BotHunter ®
  Live Internet Monitor Page
  Computer Science Laboratory
  SRI International


  Last Updated: Sun Jul 29 23:00:15 2012
BOTHUNTER LOGO
www.BOTHUNTER.net


Victim IP
 		Max Score
 		Profiles
 		CCs
 		Events
192.168.1.117
 1.6 VIEW 2
  • 1:22009200 {tcp} Inbound Attack: ET CURRENT_EVENTS Conficker.a Shellcode MAC_Dst: 00:30:48:30:03:AE; 445<-3437
  • 1:2000419 {tcp} Egg Download: ET POLICY PE EXE or DLL Windows file download; 1028<-3032
  • 1:2001685 {tcp} Egg Download: ET MALWARE Possible Windows executable sent when remote host claims to send an image; 1028<-3032
  • 1:3300007 {tcp} Egg Download: BotHunter Malware Windows executable (PE) sent from remote host; 1028<-3032
192.168.1.6
 0.8 VIEW 2
     
  • 1:22003081 {tcp} Inbound Attack: ET EXPLOIT NETBIOS SMB DCERPC NetrpPathCanonicalize request (possible MS06-040) MAC_Dst: 00:30:48:30:03:AE; 139<-1170
  • 1:22003082 {tcp} Inbound Attack: ET EXPLOIT NETBIOS SMB-DS DCERPC NetrpPathCanonicalize request (possible MS06-040) MAC_Dst: 00:30:48:30:03:AE; 139<-1170
  • 1:2299913 {tcp} Inbound Attack: ET SHELLCODE x86 0x90 unicode NOOP MAC_Dst: 00:30:48:30:03:AE; 139<-1170
  • 1:2000419 {tcp} Egg Download: ET POLICY PE EXE or DLL Windows file download; 9988<-1265
192.168.1.175
 0.8 VIEW 2
     
  • 1:22000032 {tcp} Inbound Attack: ET EXPLOIT LSA exploit MAC_Dst: 00:30:48:30:03:AE; 445<-3859
  • 1:22000033 {tcp} Inbound Attack: ET EXPLOIT MS04011 Lsasrv.dll RPC exploit (WinXP) MAC_Dst: 00:30:48:30:03:AE; 445<-3859
  • 1:2299913 (2) {tcp} Inbound Attack: ET SHELLCODE x86 0x90 unicode NOOP MAC_Dst: 00:30:48:30:03:AE; 445<-3859
  • 1:3300003 {tcp} Egg Download: BotHunter HTTP-based .exe Upload on backdoor port; 1031->3932
192.168.1.100
 1.4 VIEW 294
  • 1:3810007 {tcp} Russian Business Network: ET Known Russian Business Network Monitored Domain; 4815->55044
  • 1:3810007 {tcp} Russian Business Network: ET Known Russian Business Network Monitored Domain; 4815->56310
  • 1:3810007 {tcp} Russian Business Network: ET Known Russian Business Network Monitored Domain; 4815->50002
  • 1:3810007 {tcp} Russian Business Network: ET Known Russian Business Network Monitored Domain; 4815->44868
  • 1:3810007 {tcp} Russian Business Network: ET Known Russian Business Network Monitored Domain; 4815->39418
  • 1:3810007 {tcp} Russian Business Network: ET Known Russian Business Network Monitored Domain; 4815->45179
  • 1:3810007 {tcp} Russian Business Network: ET Known Russian Business Network Monitored Domain; 4815->56395
  • 1:3810007 {tcp} Russian Business Network: ET Known Russian Business Network Monitored Domain; 4815->51568
  • 1:3810007 {tcp} Russian Business Network: ET Known Russian Business Network Monitored Domain; 4815->46557
  • 1:3810007 {tcp} Russian Business Network: ET Known Russian Business Network Monitored Domain; 4815->52283
  • 1:3810007 {tcp} Russian Business Network: ET Known Russian Business Network Monitored Domain; 4815->53062
  • 1:3810007 {tcp} Russian Business Network: ET Known Russian Business Network Monitored Domain; 4815->42777
  • 1:3810007 {tcp} Russian Business Network: ET Known Russian Business Network Monitored Domain; 4815->58108
  • 1:3810007 {tcp} Russian Business Network: ET Known Russian Business Network Monitored Domain; 4815->57920
  • 1:3810007 {tcp} Russian Business Network: ET Known Russian Business Network Monitored Domain; 4815->44939
  • 1:3810007 {tcp} Russian Business Network: ET Known Russian Business Network Monitored Domain; 4815->35131
  • 1:3810007 {tcp} Russian Business Network: ET Known Russian Business Network Monitored Domain; 4815->58396
  • 1:3810007 {tcp} Russian Business Network: ET Known Russian Business Network Monitored Domain; 4815->36964
  • 1:3810007 {tcp} Russian Business Network: ET Known Russian Business Network Monitored Domain; 4815->58116
  • 1:3810007 {tcp} Russian Business Network: ET Known Russian Business Network Monitored Domain; 4815->38049
192.168.1.131
 1.9 VIEW 2
  • 1:22000032 {tcp} Inbound Attack: ET EXPLOIT LSA exploit MAC_Dst: 00:30:48:30:03:AE; 445<-2400
  • 1:22000033 {tcp} Inbound Attack: ET EXPLOIT MS04011 Lsasrv.dll RPC exploit (WinXP) MAC_Dst: 00:30:48:30:03:AE; 445<-2400
  • 1:2299913 (2) {tcp} Inbound Attack: ET SHELLCODE x86 0x90 unicode NOOP MAC_Dst: 00:30:48:30:03:AE; 445<-2400
  • 1:3300003 {tcp} Egg Download: BotHunter HTTP-based .exe Upload on backdoor port; 1031->3270
192.168.1.103
 0.8 VIEW 2
     
