SnortSnarf alert page

Source: 130.54.208.193: overview

SnortSnarf v021111.1

Signature section (16810)

Top 20 source IPs

Top 20 dest IPs

698 such alerts found using input module SnortFileInput, with sources:

/var/log/snort/alert

Earliest: 17:30:25.524878 on 09/18/2009
Latest: 11:56:39.597147 on 08/10/2010

9 different signatures are present for 130.54.208.193 as a source

3 instances of IMAP authenticate overflow attempt
4 instances of WEB-MISC cross site scripting attempt
4 instances of (http_inspect) OVERSIZE CHUNK ENCODING
5 instances of (http_inspect) BARE BYTE UNICODE ENCODING
9 instances of WEB-MISC http directory traversal
9 instances of WEB-MISC Invalid HTTP Version String
13 instances of WEB-PHP test.php access
223 instances of IMAP status overflow attempt
428 instances of IMAP fetch overflow attempt

There are 1 distinct destination IPs in the alerts of the type on this page.

130.54.208.193 Whois lookup at: ARIN RIPE APNIC Geektools

DNS lookup at: Amenesi TRIUMF Princeton

More lookup links: Dshield Sam Spade

This listing contains 698 alerts. You can:

view the whole listing
view a range of alerts (see table below)

Alert ranges (sorted by time):

alert #'s	first time	last time
1 to 100	17:30:25.524878 on 09/18/2009	10:19:26.783581 on 04/20/2010
101 to 200	10:25:08.150558 on 04/20/2010	09:16:31.573988 on 05/01/2010
201 to 300	09:16:31.915905 on 05/01/2010	11:40:59.607964 on 05/07/2010
301 to 400	11:41:01.461420 on 05/07/2010	09:56:59.038483 on 05/22/2010
401 to 500	10:22:03.201594 on 05/22/2010	08:46:02.037392 on 05/30/2010
501 to 600	11:30:59.880659 on 05/30/2010	18:47:10.193747 on 06/14/2010
601 to 698	18:56:39.679922 on 06/14/2010	11:56:39.597147 on 08/10/2010

SnortSnarf brought to you courtesy of Silicon Defense
Authors: Jim Hoagland and Stuart Staniford
See also the Snort Page by Marty Roesch
Page generated at Wed Sep 8 05:13:20 2010