[Silicon Defense logo]

SnortSnarf alert page

Source: 203.180.88.108

SnortSnarf v021111.1

Signature section (16810)Top 20 source IPsTop 20 dest IPs

15 such alerts found using input module SnortFileInput, with sources:
Earliest: 19:32:44.344773 on 04/23/2010
Latest: 22:47:06.253414 on 04/23/2010

3 different signatures are present for 203.180.88.108 as a source

There are 1 distinct destination IPs in the alerts of the type on this page.

203.180.88.108 Whois lookup at: ARIN RIPE APNIC Geektools
DNS lookup at: Amenesi TRIUMF Princeton
More lookup links: Dshield Sam Spade

[**] [1:1844:9] IMAP authenticate overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
04/23-19:32:44.344773 203.180.88.108:32771 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:241
***AP*** Seq: 0x683EFBAF Ack: 0xA302A34C Win: 0x16A0 TcpLen: 20
[Xref => http://cgi.nessus.org/plugins/dump.php3?id=10292][Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=1999-0042]
[**] [1:3072:1] IMAP status overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
04/23-19:32:44.344773 203.180.88.108:32771 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:241
***AP*** Seq: 0x683EFBAF Ack: 0xA302A34C Win: 0x16A0 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3072:1] IMAP status overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
04/23-19:32:45.496174 203.180.88.108:32771 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:182
***AP*** Seq: 0x683EFC7E Ack: 0xA302A3DA Win: 0x16A0 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3072:1] IMAP status overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
04/23-19:32:47.535495 203.180.88.108:32771 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:263
***AP*** Seq: 0x683EFDC2 Ack: 0xA302A4B9 Win: 0x16A0 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3072:1] IMAP status overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
04/23-19:32:50.586579 203.180.88.108:32771 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:317
***AP*** Seq: 0x683EFF5D Ack: 0xA302A5CE Win: 0x16A0 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3072:1] IMAP status overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
04/23-19:32:53.499161 203.180.88.108:32771 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:394
***AP*** Seq: 0x683F015F Ack: 0xA302A730 Win: 0x16A0 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3072:1] IMAP status overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
04/23-19:32:55.108946 203.180.88.108:32771 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:249
***AP*** Seq: 0x683F029E Ack: 0xA302A801 Win: 0x16A0 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3072:1] IMAP status overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
04/23-19:34:06.820864 203.180.88.108:32771 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:183
***AP*** Seq: 0x683F04EC Ack: 0xA302A890 Win: 0x16A0 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3072:1] IMAP status overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
04/23-19:34:09.193160 203.180.88.108:32771 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:333
***AP*** Seq: 0x683F0F64 Ack: 0xA302A9B5 Win: 0x1920 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3072:1] IMAP status overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
04/23-19:34:21.046735 203.180.88.108:32771 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:188
***AP*** Seq: 0x683F6548 Ack: 0xA302AA49 Win: 0x1920 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3072:1] IMAP status overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
04/23-19:34:32.081008 203.180.88.108:32771 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:285
***AP*** Seq: 0x6840023C Ack: 0xA302AB3E Win: 0x1920 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
04/23-19:34:32.081008 203.180.88.108:32771 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:285
***AP*** Seq: 0x6840023C Ack: 0xA302AB3E Win: 0x1920 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
04/23-19:35:44.221129 203.180.88.108:32771 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:353
***AP*** Seq: 0x684004AC Ack: 0xA302AC77 Win: 0x1D50 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
04/23-19:35:54.399379 203.180.88.108:32771 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:219
***AP*** Seq: 0x6840272D Ack: 0xA302ADB9 Win: 0x1D50 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
[**] [1:3070:1] IMAP fetch overflow attempt [**]
[Classification: Misc Attack] [Priority: 2]
04/23-22:47:06.253414 203.180.88.108:32926 -> 192.168.24.11:143
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:356
***AP*** Seq: 0x5E97737C Ack: 0x3D3ED39B Win: 0x2E10 TcpLen: 20
[Xref => http://www.securityfocus.com/bid/11775]
SnortSnarf brought to you courtesy of Silicon Defense
Authors: Jim Hoagland and Stuart Staniford
See also the Snort Page by Marty Roesch
Page generated at Tue Sep 14 05:05:27 2010