $53,000 by a fraudulent Bitcoin investment scheme, which added significant stress to my already difficult health issues, as I was also facing cancer surgery expenses. Desperate to recover my funds, I spent hours researching and consulting other victims, which led me to discover the excellent reputation of Capital Crypto Recover, I came across a Google post It was only after spending many hours researching and asking other victims for advice that I discovered Capital Crypto Recovery’s stellar reputation. I decided to contact them because of their successful recovery record and encouraging client testimonials. I had no idea that this would be the pivotal moment in my fight against cryptocurrency theft. Thanks to their expert team, I was able to recover my lost cryptocurrency back. The process was intricate, but Capital Crypto Recovery's commitment to utilizing the latest technology ensured a successful outcome. I highly recommend their services to anyone who has fallen victim to cryptocurrency fraud. For assistance contact [email protected] and on Telegram OR Call Number +1 (336)390-6684 via email: [email protected] you can visit his website: https://recovercapital.wixsite.com/capital-crypto-rec-1
24.03.26 21:21 michaeldavenport238

I was recently scammed out of $53,000 by a fraudulent Bitcoin investment scheme, which added significant stress to my already difficult health issues, as I was also facing cancer surgery expenses. Desperate to recover my funds, I spent hours researching and consulting other victims, which led me to discover the excellent reputation of Capital Crypto Recover, I came across a Google post It was only after spending many hours researching and asking other victims for advice that I discovered Capital Crypto Recovery’s stellar reputation. I decided to contact them because of their successful recovery record and encouraging client testimonials. I had no idea that this would be the pivotal moment in my fight against cryptocurrency theft. Thanks to their expert team, I was able to recover my lost cryptocurrency back. The process was intricate, but Capital Crypto Recovery's commitment to utilizing the latest technology ensured a successful outcome. I highly recommend their services to anyone who has fallen victim to cryptocurrency fraud. For assistance contact [email protected] and on Telegram OR Call Number +1 (336)390-6684 via email: [email protected] you can visit his website: https://recovercapital.wixsite.com/capital-crypto-rec-1
27.03.26 02:38 ledezmacecilia

How TechY Force Retrieves Stolen Bitcoin in 2026 Losing Bitcoin to scammers is one of the most devastating experiences in the cryptocurrency space. In 2026, thefts often occur through sophisticated phishing attacks, fake trading apps, impersonation schemes, romance fraud, hacked wallets, or fraudulent investment platforms that promise high returns before disappearing with your funds. Visit https://techyforcecyberretrieval.com Bitcoin's irreversible transactions and pseudonymous nature make recovery feel impossible—but in many cases, stolen BTC can still be traced and potentially retrieved with the right expertise. The most important decision is choosing a legitimate, professional crypto recovery firm with proven capabilities. After evaluating the landscape, TechY Force Cyber Retrieval consistently ranks as the top firm for helping victims recover stolen Bitcoin. Why Retrieval Is Challenging—But Not Hopeless Scammers typically attempt to obscure stolen Bitcoin by: Chain Hopping: Rapidly swapping BTC for privacy coins or altcoins across decentralized exchanges. Mixing Services: Using tumblers to blend stolen funds with legitimate traffic, breaking the transaction trail. Peel Chains: Splitting large sums into tiny amounts sent through hundreds of intermediate wallets to evade detection. Cross-Bridge Laundering: Moving assets instantly between different blockchains to escape standard monitoring tools. Visit https://techyforcecyberretrieval.com While these tactics create complexity, they leave digital footprints that require specialized forensic tools to interpret. This is where TechY Force operates. How TechY Force Works: Our 3-Step Recovery Protocol We don't rely on guesswork; we use a data-driven methodology designed for the 2026 threat landscape. 1. Advanced Forensic Tracing Our process begins with a deep-dive blockchain audit. Using proprietary AI-driven software, we map the entire journey of your stolen funds. We penetrate through mixers and peel chains to identify "clustered" addresses controlled by the scammer, pinpointing exactly where the funds are currently held or where they are attempting to cash out. Visit https://techyforcecyberretrieval.com 2. Intelligence & Attribution Tracing the coin is only half the battle; identifying the actor is the key. Our intelligence team correlates on-chain data with off-chain Open Source Intelligence (OSINT). We link anonymous wallet addresses to real-world identities, IP leaks, and known criminal syndicates. This evidence package is crucial for the next step. 3. Strategic Intervention & Recovery Once the funds are located at a centralized exchange or regulated custodian, we act immediately. We present our forensic evidence to the platform's compliance team and coordinate with international law enforcement to freeze the assets before they can be withdrawn. We then guide you through the legal verification process to ensure the frozen assets are repatriated directly to your secure wallet. Why Choose TechY Force? In an era filled with secondary "recovery scams," TechY Force stands apart through transparency and verified results. We specialize in Bitcoin tracing and use tools updated daily to counter the latest 2026 money laundering techniques. If you have lost funds, time is your most critical asset. The longer scammers have to layer their transactions, the harder recovery becomes. Don't let the complexity of the blockchain discourage you. Contact TechY Force Cyber Retrieval today for a confidential case evaluation. Let our expertise turn the impossible into a recovery. Email Techyforcecyberretrieval(@)consultant(.)com Visit https://techyforcecyberretrieval.com
27.03.26 23:00 robertalfred175

CRYPTO SCAM RECOVERY SUCCESSFUL – A TESTIMONIAL OF LOST PASSWORD TO YOUR DIGITAL WALLET BACK. My name is Robert Alfred, Am from Australia. I’m sharing my experience in the hope that it helps others who have been victims of crypto scams. A few months ago, I fell victim to a fraudulent crypto investment scheme linked to a broker company. I had invested heavily during a time when Bitcoin prices were rising, thinking it was a good opportunity. Unfortunately, I was scammed out of $120,000 AUD and the broker denied me access to my digital wallet and assets. It was a devastating experience that caused many sleepless nights. Crypto scams are increasingly common and often involve fake trading platforms, phishing attacks, and misleading investment opportunities. In my desperation, a friend from the crypto community recommended Capital Crypto Recovery Service, known for helping victims recover lost or stolen funds. After doing some research and reading multiple positive reviews, I reached out to Capital Crypto Recovery. I provided all the necessary information—wallet addresses, transaction history, and communication logs. Their expert team responded immediately and began investigating. Using advanced blockchain tracking techniques, they were able to trace the stolen Dogecoin, identify the scammer’s wallet, and coordinate with relevant authorities to freeze the funds before they could be moved. Incredibly, within 24 hours, Capital Crypto Recovery successfully recovered the majority of my stolen crypto assets. I was beyond relieved and truly grateful. Their professionalism, transparency, and constant communication throughout the process gave me hope during a very difficult time. If you’ve been a victim of a crypto scam, I highly recommend them with full confidence contacting: Email: [email protected] Telegram: @Capitalcryptorecover Contact: [email protected] Call/Text: +1 (336) 390-6684 Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
27.03.26 23:01 robertalfred175

CRYPTO SCAM RECOVERY SUCCESSFUL – A TESTIMONIAL OF LOST PASSWORD TO YOUR DIGITAL WALLET BACK. My name is Robert Alfred, Am from Australia. I’m sharing my experience in the hope that it helps others who have been victims of crypto scams. A few months ago, I fell victim to a fraudulent crypto investment scheme linked to a broker company. I had invested heavily during a time when Bitcoin prices were rising, thinking it was a good opportunity. Unfortunately, I was scammed out of $120,000 AUD and the broker denied me access to my digital wallet and assets. It was a devastating experience that caused many sleepless nights. Crypto scams are increasingly common and often involve fake trading platforms, phishing attacks, and misleading investment opportunities. In my desperation, a friend from the crypto community recommended Capital Crypto Recovery Service, known for helping victims recover lost or stolen funds. After doing some research and reading multiple positive reviews, I reached out to Capital Crypto Recovery. I provided all the necessary information—wallet addresses, transaction history, and communication logs. Their expert team responded immediately and began investigating. Using advanced blockchain tracking techniques, they were able to trace the stolen Dogecoin, identify the scammer’s wallet, and coordinate with relevant authorities to freeze the funds before they could be moved. Incredibly, within 24 hours, Capital Crypto Recovery successfully recovered the majority of my stolen crypto assets. I was beyond relieved and truly grateful. Their professionalism, transparency, and constant communication throughout the process gave me hope during a very difficult time. If you’ve been a victim of a crypto scam, I highly recommend them with full confidence contacting: Email: [email protected] Telegram: @Capitalcryptorecover Contact: [email protected] Call/Text: +1 (336) 390-6684 Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
31.03.26 04:28 helenjackson