  • 1:22009200 {tcp} Inbound Attack: ET CURRENT_EVENTS Conficker.a Shellcode MAC_Dst: 00:30:48:30:03:AE; 445<-4180
  • 1:2000419 {tcp} Egg Download: ET POLICY PE EXE or DLL Windows file download; 1028<-5496
  • 1:2001685 {tcp} Egg Download: ET MALWARE Possible Windows executable sent when remote host claims to send an image; 1028<-5496
  • 1:3300007 {tcp} Egg Download: BotHunter Malware Windows executable (PE) sent from remote host; 1028<-5496
192.168.1.46
 1.1 VIEW 4
  • 1:2001219 {tcp} Outbound Attack: ET SCAN Potential SSH Scan (20 in 60 secs); 60494->22
  • 1:2001219 {tcp} Outbound Attack: ET SCAN Potential SSH Scan (20 in 60 secs); 43909->22
  • 1:2001219 {tcp} Outbound Attack: ET SCAN Potential SSH Scan (20 in 60 secs); 53236->22
  • 1:2001219 {tcp} Outbound Attack: ET SCAN Potential SSH Scan (20 in 60 secs); 49484->22
  • 1:2001219 {tcp} Outbound Attack: ET SCAN Potential SSH Scan (20 in 60 secs); 34494->22
  • 1:2001219 {tcp} Outbound Attack: ET SCAN Potential SSH Scan (20 in 60 secs); 37010->22
  • 1:2001219 {tcp} Outbound Attack: ET SCAN Potential SSH Scan (20 in 60 secs); 44699->22
  • 1:2001219 {tcp} Outbound Attack: ET SCAN Potential SSH Scan (20 in 60 secs); 48847->22
  • 1:2001219 {tcp} Outbound Attack: ET SCAN Potential SSH Scan (20 in 60 secs); 39592->22
192.168.1.229
 1.1 VIEW 3
  • 1:22000032 {tcp} Inbound Attack: ET EXPLOIT LSA exploit MAC_Dst: 00:30:48:30:03:AE; 445<-3136
  • 1:22000033 {tcp} Inbound Attack: ET EXPLOIT MS04011 Lsasrv.dll RPC exploit (WinXP) MAC_Dst: 00:30:48:30:03:AE; 445<-3136
  • 1:2299913 (2) {tcp} Inbound Attack: ET SHELLCODE x86 0x90 unicode NOOP MAC_Dst: 00:30:48:30:03:AE; 445<-3136
  • 1:3300003 {tcp} Egg Download: BotHunter HTTP-based .exe Upload on backdoor port; 1031->4102
  • 1:2003070 {tcp} C&C Communication: ET WORM Korgo.U Reporting, [/index.php?id=hzzvyrhnuhpnwvhw&scn=0&inf=0&ver=19&cnt=USA]; 1032->80
192.168.1.98
 0.8 VIEW 2
     
