[Silicon Defense logo]

SnortSnarf alert page

Source: 130.54.208.193: #501-600

SnortSnarf v021111.1

Signature section (16810)Top 20 source IPsTop 20 dest IPs

Looking using input module SnortFileInput, with sources:
Earliest: 11:30:59.880659 on 05/30/2010
Latest: 18:47:10.193747 on 06/14/2010

9 different signatures are present for 130.54.208.193 as a source

There are 1 distinct destination IPs in the alerts of the type on this page.

130.54.208.193 Whois lookup at: ARIN RIPE APNIC Geektools
DNS lookup at: Amenesi TRIUMF Princeton
More lookup links: Dshield Sam Spade

Go to: previous range, next range, all alerts, overview page
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
05/30-11:30:59.880659 130.54.208.193:51808 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:477
***AP*** Seq: 0x6CB8165 Ack: 0x11CA980B Win: 0x2180 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3072:1] IMAP status overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
05/30-15:41:13.091036 130.54.208.193:39339 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:179
***AP*** Seq: 0xBB481AD1 Ack: 0xC6B3C424 Win: 0x16A0 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3072:1] IMAP status overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
05/30-15:41:13.364689 130.54.208.193:39339 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:192
***AP*** Seq: 0xBB481BA1 Ack: 0xC6B3C4BC Win: 0x16A0 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3072:1] IMAP status overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
05/30-15:41:14.196692 130.54.208.193:39339 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:462
***AP*** Seq: 0xBB481E15 Ack: 0xC6B3C662 Win: 0x16A0 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3072:1] IMAP status overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
05/30-15:41:14.251814 130.54.208.193:39339 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:666
***AP*** Seq: 0xC6B3C662 Ack: 0xBB481E7E Win: 0x9E4 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
05/30-16:41:42.508815 130.54.208.193:2514 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:225
***AP*** Seq: 0x9B6E967E Ack: 0x1357CA08 Win: 0x1920 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
05/30-16:41:43.078741 130.54.208.193:2514 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:240
***AP*** Seq: 0x9B6EC8A8 Ack: 0x1357CAD0 Win: 0x1920 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
05/30-16:41:43.924449 130.54.208.193:2514 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:179
***AP*** Seq: 0x1357CB47 Ack: 0x9B6EDDAC Win: 0xFF32 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3072:1] IMAP status overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
05/30-19:45:55.780680 130.54.208.193:38082 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:605
***AP*** Seq: 0x561B24CC Ack: 0x62EC2F0B Win: 0x16A0 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3072:1] IMAP status overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
05/30-19:45:55.823374 130.54.208.193:38082 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:523
***AP*** Seq: 0x62EC2F0B Ack: 0x561B2533 Win: 0x9E4 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
05/31-09:49:54.332773 130.54.208.193:3051 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:213
***AP*** Seq: 0xAFCCD77A Ack: 0x91C2ECD Win: 0x1920 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
05/31-09:50:22.430151 130.54.208.193:3051 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:266
***AP*** Seq: 0xAFCCEB82 Ack: 0x91C2FAF Win: 0x1920 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
05/31-09:50:24.078100 130.54.208.193:3051 -> 192.168.24.11:143
TCP TTL:111 TOS:0x0 ID:37402 IpLen:20 DgmLen:254 DF
***AP*** Seq: 0x91C3003 Ack: 0xAFCD1F0C Win: 0xFFFF TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
05/31-09:50:37.010028 130.54.208.193:3051 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:714
***AP*** Seq: 0xAFCE1C41 Ack: 0x91C337D Win: 0x2180 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/01-08:36:15.366002 130.54.208.193:4152 -> 192.168.24.11:143
TCP TTL:111 TOS:0x0 ID:31703 IpLen:20 DgmLen:249 DF