HIRE CERTIFIED ETHEREUM / USDT & BITCOIN RECOVERY EXPERT HERE / REVENANT CYBER HACKER I never imagined that one bad decision could shatter my life the way it did. Like many people, I was drawn into cryptocurrency by stories of financial freedom and security for my family. When an online “recovery scheme” promised to help me retrieve funds I had previously lost, I was desperate and hopeful. Instead, I walked straight into another trap. Within weeks, $172,000, my life savings, was gone. The realization was devastating. I couldn't sleep. I avoided my family because I didn't know how to explain that everything I had worked for over the years had vanished in silence, stolen by faceless scammers hiding behind fake platforms and convincing words. Every unanswered email and every ignored message felt like another punch to the chest. I truly believed my future was over. I reported the incident to different platforms and authorities, but the responses were cold and discouraging. I was told crypto losses were “almost impossible” to recover. That sentence echoed in my mind daily. I felt ashamed, broken, and completely alone. That was when I came across REVENANT CYBER HACKER. At first, I was skeptical. After being scammed once, trusting anyone again felt impossible. But from the very first consultation, something was different. They listened, really listened to my story without judgment. They explained the process clearly, showed verifiable evidence of past recoveries, and never made unrealistic promises. REVENANT CYBER HACKER treated my case with urgency and professionalism. Their team traced blockchain transactions, identified wallet movements, and coordinated the recovery process step by step, keeping me informed throughout. For the first time in months, I felt a sense of hope. When I received confirmation that my $172,000 had been successfully recovered, I broke down in tears. It wasn't just about the money; it was about getting my life back. REVENANT CYBER HACKER restored more than my funds; they restored my dignity, my peace of mind, and my belief that justice is still possible in the digital world. Today, I share my story so others don't lose hope. If you feel trapped, ashamed, or helpless after a crypto scam, know this: recovery is possible. REVENANT CYBER HACKER gave me a second chance when I needed it most. Email: revenantcyberhacker ( @ ) gmail (. ) com Telegram: revenantcyberhacker WhatsApp: +1 (208) 425-8584 WhatsApp: +1 (913) 820-0739 Website https://www.revenantcyberhacker.com
31.03.26 19:37 kerrieriley

Losing access to your cryptocurrency is more than just a technical glitch; it is an overwhelming, financially devastating experience. Whether your digital assets vanished due to a sophisticated scam, a hacked wallet, a phishing attack, a forgotten password, or a simple technical failure, you are not alone. Thousands of investors face this harsh reality every single day. Reach out to us at https://techyforcecyberretrieval.com The common belief is that once Bitcoin or Ethereum is lost, it is gone forever. But that is not always true. With the right legitimate experts, lost cryptocurrency can often be traced, unlocked, and recovered. This is where TechY Force Cyber Retrieval (TFCR) stands out as a globally trusted, top-rated partner in restoring financial security. The Reality of Crypto Loss The decentralized nature of blockchain offers freedom, but it also means there is no central "help desk" to call when things go wrong. Victims often feel helpless against: Investment Scams: Fake platforms that disappear with funds. Hacks & Phishing: Unauthorized access to private keys. Human Error: Forgotten passwords or lost hardware wallet seeds. Technical Failures: Corrupted files or failed transactions. Enter TechY Force Cyber Retrieval TechY Force Cyber Retrieval is a world-class service specializing in the recovery of digital assets across the globe. They have established themselves as one of the most trusted names in Bitcoin (BTC), Ethereum (ETH), and general crypto scam recovery. Reach out to us at https://techyforcecyberretrieval.com Their approach is not based on hope, but on proven methodology. Over the years, TFCR has successfully recovered millions of dollars in cryptocurrency, helping clients reclaim what rightfully belongs to them. How We Work: The TFCR Methodology Recovering crypto requires a blend of advanced technology and deep human expertise. Here is how TechY Force Cyber Retrieval operates to deliver real, verifiable results: 1. Elite Team Composition We do not rely on generic IT support. Our team consists of highly skilled professionals, including: Blockchain Forensic Analysts: Experts who trace transactions across the ledger to identify where funds moved. Cybersecurity Professionals: Specialists in securing data and identifying vulnerabilities. Ethical Hackers: Talented individuals who use their skills to bypass security barriers legally and ethically to regain access. Crypto Investigators: Dedicated researchers who build cases against scammers and track illicit flows. Reach out to us at https://techyforcecyberretrieval.com 2. Cutting-Edge Technology From legacy wallets locked for years to complex, multi-layered scam networks, TFCR utilizes state-of-the-art blockchain technology. We employ advanced tracing tools that can follow the footprints of stolen funds across different exchanges and mixing services, providing a clear path to recovery. 3. Precision and Discretion We understand that financial loss is sensitive. Every case is handled with the utmost discretion and precision. Whether you are an individual investor or a corporate entity, our process is designed to protect your identity while aggressively pursuing your assets. 4. Transparency and Integrity Our mission is clear: to help victims recover their losses through transparency. We provide clear communication throughout the recovery process, ensuring you understand the steps being taken to unlock your Bitcoin, Ethereum, USDT, or other leading altcoins. Reclaim What Is Yours Don't let a mistake or a crime define your financial future. While the blockchain is immutable, the loss of access is not always permanent. Reach out to us at https://techyforcecyberretrieval.com If you are facing the nightmare of lost or stolen crypto, TechY Force Cyber Retrieval is ready to apply its years of hands-on experience to your case. Join the thousands of investors who have turned a devastating situation into a success story. Your assets may be hidden, but they are not necessarily lost. Let us help you find them.
02.04.26 12:57 keithwilson9899

ETHEREUM RECOVERY ASSISTANCE: CAPITAL CRYPTO RECOVER HELPED ME RECOVER $98,000 WORTH OF LOST ETH In cases of cryptocurrency scams, having accurate information and trusted support is essential. I would like to recommend Capital Crypto Recover Service, a professional team that specializes in assisting individuals with the recovery of lost or stolen Bitcoin and Ethereum (ETH). Their experienced experts are dedicated to helping victims of digital asset fraud by carefully analyzing each case, developing strategic recovery plans, Capital Crypto Recover Service knowledgeable team's primary goals are to satisfy clients and offer significant support and working diligently toward fund retrieval. The team is committed to providing reliable assistance and maintaining a high level of client satisfaction. Based on my assessment, their reputation professionalism and a strong commitment to their clients. If you have experienced a cryptocurrency loss, you can contacting them for further assistance Phone (Call/Text): +1 (336) 390-6684 Email: [email protected] Alternate Email: [email protected] Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
02.04.26 12:57 keithwilson9899

ETHEREUM RECOVERY ASSISTANCE: CAPITAL CRYPTO RECOVER HELPED ME RECOVER $98,000 WORTH OF LOST ETH In cases of cryptocurrency scams, having accurate information and trusted support is essential. I would like to recommend Capital Crypto Recover Service, a professional team that specializes in assisting individuals with the recovery of lost or stolen Bitcoin and Ethereum (ETH). Their experienced experts are dedicated to helping victims of digital asset fraud by carefully analyzing each case, developing strategic recovery plans, Capital Crypto Recover Service knowledgeable team's primary goals are to satisfy clients and offer significant support and working diligently toward fund retrieval. The team is committed to providing reliable assistance and maintaining a high level of client satisfaction. Based on my assessment, their reputation professionalism and a strong commitment to their clients. If you have experienced a cryptocurrency loss, you can contacting them for further assistance Phone (Call/Text): +1 (336) 390-6684 Email: [email protected] Alternate Email: [email protected] Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
02.04.26 19:27 JasonDrew

RECOVER YOUR STOLEN CRYPTO / BTC / USDT / ETH WITH THE HELP OF "DIGITAL TECH WIZZARD" I’m truly and eternally grateful for the amazing team of DIGITAL TECH WIZZARD and the great services they render to internet and crypto fraud victims like me. I never would have imagined that I could recover my stolen USDT and USDC, gain back access to my wallet after losing everything to a fake investment platform. It’s truly amazing the kind of service DIGITAL TECH WIZZARD rendered. I was able to recover all that was stolen from me within 32 hours of officially hiring them. The team at DIGITAL TECH WIZZARD is very professional and emotionally concerned about their clients, indeed. If you ever find yourself worrying about how to get back all you have lost from fraud, I suggest you rethink and research more before losing hope. Tons of amateur cybersecurity and asset recovery experts are littered all over Google. However, DIGITAL TECH WIZZARD stands out among them due to their years of experience and success recorded under their belt. There are so many victims of cryptocurrency scams who concluded that it is impossible to recover their funds. DIGITAL TECH WIZZARD is here to provide that service for you. I highly recommend their services to everyone who wishes to recover their lost funds. Reach them via the following: Email: [email protected] Thank you.
02.04.26 19:28 JasonDrew

RECOVER YOUR STOLEN CRYPTO / BTC / USDT / ETH WITH THE HELP OF "DIGITAL TECH WIZZARD" I’m truly and eternally grateful for the amazing team of DIGITAL TECH WIZZARD and the great services they render to internet and crypto fraud victims like me. I never would have imagined that I could recover my stolen USDT and USDC, gain back access to my wallet after losing everything to a fake investment platform. It’s truly amazing the kind of service DIGITAL TECH WIZZARD rendered. I was able to recover all that was stolen from me within 32 hours of officially hiring them. The team at DIGITAL TECH WIZZARD is very professional and emotionally concerned about their clients, indeed. If you ever find yourself worrying about how to get back all you have lost from fraud, I suggest you rethink and research more before losing hope. Tons of amateur cybersecurity and asset recovery experts are littered all over Google. However, DIGITAL TECH WIZZARD stands out among them due to their years of experience and success recorded under their belt. There are so many victims of cryptocurrency scams who concluded that it is impossible to recover their funds. DIGITAL TECH WIZZARD is here to provide that service for you. I highly recommend their services to everyone who wishes to recover their lost funds. Reach them via the following: Email: [email protected] Thank you.
02.04.26 19:31 JasonDrew

