rendered paste bodySmoothWall IDS snort log
Date: 26 June
Date: 06/26 00:00:44
Name: (http_inspect) DOUBLE DECODING ATTACK
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:1353 -> 128.241.220.96:80
Refs:
Date: 06/26 00:15:40
Name: (http_inspect) DOUBLE DECODING ATTACK
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:1568 -> 128.241.220.96:80
Refs:
Date: 06/26 00:21:07
Name: (http_inspect) DOUBLE DECODING ATTACK
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:1659 -> 128.241.220.96:80
Refs:
Date: 06/26 00:22:59
Name: spp_portscan: PORTSCAN DETECTED from 82.96.96.3 (THRESHOLD 4 connections exceeded in 0 seconds)
Priority: n/a
Type: n/a
IP Info: n/a:n/a -> n/a:n/a
Refs:
Date: 06/26 00:23:08
Name: spp_portscan: portscan status from 82.96.96.3: 21 connections across 1 hosts: TCP(21), UDP(0)
Priority: n/a
Type: n/a
IP Info: n/a:n/a -> n/a:n/a
Refs:
Date: 06/26 00:23:20
Name: spp_portscan: portscan status from 82.96.96.3: 16 connections across 1 hosts: TCP(16), UDP(0)
Priority: n/a
Type: n/a
IP Info: n/a:n/a -> n/a:n/a
Refs:
Date: 06/26 00:24:04
Name: spp_portscan: portscan status from 82.96.96.3: 10 connections across 1 hosts: TCP(10), UDP(0)
Priority: n/a
Type: n/a
IP Info: n/a:n/a -> n/a:n/a
Refs:
Date: 06/26 00:24:14
Name: spp_portscan: End of portscan from 82.96.96.3: TOTAL time(21s) hosts(1) TCP(47) UDP(0)
Priority: n/a
Type: n/a
IP Info: n/a:n/a -> n/a:n/a
Refs:
Date: 06/26 00:24:20
Name: (http_inspect) NON-RFC HTTP DELIMITER
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:38362 -> 209.85.201.19:80
Refs:
Date: 06/26 00:24:53
Name: (http_inspect) NON-RFC HTTP DELIMITER
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:47046 -> 209.85.201.19:80
Refs:
Date: 06/26 00:29:01
Name: (http_inspect) DOUBLE DECODING ATTACK
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:1772 -> 128.241.220.96:80
Refs:
Date: 06/26 00:35:02
Name: (http_inspect) DOUBLE DECODING ATTACK
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:1886 -> 128.241.220.96:80
Refs:
Date: 06/26 00:36:32
Name: (http_inspect) DOUBLE DECODING ATTACK
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:1948 -> 128.241.220.89:80
Refs:
Date: 06/26 00:37:05
Name: (http_inspect) DOUBLE DECODING ATTACK
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:1974 -> 128.241.220.96:80
Refs:
Date: 06/26 00:37:26
Name: (http_inspect) DOUBLE DECODING ATTACK
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:2013 -> 128.241.220.96:80
Refs:
Date: 06/26 00:56:36
Name: ICMP PING CyberKit 2.2 Windows
Priority: 3
Type: Misc activity
IP Info: 24.19.246.38:n/a -> 24.16.243.186:n/a
Refs: http://www.whitehats.com/info/IDS154,
Date: 06/26 01:08:17
Name: (http_inspect) DOUBLE DECODING ATTACK
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:2448 -> 128.241.220.89:80
Refs:
Date: 06/26 01:35:01
Name: (http_inspect) DOUBLE DECODING ATTACK
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:1057 -> 128.241.220.89:80
Refs:
Date: 06/26 01:35:30
Name: DNS SPOOF query response with ttl: 1 min. and no authority
Priority: 2
Type: Potentially Bad Traffic
IP Info: 208.67.222.222:53 -> 24.16.243.186:1036
Refs:
Date: 06/26 01:36:43
Name: (http_inspect) DOUBLE DECODING ATTACK
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:1118 -> 128.241.220.96:80
