incidents 2001/07
By Thread

Starting: Sun Jul 01 2001 - 06:01:22 PDT
Ending: Tue Jul 31 2001 - 21:05:32 PDT

• Traffic from microsoft.com ? Peter Bates (Sun Jul 01 2001 - 06:01:22 PDT)
  • Re: Traffic from microsoft.com ? Bjorn Djupvik (Sun Jul 01 2001 - 13:47:12 PDT)
  • Re: Traffic from microsoft.com ? Peter Bates (Sun Jul 01 2001 - 16:21:02 PDT)
• Re: Why would someone DoS a free-lance writer? gabriel rosenkoetter (Sun Jul 01 2001 - 11:08:11 PDT)
  • Re: Why would someone DoS a free-lance writer? James Pruitt (Sun Jul 01 2001 - 17:16:32 PDT)
  • Re: Why would someone DoS a free-lance writer? Sara Brigid Gaffney (Sun Jul 01 2001 - 15:21:39 PDT)
  • Re: Why would someone DoS a free-lance writer? Markus Kern (Mon Jul 02 2001 - 07:39:22 PDT)
    • Re: Why would someone DoS a free-lance writer? gabriel rosenkoetter (Mon Jul 02 2001 - 21:25:55 PDT)
      • Re: Why would someone DoS a free-lance writer? Markus Kern (Tue Jul 03 2001 - 12:17:19 PDT)
      • Re: Why would someone DoS a free-lance writer? gabriel rosenkoetter (Thu Jul 05 2001 - 22:40:54 PDT)
• sadmind/IIS side effects Denis Normand (Mon Jul 02 2001 - 08:36:07 PDT)
• THE HONEYNET PROJECT: July's Scan of the Month Jeffery L. Stutzman (Mon Jul 02 2001 - 06:03:18 PDT)
• Re: solaris hack info required Jens Hektor (Sun Jul 01 2001 - 23:01:23 PDT)
• THE HONEYNET PROJECT: July Scan of the Month Jeffery L. Stutzman (Mon Jul 02 2001 - 10:37:51 PDT)
• iis scanning Jordan K Wiens (Mon Jul 02 2001 - 12:09:27 PDT)
  • Re: iis scanning Jordan K Wiens (Mon Jul 02 2001 - 12:24:15 PDT)
  • Re: iis scanning Patrick Oonk (Tue Jul 03 2001 - 04:03:51 PDT)
• Re: Interesting group of scans Akatosh (Tue Jul 03 2001 - 13:22:42 PDT)
• Deny IP spoof from 255.255.255.255 Curt Wilson (Thu Jul 05 2001 - 14:58:24 PDT)
  • Re: Deny IP spoof from 255.255.255.255 Vitaly Osipov (Fri Jul 06 2001 - 08:32:34 PDT)
    • Re: Deny IP spoof from 255.255.255.255 Jens Hektor (Fri Jul 06 2001 - 13:26:04 PDT)
    • Re: Deny IP spoof from 255.255.255.255 Crist Clark (Fri Jul 06 2001 - 13:49:06 PDT)
  • Re: Deny IP spoof from 255.255.255.255 Crist Clark (Fri Jul 06 2001 - 10:50:40 PDT)
• Abuse Complaint/Postmaster issue Aaron Silver (Fri Jul 06 2001 - 06:35:20 PDT)
  • Re: Abuse Complaint/Postmaster issue Aaron Silver (Fri Jul 06 2001 - 09:35:28 PDT)
• [Fwd: [iodef] IODEF BoF at FIRST13 materials and IODEF work update] Yuri Demchenko (Fri Jul 06 2001 - 10:05:10 PDT)
• Advanced IIS unicode scanning? Gossi The Dog (Fri Jul 06 2001 - 19:22:37 PDT)
• TCP Src 5635: what is it? rlt (Tue Jul 10 2001 - 08:11:28 PDT)
  • RE: TCP Src 5635: what is it? Curt Purdy (Tue Jul 10 2001 - 10:02:24 PDT)
    • Re: TCP Src 5635: what is it? Scott Nursten (Thu Jul 12 2001 - 01:58:30 PDT)
• Unicode Logs with Ping Activity myrddin_eat_private (Tue Jul 10 2001 - 09:24:50 PDT)
