incidents 2001/04
By Thread

Starting: Thu Apr 12 2001 - 12:04:46 PDT
Ending: Thu Nov 07 2030 - 07:28:32 PST

• Two questions Portnoy, Gary (Thu Apr 12 2001 - 12:04:46 PDT)
  • Re: Two questions Blake Frantz (Fri Apr 13 2001 - 09:55:54 PDT)
  • Re: Two questions Shafik Yaghmour (Fri Apr 13 2001 - 12:12:18 PDT)
• Re: Am I Under Attack? John (Thu Apr 12 2001 - 15:15:40 PDT)
• Re: Traceroute network mapping, but spoofed source? Valdis Kletnieks (Thu Apr 12 2001 - 15:42:00 PDT)
• Re: Common occurrence in my logs James W. Abendschan (Thu Apr 12 2001 - 21:57:15 PDT)
  • Re: Common occurrence in my logs Igor Gashinsky (Thu Apr 12 2001 - 21:45:41 PDT)
• Re: Yet another Linux bind worm ? Jon O. (Thu Apr 12 2001 - 21:38:45 PDT)
  • Re: Yet another Linux bind worm ? root (Thu Apr 12 2001 - 04:34:14 PDT)
    • Re: Yet another Linux bind worm ? Arthur Donkers (Sat Apr 14 2001 - 11:58:26 PDT)
  • Re: Yet another Linux bind worm ? Chris Jordan (Mon Apr 16 2001 - 08:32:32 PDT)
• Strange Hybris variant. Jay D. Dyson (Sat Apr 14 2001 - 08:28:26 PDT)
• Fw: Help with a home computer problem. dmitriw@Home (Sun Apr 15 2001 - 20:00:08 PDT)
  • Re: Fw: Help with a home computer problem. Chris Ess (Mon Apr 16 2001 - 08:29:27 PDT)
  • Re: Help with a home computer problem. claymore (Mon Apr 16 2001 - 09:17:28 PDT)
    • Re: Help with a home computer problem. David Stang (Mon Apr 16 2001 - 09:32:29 PDT)
      • Re: Help with a home computer problem. claymore (Mon Apr 16 2001 - 10:15:48 PDT)
    • Verizon DNS Lookups John R. Sciandra (Mon Apr 16 2001 - 12:58:57 PDT)
      • Re: Verizon DNS Lookups Chris Arnold (Mon Apr 16 2001 - 10:16:58 PDT)
• United States Code Keith Pachulski (Mon Apr 16 2001 - 10:41:37 PDT)
  • Re: United States Code Joe Hamelin (Mon Apr 16 2001 - 13:35:33 PDT)
• 1fab babe George Bakos (Mon Apr 16 2001 - 15:14:58 PDT)
  • Re: 1fab babe Daniel Martin (Tue Apr 17 2001 - 05:58:35 PDT)
    • Re: 1fab babe George Bakos (Tue Apr 17 2001 - 05:39:39 PDT)
• glob overflows CA-2001-07 Brian McKinney (Mon Apr 16 2001 - 15:41:23 PDT)
• Does anyone recognize this? Bill Borton (Mon Apr 16 2001 - 14:22:21 PDT)
  • Re: Does anyone recognize this? Daniel Martin (Tue Apr 17 2001 - 06:17:37 PDT)
    • Re: Does anyone recognize this? Ryan Russell (Tue Apr 17 2001 - 15:10:15 PDT)
      • Re: Does anyone recognize this? Daniel Martin (Wed Apr 18 2001 - 05:40:32 PDT)
  • Re: Does anyone recognize this? Ryan Russell (Tue Apr 17 2001 - 18:27:22 PDT)
    • Re: Does anyone recognize this? Bill Borton (Wed Apr 18 2001 - 07:28:08 PDT)
• Carko Information Alfred Huger (Tue Apr 17 2001 - 16:36:12 PDT)
• Madereet exploit Eugene Geldenhuys (Tue Apr 17 2001 - 16:06:10 PDT)
  • Re: Madereet exploit Daniel Brachmann (Wed Apr 18 2001 - 01:31:36 PDT)
    • Re: Madereet exploit Daniel Martin (Wed Apr 18 2001 - 07:30:07 PDT)
    • Re: Madereet exploit Martin Markgraf (Wed Apr 18 2001 - 08:22:25 PDT)
  • Re: Madereet exploit Roberto (Wed Apr 18 2001 - 11:40:51 PDT)
• Carko Alfred Huger (Tue Apr 17 2001 - 18:25:44 PDT)
• Cark & snmpXdmid Alfred Huger (Wed Apr 18 2001 - 07:04:10 PDT)
  • Re: Cark & snmpXdmid Shoten (Wed Apr 18 2001 - 08:40:08 PDT)
  • Re: Cark & snmpXdmid Alfred Huger (Thu Apr 19 2001 - 07:18:15 PDT)
• non-routable Scan? Curley Mr Eric P (Wed Apr 18 2001 - 07:06:13 PDT)
  • Re: non-routable Scan? Russell Fulton (Wed Apr 18 2001 - 18:09:07 PDT)
  • Re: non-routable Scan? Anders Thulin (Wed Apr 18 2001 - 23:30:49 PDT)
• 31337 udp, on cisco...? w1re p4ir (Wed Apr 18 2001 - 07:54:40 PDT)
  • Re: 31337 udp, on cisco...? Daniel Martin (Wed Apr 18 2001 - 11:05:42 PDT)
    • Re: 31337 udp, on cisco...? Jose Nazario (Wed Apr 18 2001 - 13:41:46 PDT)
  • Re: 31337 udp, on cisco...? Joe Hamelin (Wed Apr 18 2001 - 09:41:42 PDT)
  • Re: 31337 udp, on cisco...? Jason Lewis (Wed Apr 18 2001 - 16:18:05 PDT)
  • Re: 31337 udp, on cisco...? w1re p4ir (Wed Apr 18 2001 - 10:42:42 PDT)
  • Re: 31337 udp, on cisco...? Vitaly Osipov (Thu Apr 19 2001 - 01:35:53 PDT)
• Carko/snmpXdmid Analysis v1.0 Ryan Russell (Wed Apr 18 2001 - 16:17:40 PDT)
• Increase in Sun RPC Scans Jason Lewis (Wed Apr 18 2001 - 20:28:53 PDT)
  • Re: Increase in Sun RPC Scans Martin Markgraf (Thu Apr 19 2001 - 02:22:17 PDT)
  • Re: Increase in Sun RPC Scans Chris Arnold (Wed Apr 18 2001 - 21:58:55 PDT)
    • Re: Increase in Sun RPC Scans Arthur Donkers (Thu Apr 19 2001 - 08:38:41 PDT)
      • Re: Increase in Sun RPC Scans Randy Johnson (Thu Apr 19 2001 - 10:10:58 PDT)
      • Re: Increase in Sun RPC Scans Joe Hamelin (Fri Apr 20 2001 - 10:05:00 PDT)
      • Re: Increase in Sun RPC Scans Jim Forster (Fri Apr 20 2001 - 11:42:46 PDT)
      • Repeated LPR attacks against wrong OS Lance Spitzner (Sun Apr 22 2001 - 06:15:59 PDT)
  • Re: Increase in Sun RPC Scans Jason Boyer (Thu Apr 19 2001 - 04:41:36 PDT)
    • Re: Increase in Sun RPC Scans Joseph Nicholas Yarbrough (Thu Apr 19 2001 - 08:22:38 PDT)
    • Re: Increase in Sun RPC Scans Prashanth Ram (Thu Apr 19 2001 - 08:29:34 PDT)
  • Re: Increase in Sun RPC Scans Mike Fetherston (Thu Apr 19 2001 - 05:47:45 PDT)
  • Re: Increase in Sun RPC Scans Rick Robinson (Thu Apr 19 2001 - 08:36:46 PDT)
    • Re: Increase in Sun RPC Scans Muenther, Jan (Thu Apr 19 2001 - 12:22:21 PDT)
  • Re: Increase in Sun RPC Scans Joe Butin (Thu Apr 19 2001 - 08:52:55 PDT)
    • Re: Increase in Sun RPC Scans Joseph Nicholas Yarbrough (Thu Apr 19 2001 - 23:41:50 PDT)
