SnortSnarf signature page

WEB-IIS ISAPI .ida attempt

SnortSnarf v021111.1

Signature section (91123)

Top 20 source IPs

Top 20 dest IPs

930 alerts with this signature using input module SnortFileInput, with sources:

/home/rivettmj/snort_alertlog/alert

Earliest such alert at 04:22:53.472111 on 04/18/2003
Latest such alert at 03:47:13.898725 on 06/17/2003

WEB-IIS ISAPI .ida attempt	304 sources	1 destinations
Priority: 1	Classification: Web Application Attack
[sid:1243] [arachNIDS:552]

Sources triggering this attack signature

Source	# Alerts (sig)	# Alerts (total)	# Dsts (sig)	# Dsts (total)
24.209.196.254	66	134	1	1
24.209.98.148	62	125	1	1
24.209.26.198	60	120	1	1
24.209.36.194	56	129	1	1
24.209.37.151	37	74	1	1
24.209.44.83	36	72	1	1
24.209.39.246	35	326	1	1
24.209.191.91	27	136	1	1
24.209.97.26	25	50	1	1
24.209.229.123	24	48	1	1
24.209.203.150	20	40	1	1
24.209.49.251	20	42	1	1
24.209.215.159	16	33	1	1
24.209.238.177	16	32	1	1
24.209.191.210	14	28	1	1
24.209.42.242	14	77	1	1
24.209.105.156	13	306	1	1
24.209.5.98	7	14	1	1
24.209.33.158	6	12	1	1
24.209.50.212	5	10	1	1
24.209.113.11	5	52	1	1
24.209.178.84	5	10	1	1
24.209.45.21	5	10	1	1
218.16.111.89	5	10	1	1
24.209.179.154	5	10	1	1
24.209.210.252	5	10	1	1
24.209.45.97	4	8	1	1
24.225.182.78	4	6	1	1
24.209.100.245	4	8	1	1
24.209.34.185	4	8	1	1
24.209.133.90	4	8	1	1
24.209.184.90	4	8	1	1
24.132.247.34	4	8	1	1
24.162.60.201	3	4	1	1
24.198.198.27	3	5	1	1
24.118.109.209	3	5	1	1
211.167.226.78	3	6	1	1
24.209.97.60	3	6	1	1
24.173.130.70	2	5	1	1
24.172.63.245	2	4	1	1
24.42.15.25	2	4	1	1
24.207.34.110	2	4	1	1
24.136.217.109	2	4	1	1
24.130.80.176	2	4	1	1
24.218.174.97	2	4	1	1
24.158.157.34	2	4	1	1
24.100.74.154	2	4	1	1
24.159.178.25	2	3	1	1
24.98.4.90	2	4	1	1
24.157.60.48	2	20	1	1
24.74.60.176	2	4	1	1
24.34.204.45	2	3	1	1
61.139.208.170	2	4	1	1
24.126.90.163	2	4	1	1
24.61.2.118	2	4	1	1
24.126.123.161	2	4	1	1
24.62.42.136	2	4	1	1
24.136.138.173	2	4	1	1
24.68.67.114	2	4	1	1
24.168.247.208	2	4	1	1
24.127.15.16	2	21	1	1
24.194.228.55	2	4	1	1
24.209.66.127	2	4	1	1
24.166.190.32	2	4	1	1
24.231.8.184	2	3	1	1
24.99.77.52	2	4	1	1
24.214.6.207	2	4	1	1
24.218.33.167	2	4	1	1
24.136.155.112	2	4	1	1
24.239.142.141	2	4	1	1
24.26.238.58	1	2	1	1
200.149.157.153	1	2	1	1
24.229.103.234	1	2	1	1
24.155.55.163	1	2	1	1
24.130.74.15	1	2	1	1
24.132.129.206	1	2	1	1
24.112.177.163	1	2	1	1
24.55.29.58	1	2	1	1
24.145.197.3	1	2	1	1
218.58.115.113	1	2	1	1
24.27.99.244	1	2	1	1
61.136.148.43	1	2	1	1
24.145.197.22	1	2	1	1
159.134.176.59	1	2	1	1
24.26.146.115	1	2	1	1
206.49.58.30	1	2	1	1