  • Re: Unicode Logs with Ping Activity Jordan K Wiens (Tue Jul 10 2001 - 10:05:45 PDT)
    • 27015 probe increase?? cg (Tue Jul 10 2001 - 12:10:38 PDT)
      • Re: 27015 probe increase?? bhc2at_private (Wed Jul 11 2001 - 14:09:17 PDT)
      • Re: 27015 probe increase?? mstockdaat_private (Wed Jul 11 2001 - 13:42:30 PDT)
    • Re: Unicode Logs with Ping Activity Blake Frantz (Tue Jul 10 2001 - 10:39:20 PDT)
  • Re: Unicode Logs with Ping Activity myrddin_eat_private (Tue Jul 10 2001 - 11:13:16 PDT)
    • Re: Unicode Logs with Ping Activity Vitaly Osipov (Fri Jul 13 2001 - 02:39:28 PDT)
  • Re: Unicode Logs with Ping Activity Vitaly Osipov (Wed Jul 11 2001 - 08:32:11 PDT)
• Worm or rootkit... SirPsychoSexy (Wed Jul 11 2001 - 04:08:19 PDT)
• Re: Subject: Unicode Logs with Ping Activity gattacaat_private (Tue Jul 10 2001 - 11:56:05 PDT)
• Weird UDP trafic Jacques Exelrud (Tue Jul 10 2001 - 11:00:57 PDT)
  • Re: Weird UDP trafic bludclotat_private (Wed Jul 11 2001 - 15:01:52 PDT)
  • Re: Weird UDP trafic Captain James T Kirk (Wed Jul 11 2001 - 14:15:44 PDT)
  • Re: Weird UDP trafic sarnoldat_private (Wed Jul 11 2001 - 13:44:53 PDT)
  • Re: Weird UDP trafic George Bakos (Thu Jul 12 2001 - 17:07:58 PDT)
  • Re: Weird UDP trafic Rajeev Kumar (Thu Jul 12 2001 - 08:38:57 PDT)
• Recent IRC attacks Paul Dokas (Thu Jul 12 2001 - 09:06:55 PDT)
  • Re: Recent IRC attacks adam (Thu Jul 12 2001 - 13:26:23 PDT)
• Denial of service attack on port 6667 vlimaat_private (Thu Jul 12 2001 - 06:22:25 PDT)
  • Re: Denial of service attack on port 6667 John Marquart (Thu Jul 12 2001 - 11:38:33 PDT)
    • Re: Denial of service attack on port 6667 jerat_private (Thu Jul 12 2001 - 21:15:51 PDT)
• SMTP server (How can I find out the real source of an attack) MrG (Thu Jul 12 2001 - 15:53:36 PDT)
  • Re: SMTP server (How can I find out the real source of an attack) Valdis.Kletnieksat_private (Thu Jul 12 2001 - 18:59:32 PDT)
    • Re: SMTP server (How can I find out the real source of an attack) Pavel Kankovsky (Sun Jul 15 2001 - 02:42:00 PDT)
      • Re: SMTP server (How can I find out the real source of an attack Nick FitzGerald (Mon Jul 16 2001 - 16:34:41 PDT)
  • RE: SMTP server (How can I find out the real source of an attack) Mike Batchelor (Fri Jul 13 2001 - 10:45:44 PDT)
  • RE: SMTP server (How can I find out the real source of an attack) Dean Cunningham (Thu Jul 12 2001 - 18:28:12 PDT)
  • Re: SMTP server (How can I find out the real source of an attack) kath (Thu Jul 12 2001 - 17:47:04 PDT)
    • Re: SMTP server (How can I find out the real source of an attack) Mike Lewinski (Fri Jul 13 2001 - 21:55:03 PDT)
• Security Event / Customer Reporting Tyrannis Von Nettesheim (Fri Jul 13 2001 - 08:57:40 PDT)