***AP*** Seq: 0xB67A1568 Ack: 0xDDDDEBB6 Win: 0xFFFF TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3072:1] IMAP status overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/01-11:26:28.252234 130.54.208.193:43244 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:398
***AP*** Seq: 0x65A9F6EF Ack: 0x80621454 Win: 0x16A0 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:1497:6] WEB-MISC cross site scripting attempt [**]
[Classification: Web Application Attack] [Priority: 1]
06/01-12:21:13.000218 130.54.208.193:3626 -> 192.168.24.11:80
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:30165
***AP*** Seq: 0x3467195E Ack: 0x5FD81098 Win: 0xBF22 TcpLen: 20
[**] [1:1113:5] WEB-MISC http directory traversal [**]
[Classification: Attempted Information Leak] [Priority: 2]
06/01-12:21:13.000218 130.54.208.193:3626 -> 192.168.24.11:80
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:30165
***AP*** Seq: 0x3467195E Ack: 0x5FD81098 Win: 0xBF22 TcpLen: 20
[Xref => http://www.whitehats.com/info/IDS297]
[**] [1:1497:6] WEB-MISC cross site scripting attempt [**]
[Classification: Web Application Attack] [Priority: 1]
06/01-12:23:26.820823 130.54.208.193:3629 -> 192.168.24.11:80
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:30375
***AP*** Seq: 0x3C9695B3 Ack: 0x6BEAA46 Win: 0xBF22 TcpLen: 20
[**] [1:1113:5] WEB-MISC http directory traversal [**]
[Classification: Attempted Information Leak] [Priority: 2]
06/01-12:23:26.820823 130.54.208.193:3629 -> 192.168.24.11:80
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:30375
***AP*** Seq: 0x3C9695B3 Ack: 0x6BEAA46 Win: 0xBF22 TcpLen: 20
[Xref => http://www.whitehats.com/info/IDS297]
[**] [1:1113:5] WEB-MISC http directory traversal [**]
[Classification: Attempted Information Leak] [Priority: 2]
06/01-12:29:04.740516 130.54.208.193:3633 -> 192.168.24.11:80
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:14296
***AP*** Seq: 0x8DAFE52A Ack: 0x519573FE Win: 0x4188 TcpLen: 20
[Xref => http://www.whitehats.com/info/IDS297]
[**] [1:1113:5] WEB-MISC http directory traversal [**]
[Classification: Attempted Information Leak] [Priority: 2]
06/01-12:30:31.128428 130.54.208.193:3634 -> 192.168.24.11:80
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:14435
***AP*** Seq: 0x5709472D Ack: 0x5DE53E94 Win: 0x8886 TcpLen: 20
[Xref => http://www.whitehats.com/info/IDS297]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/01-21:16:28.974016 130.54.208.193:1702 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:414
***AP*** Seq: 0x13EA9743 Ack: 0x4AF02E06 Win: 0x1920 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/02-09:36:40.263492 130.54.208.193:1882 -> 192.168.24.11:143
TCP TTL:111 TOS:0x0 ID:11248 IpLen:20 DgmLen:249 DF
***AP*** Seq: 0x4D51122 Ack: 0xF69914D3 Win: 0xFFFF TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/02-09:36:45.101245 130.54.208.193:1882 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:273
***AP*** Seq: 0xF699AA16 Ack: 0x4D512DE Win: 0x1D50 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/02-09:36:49.493796 130.54.208.193:1882 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:536
***AP*** Seq: 0xF699BE03 Ack: 0x4D514CE Win: 0x2180 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/02-09:36:51.839680 130.54.208.193:1882 -> 192.168.24.11:143
TCP TTL:111 TOS:0x0 ID:11310 IpLen:20 DgmLen:250 DF
***AP*** Seq: 0x4D514FF Ack: 0xF699C1A1 Win: 0xFC3B TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/02-09:36:56.187907 130.54.208.193:1882 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:353
***AP*** Seq: 0xF69B6EFA Ack: 0x4D517BE Win: 0x29E0 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/02-09:36:59.071996 130.54.208.193:1882 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:362
***AP*** Seq: 0x4D5184D Ack: 0xF69B7373 Win: 0xFF37 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:2570:7] WEB-MISC Invalid HTTP Version String [**]
[Classification: Detection of a non-standard protocol or event] [Priority: 2]
06/02-13:06:06.968534 130.54.208.193:2159 -> 192.168.24.11:80
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:1784