Refs:
Date: 06/26 01:37:00
Name: DNS SPOOF query response with ttl: 1 min. and no authority
Priority: 2
Type: Potentially Bad Traffic
IP Info: 208.67.222.222:53 -> 24.16.243.186:1036
Refs:
Date: 06/26 01:40:15
Name: (http_inspect) DOUBLE DECODING ATTACK
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:1296 -> 128.241.220.89:80
Refs:
Date: 06/26 01:40:15
Name: (http_inspect) DOUBLE DECODING ATTACK
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:1295 -> 128.241.220.89:80
Refs:
Date: 06/26 01:42:11
Name: (http_inspect) DOUBLE DECODING ATTACK
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:1344 -> 128.241.220.96:80
Refs:
Date: 06/26 01:42:21
Name: DNS SPOOF query response with ttl: 1 min. and no authority
Priority: 2
Type: Potentially Bad Traffic
IP Info: 208.67.222.222:53 -> 24.16.243.186:1032
Refs:
Date: 06/26 01:51:59
Name: ICMP PING CyberKit 2.2 Windows
Priority: 3
Type: Misc activity
IP Info: 24.14.85.237:n/a -> 24.16.243.186:n/a
Refs: http://www.whitehats.com/info/IDS154,
Date: 06/26 04:05:12
Name: MS-SQL Worm propagation attempt
Priority: 2
Type: Misc Attack
IP Info: 125.175.147.102:1230 -> 24.16.243.186:1434
Refs: http://vil.nai.com/vil/content/v_99992.htm,http://www.securityfocus.com/bid/5311,http://www.securityfocus.com/bid/5310,
Date: 06/26 05:01:10
Name: (http_inspect) OVERSIZE REQUEST-URI DIRECTORY
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:45792 -> 209.85.139.176:80
Refs:
Date: 06/26 05:01:10
Name: (http_inspect) OVERSIZE REQUEST-URI DIRECTORY
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:45793 -> 209.85.139.176:80
Refs:
Date: 06/26 05:09:55
Name: (http_inspect) OVERSIZE REQUEST-URI DIRECTORY
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:42092 -> 209.85.139.176:80
Refs:
Date: 06/26 05:09:55
Name: (http_inspect) OVERSIZE REQUEST-URI DIRECTORY
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:42091 -> 209.85.139.176:80
Refs:
Date: 06/26 05:10:55
Name: (http_inspect) OVERSIZE REQUEST-URI DIRECTORY
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:48997 -> 209.85.139.176:80
Refs:
Date: 06/26 05:10:55
Name: (http_inspect) OVERSIZE REQUEST-URI DIRECTORY
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:48998 -> 209.85.139.176:80
Refs:
Date: 06/26 05:46:48
Name: (http_inspect) OVERSIZE REQUEST-URI DIRECTORY
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:55812 -> 209.249.142.8:80
Refs:
Date: 06/26 05:46:48
Name: (http_inspect) OVERSIZE REQUEST-URI DIRECTORY
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:34593 -> 209.249.142.97:80
Refs:
Date: 06/26 06:16:09
Name: DNS SPOOF query response with ttl: 1 min. and no authority
Priority: 2
Type: Potentially Bad Traffic
IP Info: 208.67.222.222:53 -> 24.16.243.186:33909
Refs:
Date: 06/26 06:17:14
Name: DNS SPOOF query response with ttl: 1 min. and no authority
Priority: 2
Type: Potentially Bad Traffic
IP Info: 208.67.222.222:53 -> 24.16.243.186:33909
Refs:
Date: 06/26 06:18:29
Name: DNS SPOOF query response with ttl: 1 min. and no authority
Priority: 2
Type: Potentially Bad Traffic
IP Info: 208.67.222.222:53 -> 24.16.243.186:33909
Refs:
Date: 06/26 06:19:45
Name: DNS SPOOF query response with ttl: 1 min. and no authority
Priority: 2