RECOVER YOUR STOLEN CRYPTO / BTC / USDT / ETH WITH THE HELP OF "DIGITAL TECH WIZZARD" I’m truly and eternally grateful for the amazing team of DIGITAL TECH WIZZARD and the great services they render to internet and crypto fraud victims like me. I never would have imagined that I could recover my stolen USDT and USDC, gain back access to my wallet after losing everything to a fake investment platform. It’s truly amazing the kind of service DIGITAL TECH WIZZARD rendered. I was able to recover all that was stolen from me within 32 hours of officially hiring them. The team at DIGITAL TECH WIZZARD is very professional and emotionally concerned about their clients, indeed. If you ever find yourself worrying about how to get back all you have lost from fraud, I suggest you rethink and research more before losing hope. Tons of amateur cybersecurity and asset recovery experts are littered all over Google. However, DIGITAL TECH WIZZARD stands out among them due to their years of experience and success recorded under their belt. There are so many victims of cryptocurrency scams who concluded that it is impossible to recover their funds. DIGITAL TECH WIZZARD is here to provide that service for you. I highly recommend their services to everyone who wishes to recover their lost funds. Reach them via the following: Email: [email protected] Thank you.
02.04.26 19:31 JasonDrew

RECOVER YOUR STOLEN CRYPTO / BTC / USDT / ETH WITH THE HELP OF "DIGITAL TECH WIZZARD" I’m truly and eternally grateful for the amazing team of DIGITAL TECH WIZZARD and the great services they render to internet and crypto fraud victims like me. I never would have imagined that I could recover my stolen USDT and USDC, gain back access to my wallet after losing everything to a fake investment platform. It’s truly amazing the kind of service DIGITAL TECH WIZZARD rendered. I was able to recover all that was stolen from me within 32 hours of officially hiring them. The team at DIGITAL TECH WIZZARD is very professional and emotionally concerned about their clients, indeed. If you ever find yourself worrying about how to get back all you have lost from fraud, I suggest you rethink and research more before losing hope. Tons of amateur cybersecurity and asset recovery experts are littered all over Google. However, DIGITAL TECH WIZZARD stands out among them due to their years of experience and success recorded under their belt. There are so many victims of cryptocurrency scams who concluded that it is impossible to recover their funds. DIGITAL TECH WIZZARD is here to provide that service for you. I highly recommend their services to everyone who wishes to recover their lost funds. Reach them via the following: Email: [email protected] Thank you.
02.04.26 19:31 JasonDrew

RECOVER YOUR STOLEN CRYPTO / BTC / USDT / ETH WITH THE HELP OF "DIGITAL TECH WIZZARD" I’m truly and eternally grateful for the amazing team of DIGITAL TECH WIZZARD and the great services they render to internet and crypto fraud victims like me. I never would have imagined that I could recover my stolen USDT and USDC, gain back access to my wallet after losing everything to a fake investment platform. It’s truly amazing the kind of service DIGITAL TECH WIZZARD rendered. I was able to recover all that was stolen from me within 32 hours of officially hiring them. The team at DIGITAL TECH WIZZARD is very professional and emotionally concerned about their clients, indeed. If you ever find yourself worrying about how to get back all you have lost from fraud, I suggest you rethink and research more before losing hope. Tons of amateur cybersecurity and asset recovery experts are littered all over Google. However, DIGITAL TECH WIZZARD stands out among them due to their years of experience and success recorded under their belt. There are so many victims of cryptocurrency scams who concluded that it is impossible to recover their funds. DIGITAL TECH WIZZARD is here to provide that service for you. I highly recommend their services to everyone who wishes to recover their lost funds. Reach them via the following: Email: [email protected] Thank you.
02.04.26 19:31 JasonDrew

RECOVER YOUR STOLEN CRYPTO / BTC / USDT / ETH WITH THE HELP OF "DIGITAL TECH WIZZARD" I’m truly and eternally grateful for the amazing team of DIGITAL TECH WIZZARD and the great services they render to internet and crypto fraud victims like me. I never would have imagined that I could recover my stolen USDT and USDC, gain back access to my wallet after losing everything to a fake investment platform. It’s truly amazing the kind of service DIGITAL TECH WIZZARD rendered. I was able to recover all that was stolen from me within 32 hours of officially hiring them. The team at DIGITAL TECH WIZZARD is very professional and emotionally concerned about their clients, indeed. If you ever find yourself worrying about how to get back all you have lost from fraud, I suggest you rethink and research more before losing hope. Tons of amateur cybersecurity and asset recovery experts are littered all over Google. However, DIGITAL TECH WIZZARD stands out among them due to their years of experience and success recorded under their belt. There are so many victims of cryptocurrency scams who concluded that it is impossible to recover their funds. DIGITAL TECH WIZZARD is here to provide that service for you. I highly recommend their services to everyone who wishes to recover their lost funds. Reach them via the following: Email: [email protected] Thank you.
02.04.26 19:31 JasonDrew

RECOVER YOUR STOLEN CRYPTO / BTC / USDT / ETH WITH THE HELP OF "DIGITAL TECH WIZZARD" I’m truly and eternally grateful for the amazing team of DIGITAL TECH WIZZARD and the great services they render to internet and crypto fraud victims like me. I never would have imagined that I could recover my stolen USDT and USDC, gain back access to my wallet after losing everything to a fake investment platform. It’s truly amazing the kind of service DIGITAL TECH WIZZARD rendered. I was able to recover all that was stolen from me within 32 hours of officially hiring them. The team at DIGITAL TECH WIZZARD is very professional and emotionally concerned about their clients, indeed. If you ever find yourself worrying about how to get back all you have lost from fraud, I suggest you rethink and research more before losing hope. Tons of amateur cybersecurity and asset recovery experts are littered all over Google. However, DIGITAL TECH WIZZARD stands out among them due to their years of experience and success recorded under their belt. There are so many victims of cryptocurrency scams who concluded that it is impossible to recover their funds. DIGITAL TECH WIZZARD is here to provide that service for you. I highly recommend their services to everyone who wishes to recover their lost funds. Reach them via the following: Email: [email protected] Thank you.
03.04.26 13:04 robertalfred175

CRYPTO SCAM RECOVERY SUCCESSFUL – A TESTIMONIAL OF LOST PASSWORD TO YOUR DIGITAL WALLET BACK. My name is Robert Alfred, Am from Australia. I’m sharing my experience in the hope that it helps others who have been victims of crypto scams. A few months ago, I fell victim to a fraudulent crypto investment scheme linked to a broker company. I had invested heavily during a time when Bitcoin prices were rising, thinking it was a good opportunity. Unfortunately, I was scammed out of $120,000 AUD and the broker denied me access to my digital wallet and assets. It was a devastating experience that caused many sleepless nights. Crypto scams are increasingly common and often involve fake trading platforms, phishing attacks, and misleading investment opportunities. In my desperation, a friend from the crypto community recommended Capital Crypto Recovery Service, known for helping victims recover lost or stolen funds. After doing some research and reading multiple positive reviews, I reached out to Capital Crypto Recovery. I provided all the necessary information—wallet addresses, transaction history, and communication logs. Their expert team responded immediately and began investigating. Using advanced blockchain tracking techniques, they were able to trace the stolen Dogecoin, identify the scammer’s wallet, and coordinate with relevant authorities to freeze the funds before they could be moved. Incredibly, within 24 hours, Capital Crypto Recovery successfully recovered the majority of my stolen crypto assets. I was beyond relieved and truly grateful. Their professionalism, transparency, and constant communication throughout the process gave me hope during a very difficult time. If you’ve been a victim of a crypto scam, I highly recommend them with full confidence contacting: Email: [email protected] Telegram: @Capitalcryptorecover Contact: [email protected] Call/Text: +1 (336) 390-6684 Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
03.04.26 13:04 robertalfred175

CRYPTO SCAM RECOVERY SUCCESSFUL – A TESTIMONIAL OF LOST PASSWORD TO YOUR DIGITAL WALLET BACK. My name is Robert Alfred, Am from Australia. I’m sharing my experience in the hope that it helps others who have been victims of crypto scams. A few months ago, I fell victim to a fraudulent crypto investment scheme linked to a broker company. I had invested heavily during a time when Bitcoin prices were rising, thinking it was a good opportunity. Unfortunately, I was scammed out of $120,000 AUD and the broker denied me access to my digital wallet and assets. It was a devastating experience that caused many sleepless nights. Crypto scams are increasingly common and often involve fake trading platforms, phishing attacks, and misleading investment opportunities. In my desperation, a friend from the crypto community recommended Capital Crypto Recovery Service, known for helping victims recover lost or stolen funds. After doing some research and reading multiple positive reviews, I reached out to Capital Crypto Recovery. I provided all the necessary information—wallet addresses, transaction history, and communication logs. Their expert team responded immediately and began investigating. Using advanced blockchain tracking techniques, they were able to trace the stolen Dogecoin, identify the scammer’s wallet, and coordinate with relevant authorities to freeze the funds before they could be moved. Incredibly, within 24 hours, Capital Crypto Recovery successfully recovered the majority of my stolen crypto assets. I was beyond relieved and truly grateful. Their professionalism, transparency, and constant communication throughout the process gave me hope during a very difficult time. If you’ve been a victim of a crypto scam, I highly recommend them with full confidence contacting: Email: [email protected] Telegram: @Capitalcryptorecover Contact: [email protected] Call/Text: +1 (336) 390-6684 Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
03.04.26 13:04 robertalfred175