***AP*** Seq: 0x129D964D Ack: 0xA8058F1B Win: 0x25B0 TcpLen: 20
[Xref => http://cgi.nessus.org/plugins/dump.php3?id=11593][Xref => http://www.securityfocus.com/bid/9809]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/05-08:36:52.906762 130.54.208.193:3261 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:222
***AP*** Seq: 0xA78777F6 Ack: 0xE4D628AC Win: 0x1920 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/05-08:36:54.756990 130.54.208.193:3261 -> 192.168.24.11:143
TCP TTL:112 TOS:0x0 ID:39131 IpLen:20 DgmLen:254 DF
***AP*** Seq: 0xE4D6292A Ack: 0xA787AC98 Win: 0xFFFF TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/05-08:36:58.577836 130.54.208.193:3261 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:239
***AP*** Seq: 0xA7883A0A Ack: 0xE4D62AC9 Win: 0x1D50 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/05-12:50:02.307513 130.54.208.193:3451 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:175
***AP*** Seq: 0xFE1C6D37 Ack: 0x71B0CBA9 Win: 0xFFFF TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3072:1] IMAP status overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/05-15:29:20.627753 130.54.208.193:35110 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:404
***AP*** Seq: 0xCFB8C5E3 Ack: 0xDA01EB1 Win: 0x16A0 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/06-08:39:51.007514 130.54.208.193:1417 -> 192.168.24.11:143
TCP TTL:111 TOS:0x0 ID:15729 IpLen:20 DgmLen:249 DF
***AP*** Seq: 0x75658033 Ack: 0xF4FD36A6 Win: 0xFFFF TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/07-08:42:06.419664 130.54.208.193:3382 -> 192.168.24.11:143
TCP TTL:113 TOS:0x0 ID:50448 IpLen:20 DgmLen:249 DF
***AP*** Seq: 0x12D71E9C Ack: 0x2CFBCA99 Win: 0xFFFF TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/07-08:42:20.876107 130.54.208.193:3382 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:536
***AP*** Seq: 0x2CFCD01F Ack: 0x12D72212 Win: 0x2180 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/07-08:42:21.517511 130.54.208.193:3382 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:199
***AP*** Seq: 0x2CFD719A Ack: 0x12D722B1 Win: 0x2180 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [119:4:1] (http_inspect) BARE BYTE UNICODE ENCODING [**]
06/07-11:41:18.676104 130.54.208.193:4255 -> 192.168.24.11:80
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:1106
***AP*** Seq: 0x7A734E35 Ack: 0xDF0852AE Win: 0xFFFF TcpLen: 20
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/07-18:36:19.616491 130.54.208.193:1724 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:311
***AP*** Seq: 0xF2EA3218 Ack: 0x54D76197 Win: 0x1D50 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/08-08:51:29.542376 130.54.208.193:2066 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:204
***AP*** Seq: 0x8DDF31E6 Ack: 0xD7EA35F5 Win: 0x1920 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/08-08:51:31.326182 130.54.208.193:2066 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:217
***AP*** Seq: 0x8DDFC3D2 Ack: 0xD7EA36A6 Win: 0x1920 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/08-08:51:31.705697 130.54.208.193:2066 -> 192.168.24.11:143
TCP TTL:113 TOS:0x0 ID:5303 IpLen:20 DgmLen:249 DF
***AP*** Seq: 0xD7EA36D7 Ack: 0x8DDFF763 Win: 0xFFFF TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/08-08:51:36.367276 130.54.208.193:2066 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:349
***AP*** Seq: 0x8DE0A2F1 Ack: 0xD7EA3992 Win: 0x2180 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/08-08:51:38.250265 130.54.208.193:2066 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:258
***AP*** Seq: 0x8DE0AEED Ack: 0xD7EA3A6C Win: 0x2180 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3072:1] IMAP status overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/08-10:10:09.807480 130.54.208.193:56791 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:241
***AP*** Seq: 0xBCB7599F Ack: 0x1BA2F03E Win: 0x16A0 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3072:1] IMAP status overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/08-10:10:10.337421 130.54.208.193:56791 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:333