Type: Potentially Bad Traffic
IP Info: 208.67.222.222:53 -> 24.16.243.186:33909
Refs:
Date: 06/26 06:21:00
Name: DNS SPOOF query response with ttl: 1 min. and no authority
Priority: 2
Type: Potentially Bad Traffic
IP Info: 208.67.222.222:53 -> 24.16.243.186:33909
Refs:
Date: 06/26 06:22:16
Name: DNS SPOOF query response with ttl: 1 min. and no authority
Priority: 2
Type: Potentially Bad Traffic
IP Info: 208.67.222.222:53 -> 24.16.243.186:33909
Refs:
Date: 06/26 06:51:51
Name: DNS SPOOF query response with ttl: 1 min. and no authority
Priority: 2
Type: Potentially Bad Traffic
IP Info: 208.67.222.222:53 -> 24.16.243.186:33910
Refs:
Date: 06/26 06:53:06
Name: DNS SPOOF query response with ttl: 1 min. and no authority
Priority: 2
Type: Potentially Bad Traffic
IP Info: 208.67.222.222:53 -> 24.16.243.186:33910
Refs:
Date: 06/26 06:54:22
Name: DNS SPOOF query response with ttl: 1 min. and no authority
Priority: 2
Type: Potentially Bad Traffic
IP Info: 208.67.222.222:53 -> 24.16.243.186:33910
Refs:
Date: 06/26 06:55:37
Name: DNS SPOOF query response with ttl: 1 min. and no authority
Priority: 2
Type: Potentially Bad Traffic
IP Info: 208.67.222.222:53 -> 24.16.243.186:33910
Refs:
Date: 06/26 06:56:40
Name: DNS SPOOF query response with ttl: 1 min. and no authority
Priority: 2
Type: Potentially Bad Traffic
IP Info: 208.67.222.222:53 -> 24.16.243.186:33910
Refs:
Date: 06/26 07:09:12
Name: MS-SQL Worm propagation attempt
Priority: 2
Type: Misc Attack
IP Info: 210.73.195.33:3196 -> 24.16.243.186:1434
Refs: http://vil.nai.com/vil/content/v_99992.htm,http://www.securityfocus.com/bid/5311,http://www.securityfocus.com/bid/5310,
Date: 06/26 07:26:37
Name: DNS SPOOF query response with ttl: 1 min. and no authority
Priority: 2
Type: Potentially Bad Traffic
IP Info: 208.67.222.222:53 -> 24.16.243.186:33911
Refs:
Date: 06/26 07:27:43
Name: DNS SPOOF query response with ttl: 1 min. and no authority
Priority: 2
Type: Potentially Bad Traffic
IP Info: 208.67.222.222:53 -> 24.16.243.186:33911
Refs:
Date: 06/26 07:28:58
Name: DNS SPOOF query response with ttl: 1 min. and no authority
Priority: 2
Type: Potentially Bad Traffic
IP Info: 208.67.222.222:53 -> 24.16.243.186:33911
Refs:
Date: 06/26 07:30:14
Name: DNS SPOOF query response with ttl: 1 min. and no authority
Priority: 2
Type: Potentially Bad Traffic
IP Info: 208.67.222.222:53 -> 24.16.243.186:33911
Refs:
Date: 06/26 07:31:29
Name: DNS SPOOF query response with ttl: 1 min. and no authority
Priority: 2
Type: Potentially Bad Traffic
IP Info: 208.67.222.222:53 -> 24.16.243.186:33911
Refs:
Date: 06/26 07:32:30
Name: DNS SPOOF query response with ttl: 1 min. and no authority
Priority: 2
Type: Potentially Bad Traffic
IP Info: 208.67.222.222:53 -> 24.16.243.186:33911
Refs:
Date: 06/26 07:35:05
Name: (http_inspect) OVERSIZE REQUEST-URI DIRECTORY
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:33465 -> 91.189.88.31:80
Refs:
Date: 06/26 07:35:05
Name: (http_inspect) OVERSIZE REQUEST-URI DIRECTORY
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:33466 -> 91.189.88.31:80
Refs:
Date: 06/26 07:37:59
Name: (http_inspect) OVERSIZE CHUNK ENCODING
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:50857 -> 69.89.27.227:80
Refs:
Date: 06/26 07:46:34
