[Silicon Defense logo]

SnortSnarf alert page

Source: 157.82.254.63

SnortSnarf v021111.1

Signature section (16810)Top 20 source IPsTop 20 dest IPs

6 such alerts found using input module SnortFileInput, with sources:
Earliest: 01:48:31.827632 on 12/21/2009
Latest: 04:00:09.325337 on 01/28/2010

1 different signatures are present for 157.82.254.63 as a source

There are 1 distinct destination IPs in the alerts of the type on this page.

157.82.254.63 Whois lookup at: ARIN RIPE APNIC Geektools
DNS lookup at: Amenesi TRIUMF Princeton
More lookup links: Dshield Sam Spade

[**] [1:1852:3] WEB-MISC robots.txt access [**]
[Classification: access to a potentially vulnerable web application] [Priority: 2]
12/21-01:48:31.827632 157.82.254.63:49438 -> 192.168.24.11:80
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:254
***AP*** Seq: 0x64F32650 Ack: 0x5653B33D Win: 0x16D0 TcpLen: 20
[Xref => http://cgi.nessus.org/plugins/dump.php3?id=10302]
[**] [1:1852:3] WEB-MISC robots.txt access [**]
[Classification: access to a potentially vulnerable web application] [Priority: 2]
01/04-21:03:12.966398 157.82.254.63:46194 -> 192.168.24.11:80
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:254
***AP*** Seq: 0x6EF7DF59 Ack: 0xC1619FCE Win: 0x16D0 TcpLen: 20
[Xref => http://cgi.nessus.org/plugins/dump.php3?id=10302]
[**] [1:1852:3] WEB-MISC robots.txt access [**]
[Classification: access to a potentially vulnerable web application] [Priority: 2]
01/06-18:51:00.138786 157.82.254.63:57276 -> 192.168.24.11:80
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:254
***AP*** Seq: 0xF1B3EBA7 Ack: 0x4848ECB5 Win: 0x16D0 TcpLen: 20
[Xref => http://cgi.nessus.org/plugins/dump.php3?id=10302]
[**] [1:1852:3] WEB-MISC robots.txt access [**]
[Classification: access to a potentially vulnerable web application] [Priority: 2]
01/19-22:36:56.754261 157.82.254.63:40617 -> 192.168.24.11:80
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:254
***AP*** Seq: 0x1CEC07AB Ack: 0xC1BFB1EA Win: 0x16D0 TcpLen: 20
[Xref => http://cgi.nessus.org/plugins/dump.php3?id=10302]
[**] [1:1852:3] WEB-MISC robots.txt access [**]
[Classification: access to a potentially vulnerable web application] [Priority: 2]
01/22-10:43:29.980110 157.82.254.63:34391 -> 192.168.24.11:80
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:254
***AP*** Seq: 0x46EA5829 Ack: 0xF5B2E663 Win: 0x16D0 TcpLen: 20
[Xref => http://cgi.nessus.org/plugins/dump.php3?id=10302]
[**] [1:1852:3] WEB-MISC robots.txt access [**]
[Classification: access to a potentially vulnerable web application] [Priority: 2]
01/28-04:00:09.325337 157.82.254.63:37340 -> 192.168.24.11:80
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:254
***AP*** Seq: 0x7AA448FB Ack: 0x74FE0E6B Win: 0x16D0 TcpLen: 20
[Xref => http://cgi.nessus.org/plugins/dump.php3?id=10302]
SnortSnarf brought to you courtesy of Silicon Defense
Authors: Jim Hoagland and Stuart Staniford
See also the Snort Page by Marty Roesch
Page generated at Tue Sep 14 05:05:29 2010