***AP*** Seq: 0xBCB75B4A Ack: 0x1BA2F163 Win: 0x16A0 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3072:1] IMAP status overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/08-10:10:11.778179 130.54.208.193:56791 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:814
***AP*** Seq: 0xBCB75FBF Ack: 0x1BA2F469 Win: 0x16A0 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3072:1] IMAP status overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/08-10:11:04.909568 130.54.208.193:56791 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:332
***AP*** Seq: 0xBCB76510 Ack: 0x1BA2F674 Win: 0x1920 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/08-10:11:09.510081 130.54.208.193:56791 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:207
***AP*** Seq: 0xBCB7B6AC Ack: 0x1BA2F87E Win: 0x1920 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/08-20:47:58.818835 130.54.208.193:3360 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:165
***AP*** Seq: 0x6FE973EB Ack: 0x1FDCD4FA Win: 0xFE4D TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/09-09:11:51.879661 130.54.208.193:3491 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:222
***AP*** Seq: 0x11A60BE5 Ack: 0x237A7515 Win: 0x1920 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/09-09:11:53.760929 130.54.208.193:3491 -> 192.168.24.11:143
TCP TTL:113 TOS:0x0 ID:6918 IpLen:20 DgmLen:249 DF
***AP*** Seq: 0x237A7593 Ack: 0x11A640A8 Win: 0xFFFF TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/09-09:12:03.470497 130.54.208.193:3491 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:521
***AP*** Seq: 0x11A73258 Ack: 0x237A7930 Win: 0x2180 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/09-09:12:19.421575 130.54.208.193:3491 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:630
***AP*** Seq: 0x11A7A852 Ack: 0x237A7B7E Win: 0x25B0 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/09-09:12:22.100280 130.54.208.193:3491 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:570
***AP*** Seq: 0x11A84840 Ack: 0x237A7D90 Win: 0x29E0 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/09-09:12:24.768792 130.54.208.193:3491 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:523
***AP*** Seq: 0x11A8DA32 Ack: 0x237A7F73 Win: 0x2E10 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/10-18:00:49.289709 130.54.208.193:1305 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:286
***AP*** Seq: 0x113276DE Ack: 0x44D972B7 Win: 0x1920 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:2570:7] WEB-MISC Invalid HTTP Version String [**]
[Classification: Detection of a non-standard protocol or event] [Priority: 2]
06/10-18:13:17.211845 130.54.208.193:2274 -> 192.168.24.11:80
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:1614
***AP*** Seq: 0x4513A982 Ack: 0xF8CF655 Win: 0x2350 TcpLen: 20
[Xref => http://cgi.nessus.org/plugins/dump.php3?id=11593][Xref => http://www.securityfocus.com/bid/9809]
[**] [1:2570:7] WEB-MISC Invalid HTTP Version String [**]
[Classification: Detection of a non-standard protocol or event] [Priority: 2]
06/10-18:13:51.072351 130.54.208.193:2276 -> 192.168.24.11:80
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:5856
***AP*** Seq: 0x4750C619 Ack: 0x6EAF5682 Win: 0x46C0 TcpLen: 20
[Xref => http://cgi.nessus.org/plugins/dump.php3?id=11593][Xref => http://www.securityfocus.com/bid/9809]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/10-18:14:22.338110 130.54.208.193:1305 -> 192.168.24.11:143
TCP TTL:113 TOS:0x0 ID:31015 IpLen:20 DgmLen:249 DF
***AP*** Seq: 0x44D973A3 Ack: 0x1132B857 Win: 0xFFFF TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/10-18:14:44.858800 130.54.208.193:1305 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:575
***AP*** Seq: 0x11337F45 Ack: 0x44D97740 Win: 0x2180 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/10-18:14:54.981675 130.54.208.193:1305 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:280
***AP*** Seq: 0x1133CAAA Ack: 0x44D97830 Win: 0x2180 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/10-18:14:57.071908 130.54.208.193:1305 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:577
***AP*** Seq: 0x44D979C2 Ack: 0x1133CED9 Win: 0xFFFF TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/11-10:59:52.547685 130.54.208.193:1374 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:286
***AP*** Seq: 0x14289D6C Ack: 0x4F166439 Win: 0x1920 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/11-10:59:53.896914 130.54.208.193:1374 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:305
***AP*** Seq: 0x1429CE3B Ack: 0x4F166542 Win: 0x1920 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/11-10:59:55.178035 130.54.208.193:1374 -> 192.168.24.11:143
TCP TTL:113 TOS:0x0 ID:32866 IpLen:20 DgmLen:249 DF