Name: ICMP PING CyberKit 2.2 Windows
Priority: 3
Type: Misc activity
IP Info: 24.19.246.38:n/a -> 24.16.243.186:n/a
Refs: http://www.whitehats.com/info/IDS154,
Date: 06/26 07:59:19
Name: (http_inspect) NON-RFC HTTP DELIMITER
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:56376 -> 64.152.208.60:80
Refs:
Date: 06/26 08:15:12
Name: (http_inspect) NON-RFC HTTP DELIMITER
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:53409 -> 64.152.208.60:80
Refs:
Date: 06/26 08:17:57
Name: (http_inspect) NON-RFC HTTP DELIMITER
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:48778 -> 64.152.208.60:80
Refs:
Date: 06/26 08:22:40
Name: (http_inspect) DOUBLE DECODING ATTACK
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:52995 -> 128.241.220.82:80
Refs:
Date: 06/26 08:33:46
Name: (http_inspect) DOUBLE DECODING ATTACK
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:39551 -> 208.67.216.230:80
Refs:
Date: 06/26 08:59:42
Name: (http_inspect) NON-RFC HTTP DELIMITER
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:46440 -> 209.85.147.83:80
Refs:
Date: 06/26 09:45:47
Name: (http_inspect) U ENCODING
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:51984 -> 128.177.0.40:80
Refs:
Date: 06/26 09:46:07
Name: (http_inspect) DOUBLE DECODING ATTACK
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:1055 -> 128.241.220.89:80
Refs:
Date: 06/26 09:48:10
Name: (http_inspect) DOUBLE DECODING ATTACK
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:1128 -> 128.241.220.89:80
Refs:
Date: 06/26 09:50:45
Name: (http_inspect) U ENCODING
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:43596 -> 128.177.0.40:80
Refs:
Date: 06/26 09:59:49
Name: (http_inspect) OVERSIZE REQUEST-URI DIRECTORY
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:47985 -> 128.177.0.40:80
Refs:
Date: 06/26 09:59:49
Name: (http_inspect) U ENCODING
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:47985 -> 128.177.0.40:80
Refs:
Date: 06/26 10:00:46
Name: DNS SPOOF query response with ttl: 1 min. and no authority
Priority: 2
Type: Potentially Bad Traffic
IP Info: 208.67.222.222:53 -> 24.16.243.186:32936
Refs:
Date: 06/26 10:01:29
Name: spp_portscan: PORTSCAN DETECTED to port 47079 from 201.196.4.222 (STEALTH)
Priority: n/a
Type: n/a
IP Info: n/a:n/a -> n/a:n/a
Refs:
Date: 06/26 10:01:30
Name: ICMP Destination Unreachable (Communication Administratively Prohibited)
Priority: 3
Type: Misc activity
IP Info: 192.168.0.142:51205 -> 217.80.23.249:1249
Refs:
Date: 06/26 10:01:35
Name: spp_portscan: portscan status from 201.196.4.222: 1 connections across 1 hosts: TCP(1), UDP(0) STEALTH
Priority: n/a
Type: n/a
IP Info: n/a:n/a -> n/a:n/a
Refs:
Date: 06/26 10:01:41
Name: spp_portscan: End of portscan from 201.196.4.222: TOTAL time(0s) hosts(1) TCP(1) UDP(0) STEALTH
Priority: n/a
Type: n/a
IP Info: n/a:n/a -> n/a:n/a
Refs:
Date: 06/26 10:02:50
Name: DNS SPOOF query response with ttl: 1 min. and no authority
Priority: 2
Type: Potentially Bad Traffic
IP Info: 208.67.222.222:53 -> 24.16.243.186:32936
Refs:
Date: 06/26 10:04:17
Name: DNS SPOOF query response with ttl: 1 min. and no authority
Priority: 2
Type: Potentially Bad Traffic
IP Info: 208.67.220.220:53 -> 24.16.243.186:32937
Refs:
Date: 06/26 10:04:19
