[Silicon Defense logo]

SnortSnarf alert page

Source: 68.142.251.149

SnortSnarf v020516.1

Signature section (54)Top 20 source IPsTop 20 dest IPs

8 such alerts found using input module SnortFileInput, with sources:
Earliest: 06:43:07 on 7/23/2005
Latest: 20:08:33 on 7/23/2005

1 different signatures are present for 68.142.251.149 as a source

There are 1 distinct destination IPs in the alerts of the type on this page.

68.142.251.149 Whois lookup at: ARIN RIPE APNIC Geektools
DNS lookup at: Amenesi TRIUMF Princeton
More lookup links: Dshield Sam Spade


Jul 23 06:43:07 lucretia snort: [1:1852:3] WEB-MISC robots.txt access [Classification: access to a potentially vulnerable web application] [Priority: 2]: {TCP} 68.142.251.149:57204 -> 192.168.1.2:80
Jul 23 08:18:31 lucretia snort: [1:1852:3] WEB-MISC robots.txt access [Classification: access to a potentially vulnerable web application] [Priority: 2]: {TCP} 68.142.251.149:34919 -> 192.168.1.2:80
Jul 23 14:20:48 lucretia snort: [1:1852:3] WEB-MISC robots.txt access [Classification: access to a potentially vulnerable web application] [Priority: 2]: {TCP} 68.142.251.149:56605 -> 192.168.1.2:80
Jul 23 15:28:00 lucretia snort: [1:1852:3] WEB-MISC robots.txt access [Classification: access to a potentially vulnerable web application] [Priority: 2]: {TCP} 68.142.251.149:59744 -> 192.168.1.2:80
Jul 23 17:06:57 lucretia snort: [1:1852:3] WEB-MISC robots.txt access [Classification: access to a potentially vulnerable web application] [Priority: 2]: {TCP} 68.142.251.149:39464 -> 192.168.1.2:80
Jul 23 18:17:07 lucretia snort: [1:1852:3] WEB-MISC robots.txt access [Classification: access to a potentially vulnerable web application] [Priority: 2]: {TCP} 68.142.251.149:52024 -> 192.168.1.2:80
Jul 23 19:18:38 lucretia snort: [1:1852:3] WEB-MISC robots.txt access [Classification: access to a potentially vulnerable web application] [Priority: 2]: {TCP} 68.142.251.149:34680 -> 192.168.1.2:80
Jul 23 20:08:33 lucretia snort: [1:1852:3] WEB-MISC robots.txt access [Classification: access to a potentially vulnerable web application] [Priority: 2]: {TCP} 68.142.251.149:58765 -> 192.168.1.2:80

SnortSnarf brought to you courtesy of Silicon Defense
Authors: Jim Hoagland and Stuart Staniford
See also the Snort Page by Marty Roesch
Page generated at Sat Jul 23 22:10:12 2005