rendered paste body> Generated by BASE v1.3.5 (marie) on Thu, 17 May 2007 14:58:12 -0500
>
> #3-1769223| [2007-05-16 08:48:59] 64.82.199.210 -> 207.44.160.87
> [snort/122:3] (portscan) TCP Portsweep
> #3-1769000| [2007-05-16 08:47:08] 64.82.199.210 -> 209.44.126.3
> [snort/122:3] (portscan) TCP Portsweep
> #3-1769224| [2007-05-16 08:49:00] 64.82.199.210:1176 ->
> 64.233.161.103:80
> [local/882] [snort/1:882] WEB-CGI calendar access
> #3-1769657| [2007-05-16 08:53:01] 64.82.199.210 ->
> 82.98.82.22 [snort/122:3]
> (portscan) TCP Portsweep
> #3-1769798| [2007-05-16 08:54:06] 64.82.199.210 -> 69.56.175.209
> [snort/122:3] (portscan) TCP Portsweep
> #3-1769849| [2007-05-16 08:54:36] 64.82.199.210:1184 ->
> 209.62.188.20:80
> [bugtraq/2527] [local/1054] [snort/1:1054] WEB-MISC
> weblogic/tomcat .jsp
> view source attempt
> #3-1769846| [2007-05-16 08:54:32] 64.82.199.210:1171 ->
> 8.255.64.252:80
> [snort/119:2] (http_inspect) DOUBLE DECODING ATTACK
> #3-1769744| [2007-05-16 08:53:38] 64.82.199.210:1251 ->
> 64.233.161.99:80
> [local/882] [snort/1:882] WEB-CGI calendar access
> #3-1769460| [2007-05-16 08:51:07] 64.82.199.210 -> 216.139.212.170
> [snort/122:3] (portscan) TCP Portsweep
> #3-1770048| [2007-05-16 08:56:13] 64.82.199.210 -> 209.73.189.102
> [snort/122:3] (portscan) TCP Portsweep
> #3-1770270| [2007-05-16 08:57:56] 64.82.199.210 -> 64.195.235.119
> [snort/122:3] (portscan) TCP Portsweep
> #3-1770501| [2007-05-16 08:59:55] 64.82.199.210 -> 64.92.172.212
> [snort/122:3] (portscan) TCP Portsweep
> #3-1770637| [2007-05-16 09:01:05] 64.82.199.210 -> 63.251.133.40
> [snort/122:3] (portscan) TCP Portsweep
> #3-1770775| [2007-05-16 09:02:23] 64.82.199.210 -> 216.127.68.136
> [snort/122:3] (portscan) TCP Portsweep
> #3-1771053| [2007-05-16 09:04:54] 64.82.199.210 -> 209.73.189.84
> [snort/122:3] (portscan) TCP Portsweep
> #3-1771539| [2007-05-16 09:09:18] 64.82.199.210 -> 207.150.190.60
> [snort/122:3] (portscan) TCP Portsweep
> #3-1771375| [2007-05-16 09:07:48] 64.82.199.210 -> 209.85.133.27
> [snort/122:3] (portscan) TCP Portsweep
> #3-1771186| [2007-05-16 09:06:08] 64.82.199.210 -> 211.13.227.138
> [snort/122:3] (portscan) TCP Portsweep
> #3-1772180| [2007-05-16 09:14:57] 64.82.199.210 -> 64.92.172.212
> [snort/122:3] (portscan) TCP Portsweep
> #3-1772002| [2007-05-16 09:13:18] 64.82.199.210 -> 66.117.154.119
> [snort/122:3] (portscan) TCP Portsweep
> #3-1771687| [2007-05-16 09:10:42] 64.82.199.210 -> 69.56.175.208
> [snort/122:3] (portscan) TCP Portsweep
> #3-1772776| [2007-05-16 09:37:10] 64.82.199.210 -> 67.137.187.115
> [snort/122:3] (portscan) TCP Portsweep
> #3-1772661| [2007-05-16 09:18:59] 64.82.199.210 -> 207.44.160.87
> [snort/122:3] (portscan) TCP Portsweep
> #3-1772522| [2007-05-16 09:17:42] 64.82.199.210 -> 66.230.217.89
> [snort/122:3] (portscan) TCP Portsweep
> #3-1772327| [2007-05-16 09:16:04] 64.82.199.210 -> 64.92.172.212
> [snort/122:3] (portscan) TCP Portsweep
> #3-1773627| [2007-05-16 09:44:45] 64.82.199.210:1649 ->
> 64.233.161.104:80
> [local/882] [snort/1:882] WEB-CGI calendar access
> #3-1773300| [2007-05-16 09:41:48] 64.82.199.210 -> 64.14.244.60
> [snort/122:3] (portscan) TCP Portsweep
> #3-1773447| [2007-05-16 09:43:04] 64.82.199.210 -> 69.56.175.208
> [snort/122:3] (portscan) TCP Portsweep
> #3-1773592| [2007-05-16 09:44:13] 64.82.199.210 -> 207.42.3.122
> [snort/122:3] (portscan) TCP Portsweep
> #3-1772561| [2007-05-16 09:18:08] 64.82.199.210:54680 ->
> 131.107.113.76:80
> [snort/119:4] (http_inspect) BARE BYTE UNICODE ENCODING
> #3-1773123| [2007-05-16 09:40:13] 64.82.199.210 ->
> 64.20.45.46 [snort/122:3]
> (portscan) TCP Portsweep
> #3-1774125| [2007-05-16 09:49:09] 64.82.199.210 -> 165.21.86.113
> [snort/122:3] (portscan) TCP Portsweep
> #3-1773929| [2007-05-16 09:47:25] 64.82.199.210 -> 216.127.68.136
> [snort/122:3] (portscan) TCP Portsweep
> #3-1773782| [2007-05-16 09:46:10] 64.82.199.210 -> 204.13.160.129
> [snort/122:3] (portscan) TCP Portsweep
> #3-1774610| [2007-05-16 09:53:59] 64.82.199.210:1758 ->
> 66.151.152.125:80
> [bugtraq/2527] [local/1054] [snort/1:1054] WEB-MISC
> weblogic/tomcat .jsp
> view source attempt
> #3-1774430| [2007-05-16 09:52:14] 64.82.199.210 -> 64.92.172.212
> [snort/122:3] (portscan) TCP Portsweep
> #3-1774331| [2007-05-16 09:51:11] 64.82.199.210 -> 211.13.227.138
> [snort/122:3] (portscan) TCP Portsweep
> #3-1774541| [2007-05-16 09:53:27] 64.82.199.210:1726 ->
> 64.233.161.99:80
> [local/882] [snort/1:882] WEB-CGI calendar access
> #3-1774553| [2007-05-16 09:53:30] 64.82.199.210 -> 64.92.172.212
> [snort/122:3] (portscan) TCP Portsweep
> #3-1774609| [2007-05-16 09:53:57] 64.82.199.210:1750 ->
> 198.57.16.38:80
> [snort/119:2] (http_inspect) DOUBLE DECODING ATTACK
> #3-1775613| [2007-05-16 10:03:43] 64.82.199.210 -> 144.230.162.12
> [snort/122:3] (portscan) TCP Portsweep
> #3-1775045| [2007-05-16 09:58:32] 64.82.199.210 -> 209.123.16.34
> [snort/122:3] (portscan) TCP Portsweep
> #3-1775180| [2007-05-16 09:59:37] 64.82.199.210 -> 69.56.175.208
> [snort/122:3] (portscan) TCP Portsweep
> #3-1774857| [2007-05-16 09:56:25] 64.82.199.210 -> 221.224.18.187
> [snort/122:3] (portscan) TCP Portsweep
> #3-1774730| [2007-05-16 09:55:15] 64.82.199.210 ->
> 64.20.45.46 [snort/122:3]
> (portscan) TCP Portsweep
> #3-1775475| [2007-05-16 10:02:23] 64.82.199.210 -> 131.107.115.28
> [snort/122:3] (portscan) TCP Portsweep
> #3-1775797| [2007-05-16 10:06:18] 64.82.199.210 -> 211.13.227.138
> [snort/122:3] (portscan) TCP Portsweep
> #3-1776228| [2007-05-16 10:10:17] 64.82.199.210 -> 209.44.126.9
> [snort/122:3] (portscan) TCP Portsweep
> #3-1776486| [2007-05-16 10:12:53] 64.82.199.210 -> 205.150.68.172
> [snort/122:3] (portscan) TCP Portsweep
> #3-1777229| [2007-05-16 10:19:35] 64.82.199.210:2162 ->
> 64.233.161.104:80