Name: DNS SPOOF query response with ttl: 1 min. and no authority
Priority: 2
Type: Potentially Bad Traffic
IP Info: 208.67.222.222:53 -> 24.16.243.186:32937
Refs:
Date: 06/26 10:04:56
Name: ICMP PING CyberKit 2.2 Windows
Priority: 3
Type: Misc activity
IP Info: 24.19.246.38:n/a -> 24.16.243.186:n/a
Refs: http://www.whitehats.com/info/IDS154,
Date: 06/26 10:05:27
Name: DNS SPOOF query response with ttl: 1 min. and no authority
Priority: 2
Type: Potentially Bad Traffic
IP Info: 208.67.220.220:53 -> 24.16.243.186:32940
Refs:
Date: 06/26 10:06:00
Name: DNS SPOOF query response with ttl: 1 min. and no authority
Priority: 2
Type: Potentially Bad Traffic
IP Info: 208.67.222.222:53 -> 24.16.243.186:32940
Refs:
Date: 06/26 10:15:44
Name: (http_inspect) NON-RFC HTTP DELIMITER
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:34321 -> 209.85.147.83:80
Refs:
Date: 06/26 10:17:14
Name: (http_inspect) OVERSIZE REQUEST-URI DIRECTORY
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:39167 -> 209.85.199.18:80
Refs:
Date: 06/26 10:20:32
Name: (http_inspect) OVERSIZE REQUEST-URI DIRECTORY
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:55391 -> 209.85.147.83:80
Refs:
Date: 06/26 10:20:40
Name: DNS SPOOF query response with ttl: 1 min. and no authority
Priority: 2
Type: Potentially Bad Traffic
IP Info: 208.67.222.222:53 -> 24.16.243.186:32941
Refs:
Date: 06/26 10:23:26
Name: (http_inspect) OVERSIZE REQUEST-URI DIRECTORY
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:47259 -> 209.85.139.176:80
Refs:
Date: 06/26 10:23:26
Name: (http_inspect) OVERSIZE REQUEST-URI DIRECTORY
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:47260 -> 209.85.139.176:80
Refs:
Date: 06/26 10:23:26
Name: (http_inspect) NON-RFC HTTP DELIMITER
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:42689 -> 209.85.199.19:80
Refs:
Date: 06/26 10:25:27
Name: (http_inspect) NON-RFC HTTP DELIMITER
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:33734 -> 209.85.147.18:80
Refs:
Date: 06/26 10:28:00
Name: (http_inspect) U ENCODING
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:48642 -> 128.177.0.40:80
Refs:
Date: 06/26 10:31:31
Name: DNS SPOOF query response with ttl: 1 min. and no authority
Priority: 2
Type: Potentially Bad Traffic
IP Info: 208.67.222.222:53 -> 24.16.243.186:32954
Refs:
Date: 06/26 10:33:58
Name: (http_inspect) OVERSIZE REQUEST-URI DIRECTORY
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:46420 -> 72.14.255.176:80
Refs:
Date: 06/26 10:34:20
Name: DNS SPOOF query response with ttl: 1 min. and no authority
Priority: 2
Type: Potentially Bad Traffic
IP Info: 208.67.222.222:53 -> 24.16.243.186:32955
Refs:
Date: 06/26 10:35:22
Name: DNS SPOOF query response with ttl: 1 min. and no authority
Priority: 2
Type: Potentially Bad Traffic
IP Info: 208.67.222.222:53 -> 24.16.243.186:32955
Refs:
Date: 06/26 10:36:07
Name: DNS SPOOF query response with ttl: 1 min. and no authority
Priority: 2
Type: Potentially Bad Traffic
IP Info: 208.67.222.222:53 -> 24.16.243.186:32956
Refs:
Date: 06/26 10:36:10
Name: DNS SPOOF query response with ttl: 1 min. and no authority
Priority: 2
Type: Potentially Bad Traffic
IP Info: 208.67.222.222:53 -> 24.16.243.186:32956
Refs:
Date: 06/26 10:46:46