  • 1:22000032 {tcp} Inbound Attack: ET EXPLOIT LSA exploit MAC_Dst: 00:30:48:30:03:AE; 445<-4481
  • 1:22000033 {tcp} Inbound Attack: ET EXPLOIT MS04011 Lsasrv.dll RPC exploit (WinXP) MAC_Dst: 00:30:48:30:03:AE; 445<-4481
  • 1:2299913 (2) {tcp} Inbound Attack: ET SHELLCODE x86 0x90 unicode NOOP MAC_Dst: 00:30:48:30:03:AE; 445<-4481
  • 1:3300003 {tcp} Egg Download: BotHunter HTTP-based .exe Upload on backdoor port; 1031->6739
192.168.1.153
 1.6 VIEW 4
  • 1:22009200 {tcp} Inbound Attack: ET CURRENT_EVENTS Conficker.a Shellcode MAC_Dst: 00:30:48:30:03:AE; 445<-1693
  • 1:2000419 {tcp} Egg Download: ET POLICY PE EXE or DLL Windows file download; 1028<-3032
  • 1:2001685 {tcp} Egg Download: ET MALWARE Possible Windows executable sent when remote host claims to send an image; 1028<-3032
  • 1:3300007 {tcp} Egg Download: BotHunter Malware Windows executable (PE) sent from remote host; 1028<-3032
  • 1:22003081 {tcp} Inbound Attack: ET EXPLOIT NETBIOS SMB DCERPC NetrpPathCanonicalize request (possible MS06-040) MAC_Dst: 00:30:48:30:03:AE; 139<-4176
  • 1:22003082 {tcp} Inbound Attack: ET EXPLOIT NETBIOS SMB-DS DCERPC NetrpPathCanonicalize request (possible MS06-040) MAC_Dst: 00:30:48:30:03:AE; 139<-4176
  • 1:2299913 {tcp} Inbound Attack: ET SHELLCODE x86 0x90 unicode NOOP MAC_Dst: 00:30:48:30:03:AE; 139<-4176
192.168.1.247
 0.8 VIEW 2
     
  • 1:22003081 {tcp} Inbound Attack: ET EXPLOIT NETBIOS SMB DCERPC NetrpPathCanonicalize request (possible MS06-040) MAC_Dst: 00:30:48:30:03:AE; 139<-3377
  • 1:22003082 {tcp} Inbound Attack: ET EXPLOIT NETBIOS SMB-DS DCERPC NetrpPathCanonicalize request (possible MS06-040) MAC_Dst: 00:30:48:30:03:AE; 139<-3377
  • 1:2299913 {tcp} Inbound Attack: ET SHELLCODE x86 0x90 unicode NOOP MAC_Dst: 00:30:48:30:03:AE; 139<-3377
  • 1:2000419 {tcp} Egg Download: ET POLICY PE EXE or DLL Windows file download; 9988<-3476
192.168.1.144
 0.8 VIEW 4
     