24.207.210.156	1	2	1	1
24.217.19.177	1	2	1	1
24.118.162.108	1	2	1	1
24.61.163.31	1	2	1	1
24.217.85.28	1	2	1	1
65.196.39.36	1	2	1	1
24.83.20.152	1	2	1	1
213.145.174.123	1	2	1	1
24.193.243.23	1	2	1	1
24.209.14.164	1	2	1	1
24.207.208.47	1	2	1	1
24.141.105.208	1	2	1	1
24.216.27.88	1	2	1	1
24.29.133.200	1	2	1	1
62.194.177.98	1	2	1	1
61.11.35.67	1	2	1	1
24.29.16.254	1	2	1	1
24.128.167.110	1	2	1	1
200.54.64.130	1	2	1	1
24.118.24.56	1	2	1	1
24.150.72.168	1	2	1	1
24.88.222.55	1	2	1	1
24.99.71.129	1	2	1	1
24.207.196.229	1	2	1	1
24.71.45.89	1	2	1	1
24.171.29.23	1	2	1	1
24.100.77.7	1	2	1	1
24.218.34.115	1	2	1	1
24.145.209.152	1	2	1	1
24.233.151.10	1	2	1	1
24.136.140.127	1	2	1	1
202.100.20.76	1	2	1	1
24.145.209.157	1	2	1	1
24.207.159.213	1	2	1	1
65.26.95.7	1	2	1	1
24.136.220.9	1	2	1	1
24.53.7.79	1	2	1	1
24.118.120.204	1	2	1	1
211.161.149.3	1	2	1	1
24.63.8.146	1	2	1	1
24.100.46.121	1	2	1	1
24.118.108.28	1	2	1	1
24.225.137.228	1	2	1	1
24.209.177.126	1	2	1	1
24.209.24.98	1	2	1	1
24.129.65.245	1	2	1	1
24.33.80.121	1	2	1	1
24.212.21.192	1	2	1	1
24.198.148.199	1	2	1	1
24.118.110.94	1	2	1	1
24.130.75.129	1	2	1	1
24.129.124.68	1	2	1	1
24.148.39.97	1	2	1	1
24.98.68.183	1	2	1	1
24.42.220.118	1	2	1	1
61.189.217.31	1	2	1	1
24.199.81.210	1	2	1	1
24.193.104.69	1	2	1	1
24.58.202.219	1	2	1	1
24.172.109.3	1	2	1	1
24.192.100.125	1	2	1	1
24.239.159.159	1	2	1	1
61.143.118.72	1	2	1	1
24.151.33.76	1	2	1	1
24.159.116.86	1	2	1	1
24.167.23.63	1	2	1	1
24.131.187.236	1	2	1	1
24.145.224.14	1	2	1	1
81.57.79.96	1	2	1	1
24.193.10.206	1	2	1	1
24.193.153.146	1	2	1	1
24.30.124.220	1	2	1	1
24.91.112.149	1	18	1	1
24.77.17.60	1	2	1	1
203.73.143.123	1	2	1	1
24.98.69.172	1	33	1	1
24.148.85.85	1	18	1	1
24.128.89.17	1	2	1	1
24.239.182.109	1	2	1	1
24.48.212.45	1	2	1	1
24.80.90.219	1	2	1	1
24.209.128.164	1	2	1	1
24.167.80.155	1	2	1	1
218.151.92.100	1	2	1	1
24.112.85.6	1	2	1	1
24.28.233.168	1	2	1	1
24.112.69.8	1	2	1	1
24.67.245.128	1	2	1	1
24.43.3.89	1	2	1	1
24.229.63.112	1	2	1	1
24.174.88.220	1	2	1	1
24.98.209.119	1	2	1	1
24.148.1.42	1	2	1	1
24.93.250.160	1	2	1	1
24.209.252.31	1	2	1	1
24.136.23.20	1	2	1	1
218.27.203.97	1	2	1	1
24.148.65.68	1	2	1	1
24.42.35.231	1	2	1	1
24.150.134.130	1	2	1	1
24.163.219.251	1	3	1	1
24.98.28.21	1	2	1	1
24.175.87.10	1	2	1	1
24.194.35.172	1	2	1	1
80.212.222.63	1	2	1	1
24.174.80.15	1	2	1	1
24.193.230.46	1	2	1	1
24.91.171.1	1	2	1	1
24.125.71.226	1	2	1	1
24.27.172.150	1	2	1	1
24.101.169.3	1	2	1	1
62.220.28.154	1	2	1	1
24.93.116.225	1	2	1	1
24.166.156.30	1	2	1	1
24.196.16.17	1	2	1	1
24.174.84.225	1	2	1	1
24.98.45.13	1	2	1	1