Name: spp_portscan: PORTSCAN DETECTED from 82.96.96.3 (THRESHOLD 4 connections exceeded in 0 seconds)
Priority: n/a
Type: n/a
IP Info: n/a:n/a -> n/a:n/a
Refs:
Date: 06/26 10:46:53
Name: spp_portscan: portscan status from 82.96.96.3: 21 connections across 1 hosts: TCP(21), UDP(0)
Priority: n/a
Type: n/a
IP Info: n/a:n/a -> n/a:n/a
Refs:
Date: 06/26 10:47:01
Name: spp_portscan: portscan status from 82.96.96.3: 14 connections across 1 hosts: TCP(14), UDP(0)
Priority: n/a
Type: n/a
IP Info: n/a:n/a -> n/a:n/a
Refs:
Date: 06/26 10:47:07
Name: spp_portscan: portscan status from 82.96.96.3: 1 connections across 1 hosts: TCP(1), UDP(0)
Priority: n/a
Type: n/a
IP Info: n/a:n/a -> n/a:n/a
Refs:
Date: 06/26 10:47:44
Name: spp_portscan: portscan status from 82.96.96.3: 8 connections across 1 hosts: TCP(8), UDP(0)
Priority: n/a
Type: n/a
IP Info: n/a:n/a -> n/a:n/a
Refs:
Date: 06/26 10:48:09
Name: spp_portscan: End of portscan from 82.96.96.3: TOTAL time(21s) hosts(1) TCP(44) UDP(0)
Priority: n/a
Type: n/a
IP Info: n/a:n/a -> n/a:n/a
Refs:
Date: 06/26 10:54:49
Name: ICMP PING CyberKit 2.2 Windows
Priority: 3
Type: Misc activity
IP Info: 24.14.85.237:n/a -> 24.16.243.186:n/a
Refs: http://www.whitehats.com/info/IDS154,
Date: 06/26 13:00:44
Name: ICMP PING CyberKit 2.2 Windows
Priority: 3
Type: Misc activity
IP Info: 24.19.246.38:n/a -> 24.16.243.186:n/a
Refs: http://www.whitehats.com/info/IDS154,
Date: 06/26 13:07:29
Name: ICMP PING CyberKit 2.2 Windows
Priority: 3
Type: Misc activity
IP Info: 24.14.85.237:n/a -> 24.16.243.186:n/a
Refs: http://www.whitehats.com/info/IDS154,
Date: 06/26 15:17:00
Name: ICMP PING CyberKit 2.2 Windows
Priority: 3
Type: Misc activity
IP Info: 24.19.246.38:n/a -> 24.16.243.186:n/a
Refs: http://www.whitehats.com/info/IDS154,
Date: 06/26 15:26:49
Name: ICMP PING CyberKit 2.2 Windows
Priority: 3
Type: Misc activity
IP Info: 24.14.85.237:n/a -> 24.16.243.186:n/a
Refs: http://www.whitehats.com/info/IDS154,
Date: 06/26 16:39:45
Name: (http_inspect) DOUBLE DECODING ATTACK
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:1066 -> 128.241.220.96:80
Refs:
Date: 06/26 16:47:10
Name: (http_inspect) DOUBLE DECODING ATTACK
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:1329 -> 128.241.220.89:80
Refs:
Date: 06/26 16:54:32
Name: (http_inspect) DOUBLE DECODING ATTACK
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:1577 -> 128.241.220.89:80
Refs:
Date: 06/26 17:13:56
Name: (http_inspect) DOUBLE DECODING ATTACK
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:1599 -> 128.241.220.89:80
Refs:
Date: 06/26 17:32:33
Name: ICMP PING CyberKit 2.2 Windows
Priority: 3
Type: Misc activity
IP Info: 24.19.246.38:n/a -> 24.16.243.186:n/a
Refs: http://www.whitehats.com/info/IDS154,
Date: 06/26 17:40:59
Name: (http_inspect) DOUBLE DECODING ATTACK
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:1046 -> 128.241.220.89:80
Refs:
Date: 06/26 17:45:20
Name: (http_inspect) DOUBLE DECODING ATTACK
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:1103 -> 207.68.178.239:80
Refs:
Date: 06/26 17:45:20
Name: (http_inspect) DOUBLE DECODING ATTACK
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:1102 -> 207.68.178.239:80
Refs:
Date: 06/26 17:45:55
Name: ICMP PING CyberKit 2.2 Windows
Priority: 3
Type: Misc activity
