[Silicon Defense logo]

SnortSnarf alert page

Source: 66.84.25.254

SnortSnarf v021111.1

Signature section (91123)Top 20 source IPsTop 20 dest IPs

14 such alerts found using input module SnortFileInput, with sources:
Earliest: 20:45:21.886143 on 04/26/2003
Latest: 16:27:25.543066 on 06/16/2003

3 different signatures are present for 66.84.25.254 as a source

There are 1 distinct destination IPs in the alerts of the type on this page.

66.84.25.254 Whois lookup at: ARIN RIPE APNIC Geektools
DNS lookup at: Amenesi TRIUMF Princeton
More lookup links: Dshield Sam Spade

[**] [1:729:3] Virus - Possible scr Worm [**]
[Classification: Misc activity] [Priority: 3]
04/26-20:45:21.886143 66.84.25.254:110 -> 192.168.1.100:3248
TCP TTL:45 TOS:0x0 ID:43797 IpLen:20 DgmLen:1420 DF
***AP*** Seq: 0xB156752B Ack: 0xF4003291 Win: 0x7BFC TcpLen: 20
[**] [1:729:3] Virus - Possible scr Worm [**]
[Classification: Misc activity] [Priority: 3]
05/03-04:05:28.819870 66.84.25.254:110 -> 192.168.1.100:4377
TCP TTL:45 TOS:0x0 ID:42360 IpLen:20 DgmLen:1026 DF
***AP*** Seq: 0x442E474E Ack: 0x4467455F Win: 0x7BFC TcpLen: 20
[**] [1:729:3] Virus - Possible scr Worm [**]
[Classification: Misc activity] [Priority: 3]
05/12-19:39:29.711668 66.84.25.254:110 -> 192.168.1.100:3111
TCP TTL:45 TOS:0x0 ID:6543 IpLen:20 DgmLen:1022 DF
***AP*** Seq: 0x31BE265E Ack: 0x6FFE5B04 Win: 0x7BFC TcpLen: 20
[**] [1:729:3] Virus - Possible scr Worm [**]
[Classification: Misc activity] [Priority: 3]
05/19-16:16:45.855657 66.84.25.254:110 -> 192.168.1.100:1711
TCP TTL:45 TOS:0x0 ID:51673 IpLen:20 DgmLen:1420 DF
***AP*** Seq: 0x389FC458 Ack: 0xF4D1FF4 Win: 0x7BFC TcpLen: 20
[**] [1:721:3] Virus - Possible pif Worm [**]
[Classification: Misc activity] [Priority: 3]
05/20-20:52:47.196496 66.84.25.254:110 -> 192.168.1.100:3554
TCP TTL:45 TOS:0x0 ID:34727 IpLen:20 DgmLen:994 DF
***AP*** Seq: 0x9014F0FA Ack: 0x92AD2015 Win: 0x7BFC TcpLen: 20
[**] [1:721:3] Virus - Possible pif Worm [**]
[Classification: Misc activity] [Priority: 3]
05/20-21:34:40.926342 66.84.25.254:110 -> 192.168.1.100:3658
TCP TTL:45 TOS:0x0 ID:62884 IpLen:20 DgmLen:1052 DF
***AP*** Seq: 0x2B8A6176 Ack: 0xB53216D0 Win: 0x7BFC TcpLen: 20
[**] [1:729:3] Virus - Possible scr Worm [**]
[Classification: Misc activity] [Priority: 3]
05/27-16:19:57.499743 66.84.25.254:110 -> 192.168.1.100:2621
TCP TTL:46 TOS:0x0 ID:9837 IpLen:20 DgmLen:1030 DF
***AP*** Seq: 0x28C1C0D3 Ack: 0x12B28400 Win: 0x7BFC TcpLen: 20
[**] [1:729:3] Virus - Possible scr Worm [**]
[Classification: Misc activity] [Priority: 3]
05/27-16:19:57.582748 66.84.25.254:110 -> 192.168.1.100:2621
TCP TTL:46 TOS:0x0 ID:9865 IpLen:20 DgmLen:1420 DF
***AP*** Seq: 0x28C1CF79 Ack: 0x12B28400 Win: 0x7BFC TcpLen: 20
[**] [1:729:3] Virus - Possible scr Worm [**]
[Classification: Misc activity] [Priority: 3]
06/01-14:47:43.493564 66.84.25.254:110 -> 192.168.1.100:3598
TCP TTL:46 TOS:0x0 ID:16240 IpLen:20 DgmLen:1420 DF
***AP*** Seq: 0xBFC3910F Ack: 0xE3A54057 Win: 0x7BFC TcpLen: 20
[**] [1:726:3] Virus - Possible MyRomeo Worm [**]
[Classification: Misc activity] [Priority: 3]
06/01-14:47:43.785193 66.84.25.254:110 -> 192.168.1.100:3598
TCP TTL:46 TOS:0x0 ID:16264 IpLen:20 DgmLen:993 DF
***AP*** Seq: 0xBFC3AFCF Ack: 0xE3A54067 Win: 0x7BFC TcpLen: 20
[**] [1:726:3] Virus - Possible MyRomeo Worm [**]
[Classification: Misc activity] [Priority: 3]
06/01-14:47:43.794997 66.84.25.254:110 -> 192.168.1.100:3598
TCP TTL:46 TOS:0x0 ID:16270 IpLen:20 DgmLen:835 DF
***AP*** Seq: 0xBFC3C593 Ack: 0xE3A54067 Win: 0x7BFC TcpLen: 20
[**] [1:726:3] Virus - Possible MyRomeo Worm [**]
[Classification: Misc activity] [Priority: 3]
06/08-15:34:36.254412 66.84.25.254:110 -> 192.168.1.100:1666
TCP TTL:46 TOS:0x0 ID:23404 IpLen:20 DgmLen:1008 DF
***AP*** Seq: 0x273C4EEF Ack: 0x7EFFC4BD Win: 0x7BFC TcpLen: 20
[**] [1:726:3] Virus - Possible MyRomeo Worm [**]
[Classification: Misc activity] [Priority: 3]
06/08-15:34:36.257360 66.84.25.254:110 -> 192.168.1.100:1666
TCP TTL:46 TOS:0x0 ID:23407 IpLen:20 DgmLen:1029 DF
***AP*** Seq: 0x273C5A59 Ack: 0x7EFFC4BD Win: 0x7BFC TcpLen: 20
[**] [1:729:3] Virus - Possible scr Worm [**]
[Classification: Misc activity] [Priority: 3]
06/16-16:27:25.543066 66.84.25.254:110 -> 192.168.1.100:4862
TCP TTL:46 TOS:0x0 ID:47477 IpLen:20 DgmLen:1001 DF
***AP*** Seq: 0x13B61A5D Ack: 0xB7E6A5C4 Win: 0x7BFC TcpLen: 20
SnortSnarf brought to you courtesy of Silicon Defense
Authors: Jim Hoagland and Stuart Staniford
See also the Snort Page by Marty Roesch
Page generated at Tue Jun 17 09:03:53 2003