  • Re: Increase in Sun RPC Scans Jason Olsen (Mon Apr 23 2001 - 20:06:11 PDT)
  • Re: Increase in Sun RPC Scans Kevin Jackson (Tue Apr 24 2001 - 08:56:38 PDT)
    • Re: Increase in Sun RPC Scans Hugo van der Kooij (Tue Apr 24 2001 - 10:26:31 PDT)
• Weird Broadcast Traffic Mike Tibor (Wed Apr 18 2001 - 20:42:56 PDT)
  • Re: Weird Broadcast Traffic Ryan Sweat (Wed Apr 18 2001 - 21:20:18 PDT)
  • Re: Weird Broadcast Traffic Amin Tora (Wed Apr 18 2001 - 21:31:37 PDT)
    • Re: Weird Broadcast Traffic Patrick Harrison (Thu Apr 19 2001 - 13:16:08 PDT)
  • Re: Weird Broadcast Traffic Mike Tibor (Thu Apr 19 2001 - 16:02:01 PDT)
    • Re: Weird Broadcast Traffic Crist Clark (Thu Apr 19 2001 - 16:35:30 PDT)
• Strange sendmail IDS triggers Jeff Kell (Wed Apr 18 2001 - 20:16:32 PDT)
  • Re: Strange sendmail IDS triggers Jose Nazario (Thu Apr 19 2001 - 07:11:44 PDT)
    • Re: Strange sendmail IDS triggers Jeff Kell (Thu Apr 19 2001 - 17:04:38 PDT)
• Increase in RPC Port scans (portmap probes) Alfred Huger (Wed Apr 18 2001 - 21:35:27 PDT)
• More weird scans Russell Fulton (Wed Apr 18 2001 - 22:15:32 PDT)
  • Re: More weird scans Crist Clark (Thu Apr 19 2001 - 14:21:21 PDT)
  • Re: More weird scans Curley Mr Eric P (Mon Apr 23 2001 - 06:50:47 PDT)
• Re: Increase in RPC Port scans (portmap probes) (fwd) Alfred Huger (Thu Apr 19 2001 - 09:22:04 PDT)
  • Re: Increase in RPC Port scans (portmap probes) (fwd) Russell Fulton (Thu Apr 19 2001 - 14:33:15 PDT)
• Strange Ident Packets Crist Clark (Thu Apr 19 2001 - 12:41:54 PDT)
• shell.exe Ovanes Manucharyan (Fri Apr 20 2001 - 00:39:02 PDT)
  • Re: shell.exe Ken Pfeil (Sat Apr 21 2001 - 06:46:43 PDT)
  • Re: shell.exe antoine Bour (Mon Apr 23 2001 - 01:18:21 PDT)
• Sustained attack, but seemingly random? Brian Thomas (Fri Apr 20 2001 - 17:07:13 PDT)
  • Re: Sustained attack, but seemingly random? Alexander Reelsen (Sun Apr 22 2001 - 09:52:24 PDT)
• New multiple vuln scan? Sean Brown (Fri Apr 20 2001 - 21:07:53 PDT)
• Carko + supporting rootkit coca_colaat_private (Sat Apr 21 2001 - 14:43:32 PDT)
• "Know Your Enemy: Honeynets" and S-ot-M Lance Spitzner (Sun Apr 22 2001 - 18:15:43 PDT)
• Port 8529 CSIRT.WS (Mon Apr 23 2001 - 06:06:44 PDT)
• Another incident of hack attempts from a Chinese host Eric Kimminau (Mon Apr 23 2001 - 15:01:35 PDT)
  • Re: Another incident of hack attempts from a Chinese host John Oliver (Mon Apr 23 2001 - 16:36:04 PDT)
    • Re: Another incident of hack attempts from a Chinese host Michael H. Warfield (Tue Apr 24 2001 - 07:30:50 PDT)
      • Re: Another incident of hack attempts from a Chinese host semat (Tue Apr 24 2001 - 09:29:03 PDT)
  • Re: Another incident of hack attempts from a Chinese host Robert G. Ferrell (Tue Apr 24 2001 - 10:18:14 PDT)