> [local/882] [snort/1:882] WEB-CGI calendar access
> #3-1777131| [2007-05-16 10:18:49] 64.82.199.210 -> 89.149.157.9
> [snort/122:3] (portscan) TCP Portsweep
> #3-1776926| [2007-05-16 10:16:45] 64.82.199.210 -> 69.56.175.208
> [snort/122:3] (portscan) TCP Portsweep
> #3-1776785| [2007-05-16 10:15:27] 64.82.199.210 -> 65.54.249.100
> [snort/122:3] (portscan) TCP Portsweep
> #3-1777457| [2007-05-16 10:21:57] 64.82.199.210 -> 207.111.170.67
> [snort/122:3] (portscan) TCP Portsweep
> #3-1777608| [2007-05-16 10:23:06] 64.82.199.210 ->
> 82.98.82.22 [snort/122:3]
> (portscan) TCP Portsweep
> #3-1777360| [2007-05-16 10:20:55] 64.82.199.210 -> 165.21.86.113
> [snort/122:3] (portscan) TCP Portsweep
> #3-1777578| [2007-05-16 10:22:54] 64.82.199.210:2255 ->
> 198.57.16.38:80
> [snort/119:2] (http_inspect) DOUBLE DECODING ATTACK
> #3-1777385| [2007-05-16 10:21:05] 64.82.199.210:2227 ->
> 198.57.16.38:80
> [snort/119:2] (http_inspect) DOUBLE DECODING ATTACK
> #3-1777389| [2007-05-16 10:21:07] 64.82.199.210:2235 ->
> 66.151.152.125:80
> [bugtraq/2527] [local/1054] [snort/1:1054] WEB-MISC
> weblogic/tomcat .jsp
>
> 216.178.38.81:80
> [snort/119:15] (http_inspect) OVERSIZE REQUEST-URI DIRECTORY
> #3-1907311| [2007-05-17 12:33:23] 64.82.199.210 -> 60.217.58.16
> [snort/122:3] (portscan) TCP Portsweep
> #3-1907197| [2007-05-17 12:32:18] 64.82.199.210 -> 12.30.72.164
> [snort/122:3] (portscan) TCP Portsweep
> #3-1906982| [2007-05-17 12:30:17] 64.82.199.210 -> 205.178.152.19
> [snort/122:3] (portscan) TCP Portsweep
> #3-1906736| [2007-05-17 12:28:09] 64.82.199.210 -> 222.239.76.51
> [snort/122:3] (portscan) TCP Portsweep
> #3-1906608| [2007-05-17 12:26:57] 64.82.199.210 -> 207.111.170.67
> [snort/122:3] (portscan) TCP Portsweep
> #3-1906488| [2007-05-17 12:25:51] 64.82.199.210 -> 69.56.175.209
> [snort/122:3] (portscan) TCP Portsweep
> #3-1906338| [2007-05-17 12:24:38] 64.82.199.210 -> 61.236.229.213
> [snort/122:3] (portscan) TCP Portsweep
> #3-1905854| [2007-05-17 12:20:46] 64.82.199.210 -> 209.44.126.3
> [snort/122:3] (portscan) TCP Portsweep
> #3-1905717| [2007-05-17 12:19:42] 64.82.199.210 -> 207.42.3.122
> [snort/122:3] (portscan) TCP Portsweep
> #3-1905366| [2007-05-17 12:16:54] 64.82.199.210 -> 204.13.160.129
> [snort/122:3] (portscan) TCP Portsweep
> #3-1905412| [2007-05-17 12:17:09] 64.82.199.210:4632 ->
> 216.178.38.163:80
> [snort/119:15] (http_inspect) OVERSIZE REQUEST-URI DIRECTORY
> #3-1905087| [2007-05-17 12:14:34] 64.82.199.210 -> 24.234.123.177
> [snort/122:3] (portscan) TCP Portsweep
> #3-1904833| [2007-05-17 12:12:34] 64.82.199.210 ->
> 64.20.45.46 [snort/122:3]
> (portscan) TCP Portsweep
> #3-1904575| [2007-05-17 12:10:34] 64.82.199.210 -> 69.56.175.208
> [snort/122:3] (portscan) TCP Portsweep
> #3-1904888| [2007-05-17 12:13:04] 64.82.199.210:4426 ->
> 72.246.31.75:80
> [bugtraq/2527] [local/1054] [snort/1:1054] WEB-MISC
> weblogic/tomcat .jsp
> view source attempt