CRYPTO SCAM RECOVERY SUCCESSFUL – A TESTIMONIAL OF LOST PASSWORD TO YOUR DIGITAL WALLET BACK. My name is Robert Alfred, Am from Australia. I’m sharing my experience in the hope that it helps others who have been victims of crypto scams. A few months ago, I fell victim to a fraudulent crypto investment scheme linked to a broker company. I had invested heavily during a time when Bitcoin prices were rising, thinking it was a good opportunity. Unfortunately, I was scammed out of $120,000 AUD and the broker denied me access to my digital wallet and assets. It was a devastating experience that caused many sleepless nights. Crypto scams are increasingly common and often involve fake trading platforms, phishing attacks, and misleading investment opportunities. In my desperation, a friend from the crypto community recommended Capital Crypto Recovery Service, known for helping victims recover lost or stolen funds. After doing some research and reading multiple positive reviews, I reached out to Capital Crypto Recovery. I provided all the necessary information—wallet addresses, transaction history, and communication logs. Their expert team responded immediately and began investigating. Using advanced blockchain tracking techniques, they were able to trace the stolen Dogecoin, identify the scammer’s wallet, and coordinate with relevant authorities to freeze the funds before they could be moved. Incredibly, within 24 hours, Capital Crypto Recovery successfully recovered the majority of my stolen crypto assets. I was beyond relieved and truly grateful. Their professionalism, transparency, and constant communication throughout the process gave me hope during a very difficult time. If you’ve been a victim of a crypto scam, I highly recommend them with full confidence contacting: Email: [email protected] Telegram: @Capitalcryptorecover Contact: [email protected] Call/Text: +1 (336) 390-6684 Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
05.04.26 12:35 Kelvin Alfons

GREAT WHIP RECOVERY CYBER SERVICES PROVES ITS DOMINANCE AS ONE OF THE MOST POWERFUL AND DEPENDABLE ONLINE CYBER RECOVERY EXPERTS Hello everyone. I’d like to share my personal experience from one of the most challenging times in my life. I’m based in Sydney, Australia, and on November 13, 2025, I fell victim to a fraudulent cryptocurrency investment platform that promised substantial financial growth. Believing their claims, I invested a total of $220,000 with the expectation of earning solid returns. However, when I attempted to withdraw my funds, all communication abruptly stopped. My calls were ignored, my emails went unanswered, and I was left feeling completely powerless. Like many others, I had heard that Bitcoin transactions are impossible to trace, so I assumed my money was lost forever. After some time, I discovered information about GREAT WHIP RECOVERY CYBER SERVICES, a reputable digital asset recovery firm. I decided to reach out to them, and to my astonishment, they were able to help me recover the full amount I had lost. I’m sharing my story in the hope that it may help someone else who is going through a similar situation and looking for support. Their contact is, Website: https://greatwhiprecoveryc.wixsite.com/greatwhip-site Email:[email protected] Call: +1(406)2729101
05.04.26 12:37 Kelvin Alfons

GREAT WHIP RECOVERY CYBER SERVICES PROVES ITS DOMINANCE AS ONE OF THE MOST POWERFUL AND DEPENDABLE ONLINE CYBER RECOVERY EXPERTS Hello everyone. I’d like to share my personal experience from one of the most challenging times in my life. I’m based in Sydney, Australia, and on November 13, 2025, I fell victim to a fraudulent cryptocurrency investment platform that promised substantial financial growth. Believing their claims, I invested a total of $220,000 with the expectation of earning solid returns. However, when I attempted to withdraw my funds, all communication abruptly stopped. My calls were ignored, my emails went unanswered, and I was left feeling completely powerless. Like many others, I had heard that Bitcoin transactions are impossible to trace, so I assumed my money was lost forever. After some time, I discovered information about GREAT WHIP RECOVERY CYBER SERVICES, a reputable digital asset recovery firm. I decided to reach out to them, and to my astonishment, they were able to help me recover the full amount I had lost. I’m sharing my story in the hope that it may help someone else who is going through a similar situation and looking for support. Their contact is, Website: https://greatwhiprecoveryc.wixsite.com/greatwhip-site Email:[email protected] Call: +1(406)2729101
05.04.26 14:14 michaeldavenport238

I was recently scammed out of $53,000 by a fraudulent Bitcoin investment scheme, which added significant stress to my already difficult health issues, as I was also facing cancer surgery expenses. Desperate to recover my funds, I spent hours researching and consulting other victims, which led me to discover the excellent reputation of Capital Crypto Recover, I came across a Google post It was only after spending many hours researching and asking other victims for advice that I discovered Capital Crypto Recovery’s stellar reputation. I decided to contact them because of their successful recovery record and encouraging client testimonials. I had no idea that this would be the pivotal moment in my fight against cryptocurrency theft. Thanks to their expert team, I was able to recover my lost cryptocurrency back. The process was intricate, but Capital Crypto Recovery's commitment to utilizing the latest technology ensured a successful outcome. I highly recommend their services to anyone who has fallen victim to cryptocurrency fraud. For assistance contact [email protected] and on Telegram OR Call Number +1 (336)390-6684 via email: [email protected] you can visit his website: https://recovercapital.wixsite.com/capital-crypto-rec-1
05.04.26 14:14 michaeldavenport238

I was recently scammed out of $53,000 by a fraudulent Bitcoin investment scheme, which added significant stress to my already difficult health issues, as I was also facing cancer surgery expenses. Desperate to recover my funds, I spent hours researching and consulting other victims, which led me to discover the excellent reputation of Capital Crypto Recover, I came across a Google post It was only after spending many hours researching and asking other victims for advice that I discovered Capital Crypto Recovery’s stellar reputation. I decided to contact them because of their successful recovery record and encouraging client testimonials. I had no idea that this would be the pivotal moment in my fight against cryptocurrency theft. Thanks to their expert team, I was able to recover my lost cryptocurrency back. The process was intricate, but Capital Crypto Recovery's commitment to utilizing the latest technology ensured a successful outcome. I highly recommend their services to anyone who has fallen victim to cryptocurrency fraud. For assistance contact [email protected] and on Telegram OR Call Number +1 (336)390-6684 via email: [email protected] you can visit his website: https://recovercapital.wixsite.com/capital-crypto-rec-1
06.04.26 15:21 richard

THE MOST CREDIBLE CRYPTO RECOVERY: TOP RECOVERY EXPERT TOP RECOVERY EXPERT is a reliable and legitimate company that can help recover lost cryptocurrency assets. After weeks of wondering if my lost BTC could ever be restored, I realized how frequent cryptocurrency scams have become. When dealing with individuals online, especially regarding money, caution is essential. Recovering stolen cryptocurrency is possible, but it’s important not to fall victim to another scam—there are many fake “recovery companies” worldwide. Real hackers work discreetly and do not advertise themselves in such obvious ways. I personcally experienced multiple scams while desperately seeking help to recover my lost funds. Finally, a friend introduced me to TOP RECOVERY EXPERT, a trustworthy and discreet team. They handle everything from securing personal or company websites to recovering cryptocurrency assets. With their help, I successfully recovered $680,000 worth of USDT in just over a week. Their professionalism, discretion, and prompt service were outstanding. If you’ve been compromised, don’t lose hope—and be careful of fraudsters posing as saviors. TOP RECOVERY EXPERT are real professionals in crypto recovery. I am living proof of their effectiveness. you can reach them by email: [email protected] OR you contact their Phone Call/Text: +1 (346) 980-9102 you can visit website: https://toprecoveryexpert2.wixsite.com/consultant
06.04.26 18:55 robertalfred175

CRYPTO SCAM RECOVERY SUCCESSFUL – A TESTIMONIAL OF LOST PASSWORD TO YOUR DIGITAL WALLET BACK. My name is Robert Alfred, Am from Australia. I’m sharing my experience in the hope that it helps others who have been victims of crypto scams. A few months ago, I fell victim to a fraudulent crypto investment scheme linked to a broker company. I had invested heavily during a time when Bitcoin prices were rising, thinking it was a good opportunity. Unfortunately, I was scammed out of $120,000 AUD and the broker denied me access to my digital wallet and assets. It was a devastating experience that caused many sleepless nights. Crypto scams are increasingly common and often involve fake trading platforms, phishing attacks, and misleading investment opportunities. In my desperation, a friend from the crypto community recommended Capital Crypto Recovery Service, known for helping victims recover lost or stolen funds. After doing some research and reading multiple positive reviews, I reached out to Capital Crypto Recovery. I provided all the necessary information—wallet addresses, transaction history, and communication logs. Their expert team responded immediately and began investigating. Using advanced blockchain tracking techniques, they were able to trace the stolen Dogecoin, identify the scammer’s wallet, and coordinate with relevant authorities to freeze the funds before they could be moved. Incredibly, within 24 hours, Capital Crypto Recovery successfully recovered the majority of my stolen crypto assets. I was beyond relieved and truly grateful. Their professionalism, transparency, and constant communication throughout the process gave me hope during a very difficult time. If you’ve been a victim of a crypto scam, I highly recommend them with full confidence contacting: Email: [email protected] Telegram: @Capitalcryptorecover Contact: [email protected] Call/Text: +1 (336) 390-6684 Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
07.04.26 13:05 Kelvin Alfons

GREAT WHIP RECOVERY CYBER SERVICES PROVES ITS DOMINANCE AS ONE OF THE MOST POWERFUL AND DEPENDABLE ONLINE CYBER RECOVERY EXPERTS Hello everyone. I’d like to share my personal experience from one of the most challenging times in my life. I’m based in Sydney, Australia, and on November 13, 2025, I fell victim to a fraudulent cryptocurrency investment platform that promised substantial financial growth. Believing their claims, I invested a total of $220,000 with the expectation of earning solid returns. However, when I attempted to withdraw my funds, all communication abruptly stopped. My calls were ignored, my emails went unanswered, and I was left feeling completely powerless. Like many others, I had heard that Bitcoin transactions are impossible to trace, so I assumed my money was lost forever. After some time, I discovered information about GREAT WHIP RECOVERY CYBER SERVICES, a reputable digital asset recovery firm. I decided to reach out to them, and to my astonishment, they were able to help me recover the full amount I had lost. I’m sharing my story in the hope that it may help someone else who is going through a similar situation and looking for support. Their contact is, Website: https://greatwhiprecoveryc.wixsite.com/greatwhip-site Email:[email protected] Call: +1(406)2729101
07.04.26 13:06 Kelvin Alfons

GREAT WHIP RECOVERY CYBER SERVICES PROVES ITS DOMINANCE AS ONE OF THE MOST POWERFUL AND DEPENDABLE ONLINE CYBER RECOVERY EXPERTS Hello everyone. I’d like to share my personal experience from one of the most challenging times in my life. I’m based in Sydney, Australia, and on November 13, 2025, I fell victim to a fraudulent cryptocurrency investment platform that promised substantial financial growth. Believing their claims, I invested a total of $220,000 with the expectation of earning solid returns. However, when I attempted to withdraw my funds, all communication abruptly stopped. My calls were ignored, my emails went unanswered, and I was left feeling completely powerless. Like many others, I had heard that Bitcoin transactions are impossible to trace, so I assumed my money was lost forever. After some time, I discovered information about GREAT WHIP RECOVERY CYBER SERVICES, a reputable digital asset recovery firm. I decided to reach out to them, and to my astonishment, they were able to help me recover the full amount I had lost. I’m sharing my story in the hope that it may help someone else who is going through a similar situation and looking for support. Their contact is, Website: https://greatwhiprecoveryc.wixsite.com/greatwhip-site Email:[email protected] Call: +1(406)2729101
07.04.26 13:48 marcushenderson624

Bitcoin Recovery Testimonial After falling victim to a cryptocurrency scam group, I lost $354,000 worth of USDT. I thought all hope was lost from the experience of losing my hard-earned money to scammers. I was devastated and believed there was no way to recover my funds. Fortunately, I started searching for help to recover my stolen funds and I came across a lot of testimonials online about Capital Crypto Recovery, an agent who helps in recovery of lost bitcoin funds, I contacted Capital Crypto Recover Service, and with their expertise, they successfully traced and recovered my stolen assets. Their team was professional, kept me updated throughout the process, and demonstrated a deep understanding of blockchain transactions and recovery protocols. They are trusted and very reliable with a 100% successful rate record Recovery bitcoin, I’m grateful for their help and highly recommend their services to anyone seeking assistance with lost crypto. Contact: [email protected] Phone CALL/Text Number: +1 (336) 390-6684 Email: [email protected] Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
07.04.26 13:48 marcushenderson624

Bitcoin Recovery Testimonial After falling victim to a cryptocurrency scam group, I lost $354,000 worth of USDT. I thought all hope was lost from the experience of losing my hard-earned money to scammers. I was devastated and believed there was no way to recover my funds. Fortunately, I started searching for help to recover my stolen funds and I came across a lot of testimonials online about Capital Crypto Recovery, an agent who helps in recovery of lost bitcoin funds, I contacted Capital Crypto Recover Service, and with their expertise, they successfully traced and recovered my stolen assets. Their team was professional, kept me updated throughout the process, and demonstrated a deep understanding of blockchain transactions and recovery protocols. They are trusted and very reliable with a 100% successful rate record Recovery bitcoin, I’m grateful for their help and highly recommend their services to anyone seeking assistance with lost crypto. Contact: [email protected] Phone CALL/Text Number: +1 (336) 390-6684 Email: [email protected] Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
07.04.26 15:34 mary

It can be difficult navigating the world of online recommendations, especially with unreliable services out there. However, I found this recovery service to be incredibly reliable. Their professionalism and effectiveness stand out, and I can confidently recommend them. They are the real deal for recovering losses from scammers. omegacryptorecovery @ Gm a il com
08.04.26 13:44 Kelvin Alfons

GREAT WHIP RECOVERY CYBER SERVICES PROVES ITS DOMINANCE AS ONE OF THE MOST POWERFUL AND DEPENDABLE ONLINE CYBER RECOVERY EXPERTS Hello everyone. I’d like to share my personal experience from one of the most challenging times in my life. I’m based in Sydney, Australia, and on November 13, 2025, I fell victim to a fraudulent cryptocurrency investment platform that promised substantial financial growth. Believing their claims, I invested a total of $220,000 with the expectation of earning solid returns. However, when I attempted to withdraw my funds, all communication abruptly stopped. My calls were ignored, my emails went unanswered, and I was left feeling completely powerless. Like many others, I had heard that Bitcoin transactions are impossible to trace, so I assumed my money was lost forever. After some time, I discovered information about GREAT WHIP RECOVERY CYBER SERVICES, a reputable digital asset recovery firm. I decided to reach out to them, and to my astonishment, they were able to help me recover the full amount I had lost. I’m sharing my story in the hope that it may help someone else who is going through a similar situation and looking for support. Their contact is, Website: https://greatwhiprecoveryc.wixsite.com/greatwhip-site Email:[email protected] Call: +1(406)2729101
08.04.26 13:44 Kelvin Alfons

GREAT WHIP RECOVERY CYBER SERVICES PROVES ITS DOMINANCE AS ONE OF THE MOST POWERFUL AND DEPENDABLE ONLINE CYBER RECOVERY EXPERTS Hello everyone. I’d like to share my personal experience from one of the most challenging times in my life. I’m based in Sydney, Australia, and on November 13, 2025, I fell victim to a fraudulent cryptocurrency investment platform that promised substantial financial growth. Believing their claims, I invested a total of $220,000 with the expectation of earning solid returns. However, when I attempted to withdraw my funds, all communication abruptly stopped. My calls were ignored, my emails went unanswered, and I was left feeling completely powerless. Like many others, I had heard that Bitcoin transactions are impossible to trace, so I assumed my money was lost forever. After some time, I discovered information about GREAT WHIP RECOVERY CYBER SERVICES, a reputable digital asset recovery firm. I decided to reach out to them, and to my astonishment, they were able to help me recover the full amount I had lost. I’m sharing my story in the hope that it may help someone else who is going through a similar situation and looking for support. Their contact is, Website: https://greatwhiprecoveryc.wixsite.com/greatwhip-site Email:[email protected] Call: +1(406)2729101
08.04.26 13:59 robertalfred175

CRYPTO SCAM RECOVERY SUCCESSFUL – A TESTIMONIAL OF LOST PASSWORD TO YOUR DIGITAL WALLET BACK. My name is Robert Alfred, Am from Australia. I’m sharing my experience in the hope that it helps others who have been victims of crypto scams. A few months ago, I fell victim to a fraudulent crypto investment scheme linked to a broker company. I had invested heavily during a time when Bitcoin prices were rising, thinking it was a good opportunity. Unfortunately, I was scammed out of $120,000 AUD and the broker denied me access to my digital wallet and assets. It was a devastating experience that caused many sleepless nights. Crypto scams are increasingly common and often involve fake trading platforms, phishing attacks, and misleading investment opportunities. In my desperation, a friend from the crypto community recommended Capital Crypto Recovery Service, known for helping victims recover lost or stolen funds. After doing some research and reading multiple positive reviews, I reached out to Capital Crypto Recovery. I provided all the necessary information—wallet addresses, transaction history, and communication logs. Their expert team responded immediately and began investigating. Using advanced blockchain tracking techniques, they were able to trace the stolen Dogecoin, identify the scammer’s wallet, and coordinate with relevant authorities to freeze the funds before they could be moved. Incredibly, within 24 hours, Capital Crypto Recovery successfully recovered the majority of my stolen crypto assets. I was beyond relieved and truly grateful. Their professionalism, transparency, and constant communication throughout the process gave me hope during a very difficult time. If you’ve been a victim of a crypto scam, I highly recommend them with full confidence contacting: 📧 Email: [email protected] 📱 Telegram: @Capitalcryptorecover Contact: [email protected] 📞 Call/Text: +1 (336) 390-6684 Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
08.04.26 13:59 robertalfred175

CRYPTO SCAM RECOVERY SUCCESSFUL – A TESTIMONIAL OF LOST PASSWORD TO YOUR DIGITAL WALLET BACK. My name is Robert Alfred, Am from Australia. I’m sharing my experience in the hope that it helps others who have been victims of crypto scams. A few months ago, I fell victim to a fraudulent crypto investment scheme linked to a broker company. I had invested heavily during a time when Bitcoin prices were rising, thinking it was a good opportunity. Unfortunately, I was scammed out of $120,000 AUD and the broker denied me access to my digital wallet and assets. It was a devastating experience that caused many sleepless nights. Crypto scams are increasingly common and often involve fake trading platforms, phishing attacks, and misleading investment opportunities. In my desperation, a friend from the crypto community recommended Capital Crypto Recovery Service, known for helping victims recover lost or stolen funds. After doing some research and reading multiple positive reviews, I reached out to Capital Crypto Recovery. I provided all the necessary information—wallet addresses, transaction history, and communication logs. Their expert team responded immediately and began investigating. Using advanced blockchain tracking techniques, they were able to trace the stolen Dogecoin, identify the scammer’s wallet, and coordinate with relevant authorities to freeze the funds before they could be moved. Incredibly, within 24 hours, Capital Crypto Recovery successfully recovered the majority of my stolen crypto assets. I was beyond relieved and truly grateful. Their professionalism, transparency, and constant communication throughout the process gave me hope during a very difficult time. If you’ve been a victim of a crypto scam, I highly recommend them with full confidence contacting: 📧 Email: [email protected] 📱 Telegram: @Capitalcryptorecover Contact: [email protected] 📞 Call/Text: +1 (336) 390-6684 Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
11.04.26 17:49 CARL9090

Losing USDT hurts like a bad punch. This stablecoin stays near one dollar. Traders use it to swap for Bitcoin or Ethereum without big price jumps. New users pick it first for its ease. Banks hold cash reserves to back it up. Losses hit fast. A wrong wallet address sends coins to strangers. Scams on Telegram steal seed phrases. DeFi bugs or hacks drain funds. Billions vanish each year from these mistakes. Blockchains track every step. Copy your transaction hash. Check it on Etherscan. Follow the trail to the wallet or contract. [email protected] +(44 7476618364) can help. Their team of hunts funds across chains. They work with exchanges and devs to get assets back. People recover thousands of assets already even after being lost for years of failed agency and fake recovery experts. also teaches safety. Spot phishing in MetaMask. Secure your Ledger. Trade safe on Binance or Uniswap. Fix rookie slips into smart habits
12.04.26 02:12 harristhomas7376

"In the crypto world, this is great news I want to share. Last year, I fell victim to a scam disguised as a safe investment option. I have invested in crypto trading platforms for about 10yrs thinking I was ensuring myself a retirement income, only to find that all my assets were either frozen, I believed my assets were secure — until I discovered that my BTC funds had been frozen and withdrawals were impossible. It was a devastating moment when I realized I had been scammed, and I thought my Bitcoin was gone forever, Everything changed when a close friend recommended the Capital Crypto Recover Service. Their professionalism, expertise, and dedication enabled me to recover my lost Bitcoin funds back — more than €560.000 DEM to my BTC wallet. What once felt impossible became a reality thanks to their support. If you have lost Bitcoin through scams, hacking, failed withdrawals, or similar challenges, don’t lose hope. I strongly recommend Capital Crypto Recover Service to anyone seeking a reliable and effective solution for recovering any wallet assets. They have a proven track record of successful reputation in recovering lost password assets for their clients and can help you navigate the process of recovering your funds. Don’t let scammers get away with your hard-earned money – contact Email: [email protected] Phone CALL/Text Number: +1 (336) 390-6684 Contact: [email protected] Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
12.04.26 02:12 harristhomas7376

"In the crypto world, this is great news I want to share. Last year, I fell victim to a scam disguised as a safe investment option. I have invested in crypto trading platforms for about 10yrs thinking I was ensuring myself a retirement income, only to find that all my assets were either frozen, I believed my assets were secure — until I discovered that my BTC funds had been frozen and withdrawals were impossible. It was a devastating moment when I realized I had been scammed, and I thought my Bitcoin was gone forever, Everything changed when a close friend recommended the Capital Crypto Recover Service. Their professionalism, expertise, and dedication enabled me to recover my lost Bitcoin funds back — more than €560.000 DEM to my BTC wallet. What once felt impossible became a reality thanks to their support. If you have lost Bitcoin through scams, hacking, failed withdrawals, or similar challenges, don’t lose hope. I strongly recommend Capital Crypto Recover Service to anyone seeking a reliable and effective solution for recovering any wallet assets. They have a proven track record of successful reputation in recovering lost password assets for their clients and can help you navigate the process of recovering your funds. Don’t let scammers get away with your hard-earned money – contact Email: [email protected] Phone CALL/Text Number: +1 (336) 390-6684 Contact: [email protected] Website: https://recovercapital.wixsite.com/capital-crypto-rec-1

Для участия в Чате вам необходим бесплатный аккаунт pro-blockchain.com Войти Регистрация

№ п/п	sid	Описание	dataset_1	dataset_2	dataset_3	dataset_4	dataset_5	dataset_6
1	2028762	ET JA3 Hash - [Abuse.ch] Possible Trickbot	688\|0	1424\|5	1954\|10	0\|0	0\|0	3036\|11
2	2060504	ET INFO Observed Discord Service Domain (gateway .discord .gg) in TLS SNI	135\|0	534\|10	853\|7	0\|0	0\|0	3253\|669
3	2050884	ET INFO Observed vk .com API Domain (api .vk .com in TLS SNI)	231\|3	303\|261	331\|278	0\|0	0\|0	508\|361
4	2053282	ET TA_ABUSED_SERVICES Commonly Actor Abused Online Service Domain (syncthing .net)	197\|0	222\|14	459\|36	0\|0	0\|0	418\|29
5	2014819	ET INFO Packed Executable Download	145\|1	224\|44	261\|60	31\|2	47\|3	278\|59
6	2033967	ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)	92\|0	172\|26	220\|39	24\|8	12\|2	208\|37
7	2041933	ET INFO Observed Telegram Domain (t .me in TLS SNI)	25\|2	55\|46	53\|48	0\|0	0\|0	54\|40
8	2022082	ET INFO External IP Lookup ip-api.com	0\|0	46\|46	66\|66	0\|0	0\|0	73\|73
9	28000001	(o)DoH Query for dns.google	0\|0	2\|2	82\|82	0\|0	0\|0	1\|1
10	2035303	ET INFO Observed Chocolatey Windows Package Management Domain (chocolatey .org in TLS SNI)	19\|0	18\|0	27\|1	0\|0	0\|0	5\|0
11	2052581	ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)	0\|0	3\|3	0\|0	0\|0	0\|0	59\|59
12	28000974	(o)DoH Query for httpdns-push.heytapmobile.com	0\|0	0\|0	0\|0	0\|0	0\|0	61\|61
13	2060505	ET INFO Observed Discord Service Domain (discord .com) in TLS SNI	0\|0	13\|13	21\|21	0\|0	0\|0	24\|24
14	2029634	ET HUNTING Suspected Malicious Telegram Communication (POST)	5\|0	13\|13	6\|6	0\|0	0\|0	15\|13
15	1006213	MultiProxy Firefox Add-ons	33\|0	3\|2	0\|0	0\|0	0\|0	0\|0
16	2062715	ET INFO Observed UA-CPU Header	2\|1	7\|7	12\|12	0\|0	7\|7	8\|8
17	2026521	ET USER_AGENTS Suspicious User-Agent (Windows 10)	0\|0	26\|26	6\|6	0\|0	0\|0	0\|0
18	1006319	PORT SCAN (NMAP -sA)	0\|0	8\|8	4\|4	0\|0	0\|0	16\|16
19	1006585	Outbound connection to a possible C&C server	0\|0	4\|4	1\|1	0\|0	0\|0	22\|22
20	2057746	ET INFO Observed Cloudflare Page Developer Domain (pages .dev in TLS SNI)	3\|3	3\|3	7\|7	0\|0	0\|0	9\|9
21	1006557	IP blocklist	2\|2	4\|4	5\|5	1\|1	2\|2	7\|7
22	2029322	ET HUNTING Telegram API Certificate Observed	3\|0	3\|1	2\|1	1\|1	2\|1	3\|1
23	58565362	Trojan-PSW.Agent.HTTP.C&C	0\|0	8\|8	5\|5	0\|0	0\|0	1\|1
24	2063118	ET INFO Abused Hosting Domain (azurewebsites .net) in TLS SNI	1\|0	1\|1	2\|2	0\|0	0\|0	6\|6
25	2027695	ET INFO Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)	0\|0	1\|0	4\|0	0\|0	0\|0	4\|0
26	1800920	IP blocklist	0\|0	0\|0	9\|9	0\|0	0\|0	0\|0
27	2050633	ET INFO Observed File Hosting Service Domain (zohopublic .eu) in TLS SNI	8\|0	0\|0	0\|0	0\|0	0\|0	0\|0
28	28000196	(o)DoH Query for dns.google.com	1\|1	3\|3	4\|4	0\|0	0\|0	0\|0
29	28000040	(o)DoH Query for mozilla.cloudflare-dns.com	1\|0	4\|0	1\|0	0\|0	1\|0	1\|0
30	1006258	PlanetVPN	0\|0	3\|1	1\|1	0\|0	0\|0	3\|1
31	1801497	IP blocklist	0\|0	3\|3	2\|2	0\|0	1\|1	0\|0
32	2058779	ET INFO Observed Smart Chain Domain in TLS SNI (bsc-dataseed .binance .org)	0\|0	2\|2	4\|4	0\|0	0\|0	0\|0
33	2027762	ET REMOTE_ACCESS AnyDesk Remote Desktop Software User-Agent	0\|0	0\|0	2\|2	0\|0	0\|0	4\|4
34	2013927	ET INFO HTTP traffic on port 443 (HEAD)	0\|0	2\|2	2\|2	0\|0	0\|0	1\|1
35	2046071	ET INFO Observed Google DNS over HTTPS Domain (dns .google .com in TLS SNI)	0\|0	2\|2	1\|1	0\|0	0\|0	2\|2
36	2017398	ET INFO IP Check Domain (icanhazip. com in HTTP Host)	0\|0	0\|0	3\|3	0\|0	0\|0	2\|2
37	2049202	ET INFO Observed File Hosting Service Domain (files .pythonhosted .org in TLS SNI)	0\|0	0\|0	3\|3	0\|0	0\|0	2\|2
38	2043310	ET HUNTING DDoS-Guard Hosted Content	0\|0	0\|0	4\|4	0\|0	0\|0	1\|1
39	28000002	(o)DoH Query for cloudflare-dns.com	0\|0	2\|0	1\|0	0\|0	0\|0	1\|0
40	2050130	ET INFO Observed Online Application Hosting Domain (supabase .co in TLS SNI)	0\|0	2\|2	2\|2	0\|0	0\|0	0\|0
41	2057036	ET EXPLOIT_KIT Balada Domain in TLS SNI (broworker10s .com)	0\|0	4\|4	0\|0	0\|0	0\|0	0\|0
42	1801678	IP blocklist	1\|1	1\|1	0\|0	0\|0	0\|0	1\|1
43	1802605	IP blocklist	1\|1	0\|0	1\|1	1\|1	0\|0	0\|0
44	2021701	ET GAMES MINECRAFT Server response inbound	0\|0	3\|3	0\|0	0\|0	0\|0	0\|0
45	1006260	VeePN	0\|0	3\|3	0\|0	0\|0	0\|0	0\|0
46	2049251	ET INFO Observed FingerprintJS Domain (openfpcdn .io in TLS SNI)	0\|0	2\|2	1\|1	0\|0	0\|0	0\|0
47	2063071	ET INFO Observed External IP Lookup Domain (l2 .io) in TLS SNI	0\|0	0\|0	1\|1	0\|0	0\|0	2\|2
48	1803186	IP blocklist	0\|0	0\|0	1\|1	0\|0	0\|0	2\|2
49	2047866	ET INFO Observed Google DNS over HTTPS Domain (dns .google in TLS SNI)	0\|0	0\|0	3\|3	0\|0	0\|0	0\|0
50	36674245	HackTool.Nmap.TLS.C&C	0\|0	0\|0	0\|0	0\|0	0\|0	3\|3
51	2023753	ET SCAN MS Terminal Server Traffic on Non-standard Port	0\|0	0\|0	0\|0	0\|0	0\|0	3\|3
52	28000957	(o)DoH Query for httpdns-push.heytapmobile.com	2\|2	0\|0	0\|0	0\|0	0\|0	0\|0
53	1800572	IP blocklist	1\|1	0\|0	0\|0	0\|0	1\|1	0\|0
54	2039595	ET INFO External IP Address Lookup Domain (get .geojs .io) in TLS SNI	0\|0	2\|2	0\|0	0\|0	0\|0	0\|0
55	1800324	IP blocklist	0\|0	1\|1	0\|0	0\|0	0\|0	1\|1
56	1801470	IP blocklist	0\|0	1\|1	0\|0	0\|0	0\|0	1\|1
57	1802765	IP blocklist	0\|0	1\|1	0\|0	0\|0	0\|0	1\|1
58	2054227	ET TA_ABUSED_SERVICES Fingerprinting Service in TLS SNI (customfingerprints .bablosoft .com)	0\|0	0\|0	2\|2	0\|0	0\|0	0\|0
59	1802434	IP blocklist	0\|0	0\|0	0\|0	0\|0	0\|0	2\|2
60	2050282	ET INFO Observed External IP Lookup Domain (ip-info .ff .avast .com) in TLS SNI	0\|0	0\|0	0\|0	0\|0	0\|0	2\|2
61	2400004	ET DROP Spamhaus DROP Listed Traffic Inbound group 5	0\|0	0\|0	0\|0	0\|0	0\|0	2\|2

№ п/п	sid	Описание	dataset_1	dataset_2	dataset_3	dataset_4	dataset_5	dataset_6
1	2028762	ET JA3 Hash - [Abuse.ch] Possible Trickbot	688\|0	1424\|0	1954\|9	0\|0	0\|0	3036\|6
2	2014819	ET INFO Packed Executable Download	145\|0	224\|0	261\|42	31\|0	47\|1	278\|37
3	2022082	ET INFO External IP Lookup ip-api.com	0\|0	46\|0	66\|5	0\|0	0\|0	73\|0
4	2035303	ET INFO Observed Chocolatey Windows Package Management Domain (chocolatey .org in TLS SNI)	19\|0	18\|0	27\|2	0\|0	0\|0	5\|0
5	1006213	MultiProxy Firefox Add-ons	33\|4	3\|0	0\|0	0\|0	0\|0	0\|0
6	2026521	ET USER_AGENTS Suspicious User-Agent (Windows 10)	0\|0	26\|26	6\|6	0\|0	0\|0	0\|0
7	1006319	PORT SCAN (NMAP -sA)	0\|0	8\|0	4\|3	0\|0	0\|0	16\|16
8	2029322	ET HUNTING Telegram API Certificate Observed	3\|0	3\|1	2\|1	1\|1	2\|2	3\|3
9	58565362	Trojan-PSW.Agent.HTTP.C&C	0\|0	8\|0	5\|0	0\|0	0\|0	1\|0
10	2027695	ET INFO Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)	0\|0	1\|1	4\|4	0\|0	0\|0	4\|4
11	2050633	ET INFO Observed File Hosting Service Domain (zohopublic .eu) in TLS SNI	8\|5	0\|0	0\|0	0\|0	0\|0	0\|0
12	28000196	(o)DoH Query for dns.google.com	1\|1	3\|3	4\|4	0\|0	0\|0	0\|0
13	28000040	(o)DoH Query for mozilla.cloudflare-dns.com	1\|1	4\|4	1\|1	0\|0	1\|1	1\|1
14	2058779	ET INFO Observed Smart Chain Domain in TLS SNI (bsc-dataseed .binance .org)	0\|0	2\|1	4\|4	0\|0	0\|0	0\|0
15	2027762	ET REMOTE_ACCESS AnyDesk Remote Desktop Software User-Agent	0\|0	0\|0	2\|2	0\|0	0\|0	4\|4
16	2017398	ET INFO IP Check Domain (icanhazip. com in HTTP Host)	0\|0	0\|0	3\|3	0\|0	0\|0	2\|2
17	2043310	ET HUNTING DDoS-Guard Hosted Content	0\|0	0\|0	4\|4	0\|0	0\|0	1\|1
18	28000002	(o)DoH Query for cloudflare-dns.com	0\|0	2\|2	1\|1	0\|0	0\|0	1\|1
19	2050130	ET INFO Observed Online Application Hosting Domain (supabase .co in TLS SNI)	0\|0	2\|2	2\|2	0\|0	0\|0	0\|0
20	2057036	ET EXPLOIT_KIT Balada Domain in TLS SNI (broworker10s .com)	0\|0	4\|4	0\|0	0\|0	0\|0	0\|0
21	2021701	ET GAMES MINECRAFT Server response inbound	0\|0	3\|0	0\|0	0\|0	0\|0	0\|0
22	2049251	ET INFO Observed FingerprintJS Domain (openfpcdn .io in TLS SNI)	0\|0	2\|1	1\|1	0\|0	0\|0	0\|0
23	2063071	ET INFO Observed External IP Lookup Domain (l2 .io) in TLS SNI	0\|0	0\|0	1\|1	0\|0	0\|0	2\|2
24	2047866	ET INFO Observed Google DNS over HTTPS Domain (dns .google in TLS SNI)	0\|0	0\|0	3\|3	0\|0	0\|0	0\|0
25	36674245	HackTool.Nmap.TLS.C&C	0\|0	0\|0	0\|0	0\|0	0\|0	3\|3
26	2023753	ET SCAN MS Terminal Server Traffic on Non-standard Port	0\|0	0\|0	0\|0	0\|0	0\|0	3\|3
27	28000957	(o)DoH Query for httpdns-push.heytapmobile.com	2\|2	0\|0	0\|0	0\|0	0\|0	0\|0
28	2039595	ET INFO External IP Address Lookup Domain (get .geojs .io) in TLS SNI	0\|0	2\|2	0\|0	0\|0	0\|0	0\|0
29	2054227	ET TA_ABUSED_SERVICES Fingerprinting Service in TLS SNI (customfingerprints .bablosoft .com)	0\|0	0\|0	2\|2	0\|0	0\|0	0\|0
30	2047894	ET INFO Observed Online Collab Tool Domain (figma .com in TLS SNI)	0\|0	0\|0	1\|1	0\|0	0\|0	1\|1
31	2050282	ET INFO Observed External IP Lookup Domain (ip-info .ff .avast .com) in TLS SNI	0\|0	0\|0	0\|0	0\|0	0\|0	2\|2
32	2400004	ET DROP Spamhaus DROP Listed Traffic Inbound group 5	0\|0	0\|0	0\|0	0\|0	0\|0	2\|2
33	2054246	ET ATTACK_RESPONSE Eval Hex Obfuscated JS Inbound	0\|0	1\|0	0\|0	0\|0	0\|0	0\|0
34	2038967	ET INFO SSH-2.0-Go version string Observed in Network Traffic	0\|0	1\|0	0\|0	0\|0	0\|0	0\|0
35	1006206	Browsec-VPN	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
36	2060251	ET INFO Go-http-client User-Agent Observed Outbound	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
37	2014788	ET DYN_DNS DYNAMIC_DNS HTTP Request to a 3322.net Domain *.3322.net	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
38	2017499	ET ATTACK_RESPONSE Probably Evil Long Unicode string only string and unescape 1	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
39	1006914	Possible trojan activity, base64-encoded content	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
40	1003302	Anonymizer detected	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
41	2018383	ET EXPLOIT Possible OpenSSL HeartBleed Large HeartBeat Response from Common SSL Port (Outbound from Client)	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
42	2012252	ET SHELLCODE Common 0a0a0a0a Heap Spray String	0\|0	0\|0	0\|0	0\|0	0\|0	1\|1
43	2048493	ET INFO ISO File Downloaded	0\|0	0\|0	0\|0	0\|0	0\|0	1\|1
44	2024833	ET INFO Observed IP Lookup Domain (l2 .io in TLS SNI)	0\|0	0\|0	0\|0	0\|0	0\|0	1\|1