  • 1:22000032 {tcp} Inbound Attack: ET EXPLOIT LSA exploit MAC_Dst: 00:30:48:30:03:AE; 445<-50997
  • 1:22000033 {tcp} Inbound Attack: ET EXPLOIT MS04011 Lsasrv.dll RPC exploit (WinXP) MAC_Dst: 00:30:48:30:03:AE; 445<-50997
  • 1:2299913 (2) {tcp} Inbound Attack: ET SHELLCODE x86 0x90 unicode NOOP MAC_Dst: 00:30:48:30:03:AE; 445<-50997
  • 1:3300003 {tcp} Egg Download: BotHunter HTTP-based .exe Upload on backdoor port; 1031->5984
  • 1:22000032 {tcp} Inbound Attack: ET EXPLOIT LSA exploit MAC_Dst: 00:30:48:30:03:AE; 445<-3620
  • 1:22000033 {tcp} Inbound Attack: ET EXPLOIT MS04011 Lsasrv.dll RPC exploit (WinXP) MAC_Dst: 00:30:48:30:03:AE; 445<-3620
  • 1:2299913 (2) {tcp} Inbound Attack: ET SHELLCODE x86 0x90 unicode NOOP MAC_Dst: 00:30:48:30:03:AE; 445<-3620
192.168.1.216
 0.8 VIEW 1
192.168.1.190
 1.1 VIEW 3
  • 1:2003070 {tcp} C&C Communication: ET WORM Korgo.U Reporting, [/index.php?id=mbehnozqsstcyuwsi&scn=0&inf=0&ver=19&cnt=USA]; 1032->80
  • 1:2003070 {tcp} C&C Communication: ET WORM Korgo.U Reporting, [/index.php?id=juwqinvjpmaxezraip&scn=0&inf=0&ver=19&cnt=USA]; 1032->80
192.168.1.128
 0.8 VIEW 1
     
  • 1:22003081 (2) {tcp} Inbound Attack: ET EXPLOIT NETBIOS SMB DCERPC NetrpPathCanonicalize request (possible MS06-040) MAC_Dst: 00:30:48:30:03:AE; 139<-4483
  • 1:22003082 (2) {tcp} Inbound Attack: ET EXPLOIT NETBIOS SMB-DS DCERPC NetrpPathCanonicalize request (possible MS06-040) MAC_Dst: 00:30:48:30:03:AE; 139<-4483
  • 1:2299913 (3) {tcp} Inbound Attack: ET SHELLCODE x86 0x90 unicode NOOP MAC_Dst: 00:30:48:30:03:AE; 139<-4544
  • 1:2000419 {tcp} Egg Download: ET POLICY PE EXE or DLL Windows file download; 9988<-4657
192.168.1.71
 1.4 VIEW 17
  • 1:2009295 (3) {tcp} Egg Download: ET USER_AGENTS Suspicious Mozilla User-Agent - Likely Fake (Mozilla/5.0), [/pdfm7/check_purchase_permission?product=os.win8rp]; 52327->80
  • 1:22000032 {tcp} Inbound Attack: ET EXPLOIT LSA exploit MAC_Dst: 00:30:48:30:03:AE; 445<-1336
  • 1:22000033 {tcp} Inbound Attack: ET EXPLOIT MS04011 Lsasrv.dll RPC exploit (WinXP) MAC_Dst: 00:30:48:30:03:AE; 445<-1336
  • 1:2299913 (2) {tcp} Inbound Attack: ET SHELLCODE x86 0x90 unicode NOOP MAC_Dst: 00:30:48:30:03:AE; 445<-1336
  • 1:3300003 {tcp} Egg Download: BotHunter HTTP-based .exe Upload on backdoor port; 1031->2555
192.168.1.30
 1.1 VIEW 2
  • 1:22009200 {tcp} Inbound Attack: ET CURRENT_EVENTS Conficker.a Shellcode MAC_Dst: 00:30:48:30:03:AE; 445<-3436
192.168.1.138
 0.8 VIEW 2
     
  • 1:22000032 {tcp} Inbound Attack: ET EXPLOIT LSA exploit MAC_Dst: 00:30:48:30:03:AE; 445<-4923
  • 1:22000033 {tcp} Inbound Attack: ET EXPLOIT MS04011 Lsasrv.dll RPC exploit (WinXP) MAC_Dst: 00:30:48:30:03:AE; 445<-4923
  • 1:2299913 (2) {tcp} Inbound Attack: ET SHELLCODE x86 0x90 unicode NOOP MAC_Dst: 00:30:48:30:03:AE; 445<-4923
  • 1:3300003 {tcp} Egg Download: BotHunter HTTP-based .exe Upload on backdoor port; 1031->475
192.168.1.149
 0.8 VIEW 2
     