***AP*** Seq: 0x4F166596 Ack: 0x142A01FC Win: 0xFFFF TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/11-10:59:58.105924 130.54.208.193:1374 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:239
***AP*** Seq: 0x4F16671C Ack: 0x142A9136 Win: 0xFFFF TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/11-16:19:45.671986 130.54.208.193:2345 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:923
***AP*** Seq: 0x5D71FB3E Ack: 0x460F63FC Win: 0x1920 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/11-16:42:20.058209 130.54.208.193:2345 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:1995
***AP*** Seq: 0x5D723977 Ack: 0x460F6F02 Win: 0x2180 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/12-08:29:12.966048 130.54.208.193:2584 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:450
***AP*** Seq: 0x10967CA6 Ack: 0x5AED5812 Win: 0x1920 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/12-08:29:13.415323 130.54.208.193:2584 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:237
***AP*** Seq: 0x1096A832 Ack: 0x5AED58D7 Win: 0x1920 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/12-08:29:18.158860 130.54.208.193:2584 -> 192.168.24.11:143
TCP TTL:113 TOS:0x0 ID:25369 IpLen:20 DgmLen:249 DF
***AP*** Seq: 0x5AED59E0 Ack: 0x1096DDCB Win: 0xFFFF TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/12-08:29:23.565015 130.54.208.193:2584 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:273
***AP*** Seq: 0x10977270 Ack: 0x5AED5B9C Win: 0x1D50 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/12-08:29:24.951076 130.54.208.193:2584 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:497
***AP*** Seq: 0x5AED5D2E Ack: 0x10977C84 Win: 0xFCF4 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3072:1] IMAP status overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/12-09:12:26.426941 130.54.208.193:57014 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:469
***AP*** Seq: 0xB979E659 Ack: 0x3917DA4A Win: 0x16A0 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/12-11:33:51.248578 130.54.208.193:45010 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:253
***AP*** Seq: 0xC98034B0 Ack: 0x4A6F43E5 Win: 0x1D50 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/12-11:33:54.116065 130.54.208.193:45010 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:486
***AP*** Seq: 0xC9803AE9 Ack: 0x4A6F45A3 Win: 0x2180 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:1497:6] WEB-MISC cross site scripting attempt [**]
[Classification: Web Application Attack] [Priority: 1]
06/12-21:12:52.117317 130.54.208.193:4378 -> 192.168.24.11:80
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:17711
***AP*** Seq: 0x559382E8 Ack: 0x7175BD33 Win: 0x8306 TcpLen: 20
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/12-21:37:39.232810 130.54.208.193:4300 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:345
***AP*** Seq: 0x4F44F3BE Ack: 0x48A97EA6 Win: 0x1920 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/12-21:37:42.633366 130.54.208.193:4300 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:536
***AP*** Seq: 0x48A98082 Ack: 0x4F450DE1 Win: 0xFFFF TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/13-09:13:27.567875 130.54.208.193:4445 -> 192.168.24.11:143
TCP TTL:113 TOS:0x0 ID:7183 IpLen:20 DgmLen:249 DF