24.25.30.57	1	2	1	1
24.162.150.179	1	2	1	1
24.93.51.106	1	2	1	1
24.165.15.177	1	2	1	1
24.145.197.96	1	2	1	1
210.107.253.211	1	2	1	1
24.25.215.4	1	2	1	1
24.34.176.236	1	2	1	1
24.99.79.52	1	2	1	1
61.152.247.17	1	2	1	1
24.161.243.248	1	2	1	1
24.29.155.70	1	2	1	1
24.209.125.171	1	2	1	1
24.80.9.168	1	2	1	1
24.112.238.37	1	2	1	1
24.77.219.17	1	2	1	1
63.197.51.170	1	2	1	1
24.112.153.163	1	2	1	1
218.18.72.33	1	2	1	1
24.91.243.83	1	2	1	1
24.175.36.19	1	2	1	1
24.26.92.185	1	2	1	1
24.208.78.236	1	2	1	1
24.102.124.170	1	2	1	1
24.136.152.220	1	2	1	1
24.155.52.88	1	2	1	1
24.244.187.6	1	2	1	1
24.74.111.19	1	2	1	1
24.160.250.236	1	2	1	1
24.225.150.212	1	2	1	1
24.173.6.106	1	2	1	1
24.93.134.37	1	2	1	1
24.95.148.34	1	2	1	1
24.81.48.235	1	2	1	1
80.117.71.238	1	2	1	1
68.72.208.32	1	2	1	1
24.126.31.33	1	2	1	1
24.160.33.54	1	2	1	1
24.207.194.112	1	2	1	1
24.167.127.146	1	2	1	1
24.194.136.216	1	2	1	1
24.244.179.28	1	2	1	1
24.164.115.194	1	2	1	1
24.90.108.92	1	2	1	1
200.67.24.138	1	2	1	1
24.120.224.114	1	2	1	1
24.33.145.212	1	2	1	1
24.94.15.67	1	2	1	1
12.27.55.243	1	2	1	1
24.82.171.110	1	2	1	1
24.225.153.162	1	2	1	1
24.24.212.29	1	2	1	1
24.117.37.60	1	2	1	1
24.73.104.66	1	2	1	1
24.235.161.61	1	2	1	1
219.155.227.106	1	2	1	1
24.81.210.230	1	2	1	1
217.7.121.166	1	2	1	1
24.147.143.32	1	18	1	1
24.69.2.199	1	2	1	1
24.218.185.195	1	2	1	1
24.90.188.91	1	2	1	1
24.68.101.113	1	2	1	1
24.49.186.177	1	2	1	1
24.244.137.89	1	2	1	1
24.33.18.42	1	2	1	1
24.237.10.95	1	2	1	1
24.63.13.186	1	2	1	1
24.231.32.81	1	2	1	1
24.132.51.251	1	2	1	1
24.218.145.201	1	2	1	1
24.125.88.136	1	2	1	1
24.102.7.235	1	2	1	1
24.132.66.239	1	2	1	1
24.172.109.75	1	2	1	1
24.106.43.6	1	2	1	1
24.34.222.52	1	19	1	1
24.151.128.134	1	2	1	1
24.114.141.149	1	2	1	1
24.42.59.140	1	2	1	1
24.209.210.177	1	2	1	1
24.162.63.181	1	2	1	1
24.98.153.56	1	2	1	1
219.155.227.118	1	2	1	1
24.195.81.51	1	2	1	1
24.90.170.180	1	2	1	1
24.245.10.192	1	2	1	1
24.94.192.41	1	2	1	1
24.238.141.78	1	2	1	1
24.130.90.29	1	2	1	1
24.209.71.22	1	2	1	1
24.126.134.104	1	2	1	1
24.147.6.158	1	2	1	1
24.71.225.134	1	2	1	1
24.103.146.165	1	2	1	1
218.87.235.253	1	2	1	1
24.217.69.93	1	2	1	1
218.28.4.46	1	2	1	1
24.118.69.183	1	2	1	1
24.106.135.110	1	2	1	1
24.98.239.151	1	2	1	1

Destinations receiving this attack signature

Destinations	# Alerts (sig)	# Alerts (total)	# Srcs (sig)	# Srcs (total)
192.168.1.6	930	7770	304	624

SnortSnarf brought to you courtesy of Silicon Defense
Authors: Jim Hoagland and Stuart Staniford
See also the Snort Page by Marty Roesch
Page generated at Tue Jun 17 09:03:51 2003