№ п/п	sid	Описание	dataset_1	dataset_2	dataset_3	dataset_4	dataset_5	dataset_6
1	2028762	ET JA3 Hash - [Abuse.ch] Possible Trickbot	688\|0	1424\|0	1954\|11	0\|0	0\|0	3036\|8
2	2014819	ET INFO Packed Executable Download	145\|0	224\|0	261\|37	31\|0	47\|1	278\|30
3	2022082	ET INFO External IP Lookup ip-api.com	0\|0	46\|0	66\|6	0\|0	0\|0	73\|2
4	2035303	ET INFO Observed Chocolatey Windows Package Management Domain (chocolatey .org in TLS SNI)	19\|0	18\|0	27\|2	0\|0	0\|0	5\|0
5	1006213	MultiProxy Firefox Add-ons	33\|5	3\|1	0\|0	0\|0	0\|0	0\|0
6	2026521	ET USER_AGENTS Suspicious User-Agent (Windows 10)	0\|0	26\|26	6\|6	0\|0	0\|0	0\|0
7	58565362	Trojan-PSW.Agent.HTTP.C&C	0\|0	8\|0	5\|0	0\|0	0\|0	1\|0
8	2027762	ET REMOTE_ACCESS AnyDesk Remote Desktop Software User-Agent	0\|0	0\|0	2\|2	0\|0	0\|0	4\|4
9	2013927	ET INFO HTTP traffic on port 443 (HEAD)	0\|0	2\|0	2\|2	0\|0	0\|0	1\|1
10	2017398	ET INFO IP Check Domain (icanhazip. com in HTTP Host)	0\|0	0\|0	3\|3	0\|0	0\|0	2\|2
11	2043310	ET HUNTING DDoS-Guard Hosted Content	0\|0	0\|0	4\|4	0\|0	0\|0	1\|1
12	2050130	ET INFO Observed Online Application Hosting Domain (supabase .co in TLS SNI)	0\|0	2\|2	2\|2	0\|0	0\|0	0\|0
13	2057036	ET EXPLOIT_KIT Balada Domain in TLS SNI (broworker10s .com)	0\|0	4\|4	0\|0	0\|0	0\|0	0\|0
14	2021701	ET GAMES MINECRAFT Server response inbound	0\|0	3\|0	0\|0	0\|0	0\|0	0\|0
15	2049251	ET INFO Observed FingerprintJS Domain (openfpcdn .io in TLS SNI)	0\|0	2\|0	1\|1	0\|0	0\|0	0\|0
16	36674245	HackTool.Nmap.TLS.C&C	0\|0	0\|0	0\|0	0\|0	0\|0	3\|3
17	2023753	ET SCAN MS Terminal Server Traffic on Non-standard Port	0\|0	0\|0	0\|0	0\|0	0\|0	3\|3
18	2054246	ET ATTACK_RESPONSE Eval Hex Obfuscated JS Inbound	0\|0	1\|0	0\|0	0\|0	0\|0	0\|0
19	2038967	ET INFO SSH-2.0-Go version string Observed in Network Traffic	0\|0	1\|1	0\|0	0\|0	0\|0	0\|0
20	1006206	Browsec-VPN	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
21	2060251	ET INFO Go-http-client User-Agent Observed Outbound	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
22	2014788	ET DYN_DNS DYNAMIC_DNS HTTP Request to a 3322.net Domain *.3322.net	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
23	2017499	ET ATTACK_RESPONSE Probably Evil Long Unicode string only string and unescape 1	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
24	1006914	Possible trojan activity (base64-encoded content)	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
25	1003302	Anonymizer detected	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
26	2018383	ET EXPLOIT Possible OpenSSL HeartBleed Large HeartBeat Response from Common SSL Port (Outbound from Client)	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
27	2012252	ET SHELLCODE Common 0a0a0a0a Heap Spray String	0\|0	0\|0	0\|0	0\|0	0\|0	1\|1
28	2048493	ET INFO ISO File Downloaded	0\|0	0\|0	0\|0	0\|0	0\|0	1\|1

№ п/п	sid	Описание	dataset_1	dataset_2	dataset_3	dataset_4	dataset_5	dataset_6
1	2028762	ET JA3 Hash - [Abuse.ch] Possible Trickbot	688\|0	1424\|0	1954\|0	0\|0	0\|0	3036\|2
2	2014819	ET INFO Packed Executable Download	145\|0	224\|1	261\|5	31\|0	47\|0	278\|29
3	2022082	ET INFO External IP Lookup ip-api.com	0\|0	46\|0	66\|6	0\|0	0\|0	73\|2
4	2035303	ET INFO Observed Chocolatey Windows Package Management Domain (chocolatey .org in TLS SNI)	19\|0	18\|0	27\|1	0\|0	0\|0	5\|0
5	1006213	MultiProxy Firefox Add-ons	33\|3	3\|0	0\|0	0\|0	0\|0	0\|0
6	2026521	ET USER_AGENTS Suspicious User-Agent (Windows 10)	0\|0	26\|26	6\|6	0\|0	0\|0	0\|0
7	58565362	Trojan-PSW.Agent.HTTP.C&C	0\|0	8\|0	5\|0	0\|0	0\|0	1\|0
8	2027762	ET REMOTE_ACCESS AnyDesk Remote Desktop Software User-Agent	0\|0	0\|0	2\|1	0\|0	0\|0	4\|2
9	2013927	ET INFO HTTP traffic on port 443 (HEAD)	0\|0	2\|0	2\|0	0\|0	0\|0	1\|0
10	2017398	ET INFO IP Check Domain (icanhazip. com in HTTP Host)	0\|0	0\|0	3\|1	0\|0	0\|0	2\|1
11	2043310	ET HUNTING DDoS-Guard Hosted Content	0\|0	0\|0	4\|0	0\|0	0\|0	1\|1
12	2050130	ET INFO Observed Online Application Hosting Domain (supabase .co in TLS SNI)	0\|0	2\|0	2\|0	0\|0	0\|0	0\|0
13	2057036	ET EXPLOIT_KIT Balada Domain in TLS SNI (broworker10s .com)	0\|0	4\|4	0\|0	0\|0	0\|0	0\|0
14	2021701	ET GAMES MINECRAFT Server response inbound	0\|0	3\|0	0\|0	0\|0	0\|0	0\|0
15	2049251	ET INFO Observed FingerprintJS Domain (openfpcdn .io in TLS SNI)	0\|0	2\|0	1\|1	0\|0	0\|0	0\|0
16	36674245	HackTool.Nmap.TLS.C&C	0\|0	0\|0	0\|0	0\|0	0\|0	3\|3
17	2023753	ET SCAN MS Terminal Server Traffic on Non-standard Port	0\|0	0\|0	0\|0	0\|0	0\|0	3\|3
18	2054246	ET ATTACK_RESPONSE Eval Hex Obfuscated JS Inbound	0\|0	1\|0	0\|0	0\|0	0\|0	0\|0
19	2038967	ET INFO SSH-2.0-Go version string Observed in Network Traffic	0\|0	1\|1	0\|0	0\|0	0\|0	0\|0
20	1006206	Browsec-VPN	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
21	2060251	ET INFO Go-http-client User-Agent Observed Outbound	0\|0	0\|0	1\|0	0\|0	0\|0	0\|0
22	2014788	ET DYN_DNS DYNAMIC_DNS HTTP Request to a 3322.net Domain *.3322.net	0\|0	0\|0	1\|0	0\|0	0\|0	0\|0
23	2017499	ET ATTACK_RESPONSE Probably Evil Long Unicode string only string and unescape 1	0\|0	0\|0	1\|0	0\|0	0\|0	0\|0
24	1006914	Possible trojan activity (base64-encoded content)	0\|0	0\|0	1\|0	0\|0	0\|0	0\|0
25	1003302	Anonymizer detected	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
26	2018383	ET EXPLOIT Possible OpenSSL HeartBleed Large HeartBeat Response from Common SSL Port (Outbound from Client)	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
27	2012252	ET SHELLCODE Common 0a0a0a0a Heap Spray String	0\|0	0\|0	0\|0	0\|0	0\|0	1\|1
28	2048493	ET INFO ISO File Downloaded	0\|0	0\|0	0\|0	0\|0	0\|0	1\|1

Н Новости