• Re: Sun RPC Scans, Port 111/530/32k auto222418at_private (Tue Apr 24 2001 - 07:28:54 PDT)
• attachment; filename="photo1.jpg.pif" Dzzie Z (Mon Apr 23 2001 - 23:38:34 PDT)
  • Re: attachment; filename="photo1.jpg.pif" Portnoy, Gary (Tue Apr 24 2001 - 09:38:39 PDT)
  • Re: attachment; filename="photo1.jpg.pif" Majid Almassari (Tue Apr 24 2001 - 09:53:22 PDT)
    • Re: attachment; filename="photo1.jpg.pif" Nick FitzGerald (Tue Apr 24 2001 - 18:46:57 PDT)
  • Re: attachment; filename="photo1.jpg.pif" Zora Monster (Tue Apr 24 2001 - 10:38:14 PDT)
  • Re: attachment; filename="photo1.jpg.pif" Brad Griffin (Tue Apr 24 2001 - 16:05:12 PDT)
• Vacation Troller, Ignore. Alfred Huger (Tue Apr 24 2001 - 12:23:26 PDT)
• 'FrogEater' James W. Abendschan (Tue Apr 24 2001 - 13:00:20 PDT)
  • RE: 'FrogEater' Gavin Reid (Wed Apr 25 2001 - 09:29:36 PDT)
  • RE: 'FrogEater' Julien MALGHEM (F0CUQ) (Wed Apr 25 2001 - 10:00:45 PDT)
  • Re: 'FrogEater' Martin Markgraf (Thu Apr 26 2001 - 01:19:22 PDT)
• Windowsn 2000/NT Incident Response Tools Rob Lee (Tue Apr 24 2001 - 14:19:28 PDT)
• Re: Sun RPC Scans, Port 111/530/32k, slow scans Jens Hektor (Tue Apr 24 2001 - 13:42:44 PDT)
  • Re: Sun RPC Scans, Port 111/530/32k, slow scans Philipp Stucke (Wed Apr 25 2001 - 08:39:44 PDT)
• TCP/1008 port scans Jeff Nieusma (Tue Apr 24 2001 - 22:52:42 PDT)
  • Re: TCP/1008 port scans Andreas Östling (Wed Apr 25 2001 - 11:11:09 PDT)
  • Re: TCP/1008 port scans Joe Matusiewicz (Wed Apr 25 2001 - 10:29:11 PDT)
  • Re: TCP/1008 port scans Chris Baker (Wed Apr 25 2001 - 21:27:58 PDT)
    • Re: TCP/1008 port scans Chris Baker (Wed Apr 25 2001 - 22:32:20 PDT)
• scan for 109, new worm-variant or simple scan? buschermannat_private (Wed Apr 25 2001 - 03:33:22 PDT)
  • Re: scan for 109, new worm-variant or simple scan? Scott Nursten (Wed Apr 25 2001 - 11:16:47 PDT)
    • Re: scan for 109, new worm-variant or simple scan? Martin Markgraf (Thu Apr 26 2001 - 02:12:38 PDT)
  • Re: scan for 109, new worm-variant or simple scan? Jon O. (Wed Apr 25 2001 - 13:22:48 PDT)
  • Re: scan for 109, new worm-variant or simple scan? Jeff Nieusma (Wed Apr 25 2001 - 16:01:40 PDT)
    • Re: scan for 109, new worm-variant or simple scan? Russell Fulton (Wed Apr 25 2001 - 16:54:12 PDT)
• cracked box (anyone know the name of this worm?) Peter Moody (Wed Apr 25 2001 - 10:56:45 PDT)
• Port 1981 UDP trojan/worm? Devdas Bhagat (Wed Apr 25 2001 - 03:44:03 PDT)
  • Re: Port 1981 UDP trojan/worm? Joakim von Braun (Mon Apr 30 2001 - 12:18:31 PDT)
• repeated rpc.rexd processes Xiaomei Zhou (Wed Apr 25 2001 - 08:36:45 PDT)
• new worm scan? Leon Rosenstein (Thu Apr 26 2001 - 06:31:05 PDT)