  • 1:22000032 {tcp} Inbound Attack: ET EXPLOIT LSA exploit MAC_Dst: 00:30:48:30:03:AE; 445<-3968
  • 1:22000033 {tcp} Inbound Attack: ET EXPLOIT MS04011 Lsasrv.dll RPC exploit (WinXP) MAC_Dst: 00:30:48:30:03:AE; 445<-3968
  • 1:2299913 (2) {tcp} Inbound Attack: ET SHELLCODE x86 0x90 unicode NOOP MAC_Dst: 00:30:48:30:03:AE; 445<-3968
  • 1:3300003 {tcp} Egg Download: BotHunter HTTP-based .exe Upload on backdoor port; 1031->2109
192.168.1.14
 1.0 VIEW 1
  • 1:2002033 {tcp} C&C Communication: ET TROJAN BOT - potential response; 80->51127
  • 1:552123 {tcp} Outbound Attack: REGISTERED FREE ATTACK-RESPONSES Microsoft cmd.exe banner; 80->51127
192.168.1.148
 0.8 VIEW 2
     
  • 1:22000032 {tcp} Inbound Attack: ET EXPLOIT LSA exploit MAC_Dst: 00:30:48:30:03:AE; 445<-1945
  • 1:22000033 {tcp} Inbound Attack: ET EXPLOIT MS04011 Lsasrv.dll RPC exploit (WinXP) MAC_Dst: 00:30:48:30:03:AE; 445<-1945
  • 1:2299913 (2) {tcp} Inbound Attack: ET SHELLCODE x86 0x90 unicode NOOP MAC_Dst: 00:30:48:30:03:AE; 445<-1945
  • 1:3300003 {tcp} Egg Download: BotHunter HTTP-based .exe Upload on backdoor port; 1031->6739
192.168.1.159
 0.8 VIEW 2
     
  • 1:22000032 {tcp} Inbound Attack: ET EXPLOIT LSA exploit MAC_Dst: 00:30:48:30:03:AE; 445<-62970
  • 1:22000033 {tcp} Inbound Attack: ET EXPLOIT MS04011 Lsasrv.dll RPC exploit (WinXP) MAC_Dst: 00:30:48:30:03:AE; 445<-62970
  • 1:2299913 (2) {tcp} Inbound Attack: ET SHELLCODE x86 0x90 unicode NOOP MAC_Dst: 00:30:48:30:03:AE; 445<-62970
  • 1:3300003 {tcp} Egg Download: BotHunter HTTP-based .exe Upload on backdoor port; 1031->1911
192.168.1.82
 0.8 VIEW 2
     
  • 1:22009200 {tcp} Inbound Attack: ET CURRENT_EVENTS Conficker.a Shellcode MAC_Dst: 00:30:48:30:03:AE; 445<-3840
  • 1:2000419 {tcp} Egg Download: ET POLICY PE EXE or DLL Windows file download; 1028<-9763
  • 1:2001685 {tcp} Egg Download: ET MALWARE Possible Windows executable sent when remote host claims to send an image; 1028<-9763
  • 1:3300007 {tcp} Egg Download: BotHunter Malware Windows executable (PE) sent from remote host; 1028<-9763
192.168.1.221
 0.8 VIEW 2
     