***AP*** Seq: 0x344F6ECD Ack: 0xE75DF3BA Win: 0xFFFF TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3072:1] IMAP status overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/13-09:18:09.526240 130.54.208.193:49862 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:471
***AP*** Seq: 0x4E7FD35 Ack: 0x8CEF49F9 Win: 0x16A0 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/13-09:28:36.516500 130.54.208.193:49862 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:407
***AP*** Seq: 0x4E8CEC1 Ack: 0x8CEF529A Win: 0x1D50 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [119:4:1] (http_inspect) BARE BYTE UNICODE ENCODING [**]
06/13-12:44:45.577966 130.54.208.193:33753 -> 192.168.24.11:80
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:2777
***AP*** Seq: 0xF5B2CEB Ack: 0xECEF2973 Win: 0x4B60 TcpLen: 20
[**] [119:4:1] (http_inspect) BARE BYTE UNICODE ENCODING [**]
06/13-12:44:47.329190 130.54.208.193:33752 -> 192.168.24.11:80
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:3559
***AP*** Seq: 0x10005B5E Ack: 0xEC3CFA94 Win: 0x81D0 TcpLen: 20
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/13-17:29:50.975262 130.54.208.193:1652 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:204
***AP*** Seq: 0x400ABD31 Ack: 0xA9395DD3 Win: 0x1920 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/13-17:29:52.025266 130.54.208.193:1652 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:223
***AP*** Seq: 0x400B42CD Ack: 0xA9395E8A Win: 0x1920 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/13-17:29:54.105189 130.54.208.193:1652 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:512
***AP*** Seq: 0x400B4750 Ack: 0xA9396062 Win: 0x1D50 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/14-09:16:13.480083 130.54.208.193:45239 -> 192.168.24.11:143
TCP TTL:49 TOS:0x0 ID:50204 IpLen:20 DgmLen:266 DF
***AP*** Seq: 0xBF19A87D Ack: 0x2E843E2A Win: 0x3E96 TcpLen: 32
TCP Options (3) => NOP NOP TS: 588929858 578197798
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/14-09:16:25.769485 130.54.208.193:45239 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:241
***AP*** Seq: 0x2E850157 Ack: 0xBF19AA6B Win: 0x1D50 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/14-09:16:26.129327 130.54.208.193:45239 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:331
***AP*** Seq: 0x2E850533 Ack: 0xBF19AB8E Win: 0x2180 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/14-09:16:28.870661 130.54.208.193:45239 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:243
***AP*** Seq: 0x2E85200E Ack: 0xBF19AC59 Win: 0x2180 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [119:4:1] (http_inspect) BARE BYTE UNICODE ENCODING [**]
06/14-10:31:18.358651 130.54.208.193:1331 -> 192.168.24.11:80
TCP TTL:113 TOS:0x0 ID:10650 IpLen:20 DgmLen:1438 DF
***A**** Seq: 0xB615F165 Ack: 0x4DFA73CB Win: 0xFFFF TcpLen: 20
[**] [1:3072:1] IMAP status overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/14-16:40:21.666249 130.54.208.193:46633 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:183
***AP*** Seq: 0xBE59129C Ack: 0x4F8420B5 Win: 0x16A0 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3072:1] IMAP status overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/14-16:40:24.028847 130.54.208.193:46633 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:525
***AP*** Seq: 0xBE5941ED Ack: 0x4F84229A Win: 0x1920 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/14-16:40:24.028847 130.54.208.193:46633 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:525
***AP*** Seq: 0xBE5941ED Ack: 0x4F84229A Win: 0x1920 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/14-18:47:09.676760 130.54.208.193:58067 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:1430
***AP*** Seq: 0x9AA54EFE Ack: 0x2EBFEBCD Win: 0x16A0 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3072:1] IMAP status overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
06/14-18:47:10.193747 130.54.208.193:58067 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:362
***AP*** Seq: 0x9AA5534C Ack: 0x2EBFED0F Win: 0x1920 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
Go to: previous range, next range, all alerts, overview page
SnortSnarf brought to you courtesy of Silicon Defense
Authors: Jim Hoagland and Stuart Staniford
See also the Snort Page by Marty Roesch
Page generated at Tue Sep 14 05:05:21 2010