  • Re: new worm scan? Johannes B. Ullrich (Thu Apr 26 2001 - 07:55:46 PDT)
• Packets originating at port 23 Bobby, Paul (Thu Apr 26 2001 - 13:57:56 PDT)
  • Re: Packets originating at port 23 Jason Potopa (Fri Apr 27 2001 - 01:27:21 PDT)
• SecurityFocus Call for Incident Handling Articles Stephen Entwisle (Thu Apr 26 2001 - 16:21:10 PDT)
• lpdw0rm analysis Ryan Russell (Thu Apr 26 2001 - 22:42:49 PDT)
• 198.202.195.254:35817 Portnoy, Gary (Fri Apr 27 2001 - 12:28:49 PDT)
• Backdoor scans ? Jens Hektor (Sat Apr 28 2001 - 03:56:40 PDT)
  • Re: Backdoor scans ? Jeff Nieusma (Sat Apr 28 2001 - 20:42:22 PDT)
• High load average and much suspicion Kyle Hofmann (Fri Apr 27 2001 - 14:36:55 PDT)
  • Re: High load average and much suspicion Joe Hamelin (Sat Apr 28 2001 - 11:28:33 PDT)
  • Re: High load average and much suspicion Szilveszter Adam (Sat Apr 28 2001 - 11:42:10 PDT)
  • Re: High load average and much suspicion semat (Sat Apr 28 2001 - 11:49:35 PDT)
  • Re: High load average and much suspicion Cooper (Sat Apr 28 2001 - 16:21:33 PDT)
• IP 1.2.3.4 Brian Kraman (Sat Apr 28 2001 - 12:00:48 PDT)
  • Re: IP 1.2.3.4 Hugo van der Kooij (Sat Apr 28 2001 - 16:17:04 PDT)
    • Have you seen this in your logs? Jason Lewis (Sun Apr 29 2001 - 21:31:08 PDT)
      • Re: Have you seen this in your logs? H C (Mon Apr 30 2001 - 07:47:02 PDT)
  • Re: IP 1.2.3.4 John (Sun Apr 29 2001 - 07:34:41 PDT)
  • Re: IP 1.2.3.4 Joshua Fritsch (Mon Apr 30 2001 - 11:38:04 PDT)
• Another new worm ? Russell Fulton (Sun Apr 29 2001 - 18:28:05 PDT)
• slow scans to random IPs on port 53 (and other ports0 Russell Fulton (Sun Apr 29 2001 - 17:52:08 PDT)
  • Re: slow scans to random IPs on port 53 (and other ports0 Crist Clark (Mon Apr 30 2001 - 12:57:41 PDT)
    • Re: slow scans to random IPs on port 53 (and other ports0 Bryan Andersen (Mon Apr 30 2001 - 19:01:09 PDT)
• Weird traffic Curley Mr Eric P (Mon Apr 30 2001 - 07:03:36 PDT)
• Backdoor Q access? le (Sun Apr 29 2001 - 23:54:48 PDT)
• Mysterious message Mark Challender (Mon Apr 30 2001 - 08:32:36 PDT)
  • Re: Mysterious message Hugo van der Kooij (Mon Apr 30 2001 - 13:44:06 PDT)
  • Re: Mysterious message Shawn Duffy (Mon Apr 30 2001 - 13:25:56 PDT)
  • Re: Mysterious message Benjamin Krueger (Mon Apr 30 2001 - 14:34:21 PDT)
• Found this in my logs Hamid T Ouyachchi (Mon Apr 30 2001 - 11:05:41 PDT)
• My Mysterious Message Mark Challender (Mon Apr 30 2001 - 22:57:02 PDT)
• (no subject) (Sun Dec 10 2023 - 17:25:52 PST)
  • (no subject) Pat Moffitt (Mon Apr 16 2001 - 12:13:34 PDT)

Last message date: Thu Nov 07 2030 - 07:28:32 PST
Archived on: Tue May 01 2001 - 07:32:52 PDT

This archive was generated by hypermail 2b30 : Tue May 01 2001 - 07:32:52 PDT