  • 1:22003081 {tcp} Inbound Attack: ET EXPLOIT NETBIOS SMB DCERPC NetrpPathCanonicalize request (possible MS06-040) MAC_Dst: 00:30:48:30:03:AE; 139<-50377
  • 1:22003082 {tcp} Inbound Attack: ET EXPLOIT NETBIOS SMB-DS DCERPC NetrpPathCanonicalize request (possible MS06-040) MAC_Dst: 00:30:48:30:03:AE; 139<-50377
  • 1:2299913 {tcp} Inbound Attack: ET SHELLCODE x86 0x90 unicode NOOP MAC_Dst: 00:30:48:30:03:AE; 139<-50377
  • 1:2000419 {tcp} Egg Download: ET POLICY PE EXE or DLL Windows file download; 9988<-50527
192.168.1.85
 1.0 VIEW 24
  • 1:2001220 {tcp} C&C Communication: BLEEDING-EDGE WORM RXBOT / rbOT Exploit Report; 80->19198
  • 1:552123 {tcp} Outbound Attack: REGISTERED FREE ATTACK-RESPONSES Microsoft cmd.exe banner; 80->56543
  • 1:552123 {tcp} Outbound Attack: REGISTERED FREE ATTACK-RESPONSES Microsoft cmd.exe banner; 80->64863
  • 1:552123 (2) {tcp} Outbound Attack: REGISTERED FREE ATTACK-RESPONSES Microsoft cmd.exe banner; 80->56543
  • 1:2001220 {tcp} C&C Communication: BLEEDING-EDGE WORM RXBOT / rbOT Exploit Report; 80->44376
  • 1:552123 (4) {tcp} Outbound Attack: REGISTERED FREE ATTACK-RESPONSES Microsoft cmd.exe banner; 80->62553
  • 1:2001220 (2) {tcp} C&C Communication: BLEEDING-EDGE WORM RXBOT / rbOT Exploit Report; 80->44376
  • 1:552123 {tcp} Outbound Attack: REGISTERED FREE ATTACK-RESPONSES Microsoft cmd.exe banner; 80->45320
  • 1:2001220 {tcp} C&C Communication: BLEEDING-EDGE WORM RXBOT / rbOT Exploit Report; 80->43712
  • 1:552123 {tcp} Outbound Attack: REGISTERED FREE ATTACK-RESPONSES Microsoft cmd.exe banner; 80->44819
  • 1:2001220 (2) {tcp} C&C Communication: BLEEDING-EDGE WORM RXBOT / rbOT Exploit Report; 80->43712
  • 1:2001220 {tcp} C&C Communication: BLEEDING-EDGE WORM RXBOT / rbOT Exploit Report; 80->49144
  • 1:2001220 {tcp} C&C Communication: BLEEDING-EDGE WORM RXBOT / rbOT Exploit Report; 80->40633
  • 1:2001220 {tcp} C&C Communication: BLEEDING-EDGE WORM RXBOT / rbOT Exploit Report; 80->26490
  • 1:2001220 {tcp} C&C Communication: BLEEDING-EDGE WORM RXBOT / rbOT Exploit Report; 80->49359
  • 1:2001220 {tcp} C&C Communication: BLEEDING-EDGE WORM RXBOT / rbOT Exploit Report; 80->51153
  • 1:2001220 {tcp} C&C Communication: BLEEDING-EDGE WORM RXBOT / rbOT Exploit Report; 80->62717
  • 1:2001220 (3) {tcp} C&C Communication: BLEEDING-EDGE WORM RXBOT / rbOT Exploit Report; 80->53439
  • 1:2002033 {tcp} C&C Communication: ET TROJAN BOT - potential response; 80->35505
  • 1:2001220 {tcp} C&C Communication: BLEEDING-EDGE WORM RXBOT / rbOT Exploit Report; 80->52865
192.168.1.164
 0.8 VIEW 2
     