IP Info: 24.14.85.237:n/a -> 24.16.243.186:n/a
Refs: http://www.whitehats.com/info/IDS154,
Date: 06/26 17:47:51
Name: (http_inspect) DOUBLE DECODING ATTACK
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:1135 -> 65.55.132.124:80
Refs:
Date: 06/26 17:47:51
Name: (http_inspect) DOUBLE DECODING ATTACK
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:1136 -> 207.68.178.239:80
Refs:
Date: 06/26 17:47:52
Name: (http_inspect) DOUBLE DECODING ATTACK
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:1140 -> 207.68.162.254:80
Refs:
Date: 06/26 17:47:57
Name: (http_inspect) DOUBLE DECODING ATTACK
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:1147 -> 65.55.132.124:80
Refs:
Date: 06/26 17:47:57
Name: (http_inspect) DOUBLE DECODING ATTACK
Priority: n/a
Type: n/a
IP Info: 24.16.243.186:1148 -> 207.68.162.254:80
Refs:
Date: 06/26 18:24:30
Name: DNS SPOOF query response with ttl: 1 min. and no authority
Priority: 2
Type: Potentially Bad Traffic
IP Info: 208.67.222.222:53 -> 24.16.243.186:32773
Refs:
Date: 06/26 18:24:30
Name: DNS SPOOF query response with ttl: 1 min. and no authority
Priority: 2
Type: Potentially Bad Traffic
IP Info: 208.67.222.222:53 -> 24.16.243.186:32774
Refs:
Date: 06/26 18:24:31
Name: DNS SPOOF query response with ttl: 1 min. and no authority
Priority: 2
Type: Potentially Bad Traffic
IP Info: 208.67.222.222:53 -> 24.16.243.186:32775
Refs:
Date: 06/26 18:24:31
Name: DNS SPOOF query response with ttl: 1 min. and no authority
Priority: 2
Type: Potentially Bad Traffic
IP Info: 208.67.222.222:53 -> 24.16.243.186:32781
Refs:
Date: 06/26 18:24:31
Name: DNS SPOOF query response with ttl: 1 min. and no authority
Priority: 2
Type: Potentially Bad Traffic
IP Info: 208.67.222.222:53 -> 24.16.243.186:32781
Refs:
Date: 06/26 18:24:31
Name: DNS SPOOF query response with ttl: 1 min. and no authority
Priority: 2
Type: Potentially Bad Traffic
IP Info: 208.67.222.222:53 -> 24.16.243.186:32782
Refs:
Date: 06/26 18:24:31
Name: DNS SPOOF query response with ttl: 1 min. and no authority
Priority: 2
Type: Potentially Bad Traffic
IP Info: 208.67.222.222:53 -> 24.16.243.186:32783
Refs:
Date: 06/26 18:54:33
Name: DNS SPOOF query response with ttl: 1 min. and no authority
Priority: 2
Type: Potentially Bad Traffic
IP Info: 208.67.222.222:53 -> 24.16.243.186:32784
Refs:
Date: 06/26 18:54:33
Name: DNS SPOOF query response with ttl: 1 min. and no authority
Priority: 2
Type: Potentially Bad Traffic
IP Info: 208.67.222.222:53 -> 24.16.243.186:32783
Refs:
Date: 06/26 18:54:33
Name: DNS SPOOF query response with ttl: 1 min. and no authority
Priority: 2
Type: Potentially Bad Traffic
IP Info: 208.67.222.222:53 -> 24.16.243.186:32785
Refs:
Date: 06/26 18:54:41
Name: DNS SPOOF query response with ttl: 1 min. and no authority
Priority: 2
Type: Potentially Bad Traffic
IP Info: 208.67.220.220:53 -> 24.16.243.186:32789
Refs:
Date: 06/26 19:07:26
Name: DNS SPOOF query response with ttl: 1 min. and no authority
Priority: 2
Type: Potentially Bad Traffic
IP Info: 208.67.220.220:53 -> 24.16.243.186:32791
Refs:
Date: 06/26 19:07:32
Name: DNS SPOOF query response with ttl: 1 min. and no authority
Priority: 2
Type: Potentially Bad Traffic
IP Info: 208.67.222.222:53 -> 24.16.243.186:32791
Refs: