■あまてらす
----------------------------
■不正なアクセス(日本を送信元とした攻撃)
----------------------------
自分の管理するグローバルIPアドレスが以下のリストに含まれている場合は、ウィルスまたはボットワームに感染している恐れが高いです。至急ウィルススキャンを実行される事を推奨します。
61.44.97.148 148.97.44.61.ap.seikyou.ne.jp
61.116.63.206 AKAfb-01p1-206.ppp11.odn.ad.jp
61.116.123.38 SSJfa-01p1-38.ppp11.odn.ad.jp
61.116.140.200 SKNfa-03p1-200.ppp11.odn.ad.jp
61.117.15.117 M015117.ppp.dion.ne.jp
61.123.82.141 SODfa-01p3-141.ppp11.odn.ad.jp
61.123.89.165 AOBfb-02p1-165.ppp11.odn.ad.jp
61.123.96.112 SODfa-01p1-112.ppp11.odn.ad.jp
61.124.59.214 ntoska024214.oska.nt.adsl.ppp.infoweb.ne.jp
61.124.202.239 ntfkok015239.fkok.nt.adsl.ppp.infoweb.ne.jp
61.125.18.232 m61-125-18-232.megafit.me-h.ne.jp
61.125.34.78 z78.61-125-34.ppp.wakwak.ne.jp
61.125.38.66 z66.61-125-38.ppp.wakwak.ne.jp
61.125.66.25 zaq3d7d4219.zaq.ne.jp
61.125.66.194 zaq3d7d42c2.zaq.ne.jp
61.125.67.66 zaq3d7d4342.zaq.ne.jp
61.125.73.56 zaq3d7d4938.zaq.ne.jp
61.125.76.205 zaq3d7d4ccd.zaq.ne.jp
61.125.77.10 zaq3d7d4d0a.zaq.ne.jp
61.125.81.40 zaq3d7d5128.zaq.ne.jp
61.125.82.44 zaq3d7d522c.zaq.ne.jp
61.125.84.80 zaq3d7d5450.zaq.ne.jp
61.125.85.143 zaq3d7d558f.zaq.ne.jp
61.125.90.87 zaq3d7d5a57.zaq.ne.jp
61.125.90.156 zaq3d7d5a9c.zaq.ne.jp
61.125.91.58 zaq3d7d5b3a.zaq.ne.jp
61.125.91.103 zaq3d7d5b67.zaq.ne.jp
61.125.91.130 zaq3d7d5b82.zaq.ne.jp
61.125.92.216 zaq3d7d5cd8.zaq.ne.jp
61.125.95.93 zaq3d7d5f5d.zaq.ne.jp
61.125.95.209 zaq3d7d5fd1.zaq.ne.jp
61.125.96.233 zaq3d7d60e9.zaq.ne.jp
61.125.97.194 zaq3d7d61c2.zaq.ne.jp
61.125.98.7 zaq3d7d6207.zaq.ne.jp
61.125.100.212 zaq3d7d64d4.zaq.ne.jp
61.125.102.235 zaq3d7d66eb.zaq.ne.jp
61.125.103.118 zaq3d7d6776.zaq.ne.jp
61.125.104.53 zaq3d7d6835.zaq.ne.jp
61.125.104.194 zaq3d7d68c2.zaq.ne.jp
61.125.105.31 zaq3d7d691f.zaq.ne.jp
61.125.105.122 zaq3d7d697a.zaq.ne.jp
61.125.106.32 zaq3d7d6a20.zaq.ne.jp
61.125.107.102 zaq3d7d6b66.zaq.ne.jp
61.125.110.240 zaq3d7d6ef0.zaq.ne.jp
61.125.111.75 zaq3d7d6f4b.zaq.ne.jp
61.125.111.192 zaq3d7d6fc0.zaq.ne.jp
61.125.123.130 zaq3d7d7b82.zaq.ne.jp
61.125.125.195 zaq3d7d7dc3.zaq.ne.jp
61.125.127.150 zaq3d7d7f96.zaq.ne.jp
61.125.153.66 pc4c066.ztv.ne.jp
61.125.192.44 i192044.ppp.asahi-net.or.jp
61.125.194.30 i194030.ppp.asahi-net.or.jp
61.125.194.210 i194210.ppp.asahi-net.or.jp
61.125.195.119 i195119.ppp.asahi-net.or.jp
61.125.197.146 i197146.ppp.asahi-net.or.jp
61.125.200.78 i200078.ppp.asahi-net.or.jp
61.125.200.94 i200094.ppp.asahi-net.or.jp
61.125.201.112 i201112.ppp.asahi-net.or.jp
61.125.203.51 i203051.ppp.asahi-net.or.jp
61.125.205.184 i205184.ppp.asahi-net.or.jp
61.125.214.199 i214199.ppp.asahi-net.or.jp
61.125.226.197 i226197.ppp.asahi-net.or.jp
61.125.249.190 i249190.ppp.asahi-net.or.jp
61.125.251.159 i251159.ppp.asahi-net.or.jp
61.125.252.19 i252019.ppp.asahi-net.or.jp
61.125.253.58 i253058.ppp.asahi-net.or.jp
61.125.253.80 i253080.ppp.asahi-net.or.jp
61.126.219.28 p0028-ipad01okayamaima.okayama.ocn.ne.jp
61.201.162.206 TYOnni-17p174.ppp12.odn.ad.jp
61.203.39.147 FLA1Aab147.aic.mesh.ad.jp
61.207.106.72 p7072-ipad01aobadori.miyagi.ocn.ne.jp
61.213.73.210 j073210.ppp.asahi-net.or.jp
210.153.231.83 pl083.nas922.yamaguchi.nttpc.ne.jp
218.44.52.61 f52.61.fgo.jp
220.214.93.120 ZD093120.ppp.dion.ne.jp
221.113.31.71 p031071.ppp.asahi-net.or.jp
■Report
- Honeynet: 192.168.37.0/24
- Starting Date: 20051222 (inclusive)
- Ending Date: 20051223 (exclusive)
- Number of days: 1
- Output file: /tmp/.sum.ggl29114
Total pcap records processed: 30,284
Total snort records processed: 6,450
========================================
Summary
=======
Remote IP Count: 3,046
Ports Scanned: 137
Connection Packets Packets Bytes Bytes
Type Count In Out In Out
-------- --------- --------- --------- --------- ---------
Inbound 6364 45831 39198 2774800 1111286
Outbound 2797 9732 9732 409057 409057
Total Snort SIDs: 17
Total Snort Alerts: 6450
========================================
Top 10 Snort Alerts
===================
Count SID Alert Description
----- ------ ---------------------------------
2848 46 (snort_decoder) WARNING: TCP Data Offset is less than 5!
1866 2 (spp_stream4) possible EVASIVE RST detection
902 2404 NETBIOS SMB-DS Session Setup AndX request unicode username overflow attempt
389 1390 SHELLCODE x86 inc ebx NOOP
301 402 ICMP Destination Unreachable Port Unreachable
41 2924 NETBIOS SMB-DS repeated logon failure
27 2403 NETBIOS SMB Session Setup AndX request unicode username overflow attempt
25 2466 NETBIOS SMB-DS IPC$ unicode share access
16 2472 NETBIOS SMB-DS C$ unicode share access
14 528 BAD-TRAFFIC loopback traffic
8 1042 WEB-IIS view source via translate header
========================================
All Snort Alerts
================
Count SID Alert Description
----- ------ ---------------------------------
1866 2 (spp_stream4) possible EVASIVE RST detection
2848 46 (snort_decoder) WARNING: TCP Data Offset is less than 5!
301 402 ICMP Destination Unreachable Port Unreachable
3 477 ICMP Source Quench
14 528 BAD-TRAFFIC loopback traffic
4 538 NETBIOS SMB IPC$ unicode share access
8 1042 WEB-IIS view source via translate header
389 1390 SHELLCODE x86 inc ebx NOOP
2 1852 WEB-MISC robots.txt access
2 2049 MS-SQL ping attempt
1 2251 NETBIOS DCERPC Remote Activation bind attempt
27 2403 NETBIOS SMB Session Setup AndX request unicode username overflow attempt
902 2404 NETBIOS SMB-DS Session Setup AndX request unicode username overflow attempt
25 2466 NETBIOS SMB-DS IPC$ unicode share access
16 2472 NETBIOS SMB-DS C$ unicode share access
41 2924 NETBIOS SMB-DS repeated logon failure
1 3276 NETBIOS DCERPC IActivation little endian bind attempt
========================================
Top 10 Scanned Ports:
=====================
Port Packets Bytes Conns
--------- --------- --------- ---------
tcp/1433 51297 838859 3112
tcp/139 10384 888892 1313
tcp/445 18533 1547943 1131
tcp/1025 3011 365324 239
udp/1026 143 66939 137
udp/1027 123 57376 117
tcp/135 969 26272 116
tcp/80 286 77914 27
udp/137 18 3015 10
tcp/4899 46 0 9
========================================