  • 1:22000032 {tcp} Inbound Attack: ET EXPLOIT LSA exploit MAC_Dst: 00:30:48:30:03:AE; 445<-3652
  • 1:22000033 {tcp} Inbound Attack: ET EXPLOIT MS04011 Lsasrv.dll RPC exploit (WinXP) MAC_Dst: 00:30:48:30:03:AE; 445<-3652
  • 1:2299913 (2) {tcp} Inbound Attack: ET SHELLCODE x86 0x90 unicode NOOP MAC_Dst: 00:30:48:30:03:AE; 445<-3652
  • 1:3300003 {tcp} Egg Download: BotHunter HTTP-based .exe Upload on backdoor port; 1031->6739
192.168.1.245
 1.1 VIEW 4
  • 1:22000032 {tcp} Inbound Attack: ET EXPLOIT LSA exploit MAC_Dst: 00:30:48:30:03:AE; 445<-1374
  • 1:22000033 {tcp} Inbound Attack: ET EXPLOIT MS04011 Lsasrv.dll RPC exploit (WinXP) MAC_Dst: 00:30:48:30:03:AE; 445<-1374
  • 1:2299913 (2) {tcp} Inbound Attack: ET SHELLCODE x86 0x90 unicode NOOP MAC_Dst: 00:30:48:30:03:AE; 445<-1374
  • 1:3300003 {tcp} Egg Download: BotHunter HTTP-based .exe Upload on backdoor port; 1031->4735
  • 1:22000032 {tcp} Inbound Attack: ET EXPLOIT LSA exploit MAC_Dst: 00:30:48:30:03:AE; 445<-33856
  • 1:22000033 {tcp} Inbound Attack: ET EXPLOIT MS04011 Lsasrv.dll RPC exploit (WinXP) MAC_Dst: 00:30:48:30:03:AE; 445<-33856
  • 1:2299913 (2) {tcp} Inbound Attack: ET SHELLCODE x86 0x90 unicode NOOP MAC_Dst: 00:30:48:30:03:AE; 445<-33856
192.168.1.69
 1.1 VIEW 2
  • 1:22009201 {tcp} Inbound Attack: ET CURRENT_EVENTS Conficker.b Shellcode MAC_Dst: 00:30:48:30:03:AE; 445<-4176
192.168.1.102
 1.4 VIEW 332
  • 1:9910001 {udp} Bot Space Access: ET POLICY Spambot Host DNS MX Query High Count; 52720->53
  • 1:2003330 {udp} Attack Prep: ET POLICY Possible Spambot Host DNS MX Query High Count; 51820->53
  • 1:2003330 {udp} Attack Prep: ET POLICY Possible Spambot Host DNS MX Query High Count; 60614->53
  • 1:2003330 {udp} Attack Prep: ET POLICY Possible Spambot Host DNS MX Query High Count; 44521->53
  • 1:2003330 {udp} Attack Prep: ET POLICY Possible Spambot Host DNS MX Query High Count; 46599->53
  • 1:2003330 {udp} Attack Prep: ET POLICY Possible Spambot Host DNS MX Query High Count; 55850->53
  • 1:9910001 {udp} Bot Space Access: ET POLICY Spambot Host DNS MX Query High Count; 43690->53
  • 1:2003330 {udp} Attack Prep: ET POLICY Possible Spambot Host DNS MX Query High Count; 56529->53
  • 1:2003330 {udp} Attack Prep: ET POLICY Possible Spambot Host DNS MX Query High Count; 36346->53
  • 1:9910001 {udp} Bot Space Access: ET POLICY Spambot Host DNS MX Query High Count; 34483->53
  • 1:2003330 {udp} Attack Prep: ET POLICY Possible Spambot Host DNS MX Query High Count; 48306->53
  • 1:2003330 {udp} Attack Prep: ET POLICY Possible Spambot Host DNS MX Query High Count; 51924->53
  • 1:2003330 {udp} Attack Prep: ET POLICY Possible Spambot Host DNS MX Query High Count; 59780->53
  • 1:2003330 {udp} Attack Prep: ET POLICY Possible Spambot Host DNS MX Query High Count; 60693->53
  • 1:2003330 {udp} Attack Prep: ET POLICY Possible Spambot Host DNS MX Query High Count; 53584->53
  • 1:9910001 {udp} Bot Space Access: ET POLICY Spambot Host DNS MX Query High Count; 53140->53
  • 1:2003330 {udp} Attack Prep: ET POLICY Possible Spambot Host DNS MX Query High Count; 51674->53
  • 1:9910001 {udp} Bot Space Access: ET POLICY Spambot Host DNS MX Query High Count; 56422->53
  • 1:2003330 {udp} Attack Prep: ET POLICY Possible Spambot Host DNS MX Query High Count; 40315->53
  • 1:2003330 {udp} Attack Prep: ET POLICY Possible Spambot Host DNS MX Query High Count; 48920->53
192.168.1.60
 1.1 VIEW 2
  • 1:22000033 {tcp} Inbound Attack: ET EXPLOIT MS04011 Lsasrv.dll RPC exploit (WinXP) MAC_Dst: 00:30:48:30:03:AE; 445<-49410
  • 1:2299913 (2) {tcp} Inbound Attack: ET SHELLCODE x86 0x90 unicode NOOP MAC_Dst: 00:30:48:30:03:AE; 445<-49410