  • Re: Security Event / Customer Reporting Nick FitzGerald (Fri Jul 13 2001 - 15:44:34 PDT)
  • Re: Security Event / Customer Reporting ethan preston (Fri Jul 13 2001 - 21:15:26 PDT)
  • Re: Security Event / Customer Reporting Aaron Silver (Sat Jul 14 2001 - 06:58:52 PDT)
  • Re: Security Event / Customer Reporting JohnNicholsonat_private (Mon Jul 16 2001 - 10:51:56 PDT)
  • Re: Security Event / Customer Reporting ethan preston (Fri Jul 13 2001 - 21:15:26 PDT)
• RE: strange qmail actions Bojan Zdrnja (Fri Jul 13 2001 - 01:46:42 PDT)
• SANS Org Website James Edwards (Fri Jul 13 2001 - 11:16:53 PDT)
• possible frontpage exploit? John Jetmore (Mon Jul 16 2001 - 14:23:24 PDT)
  • Re: possible frontpage exploit? Bryan Andersen (Mon Jul 16 2001 - 15:59:22 PDT)
  • Re: possible frontpage exploit? Raul Dias (Mon Jul 16 2001 - 15:44:06 PDT)
  • Re: possible frontpage exploit? John Jetmore (Tue Jul 17 2001 - 07:37:01 PDT)
• Attempted WEB-IIS printer attempt Buffer Overflow Jason Robertson (Mon Jul 16 2001 - 18:49:51 PDT)
  • Re: Attempted WEB-IIS printer attempt Buffer Overflow Doug Nelson (Tue Jul 17 2001 - 08:15:05 PDT)
• streams of fragments... Russell Fulton (Mon Jul 16 2001 - 21:56:50 PDT)
  • Re: streams of fragments... Gamble (Wed Jul 18 2001 - 08:23:36 PDT)
    • Re: streams of fragments... Jose Nazario (Wed Jul 18 2001 - 10:10:14 PDT)
      • Re: streams of fragments... Dug Song (Wed Jul 18 2001 - 11:51:52 PDT)
    • Re: streams of fragments... Russell Fulton (Wed Jul 18 2001 - 15:06:32 PDT)
  • Re: streams of fragments... Burak DAYIOGLU (Wed Jul 18 2001 - 05:20:46 PDT)
  • RE: streams of fragments... Portnoy, Gary (Wed Jul 18 2001 - 11:47:09 PDT)
  • RE: streams of fragments... Rich Ostergard (Wed Jul 18 2001 - 15:50:19 PDT)
• Strange web traffic Scott Nursten (Tue Jul 17 2001 - 11:22:43 PDT)
  • Re: Strange web traffic Scott Nursten (Tue Jul 17 2001 - 11:37:57 PDT)
    • Re(2): Strange web traffic Ken Eichman (Tue Jul 17 2001 - 12:49:28 PDT)
  • Re: Strange web traffic Ryan Russell (Tue Jul 17 2001 - 13:03:39 PDT)
• Initial analysis of the .ida "Code Red" Worm aleph1at_private (Tue Jul 17 2001 - 11:43:12 PDT)
  • Re: Initial analysis of the .ida "Code Red" Worm Matt Power (Wed Jul 18 2001 - 11:23:15 PDT)
• [Fwd: Re: Strange web traffic] Scott Nursten (Tue Jul 17 2001 - 11:46:22 PDT)
• DNS poisoning of naive caches, bigred.com search engine Mike Batchelor (Tue Jul 17 2001 - 17:52:44 PDT)
• Packets destined for ports 6970 and 6972 Elliott Perrin (Wed Jul 18 2001 - 08:19:38 PDT)
  • RE: Packets destined for ports 6970 and 6972 Bell, James (AZ76) (Wed Jul 18 2001 - 13:14:09 PDT)
  • RE: Packets destined for ports 6970 and 6972 Bryan Allerdice (Wed Jul 18 2001 - 16:07:59 PDT)
• Http scanning for cgi based mail-relays. measlat_private (Wed Jul 18 2001 - 06:17:03 PDT)
  • Re: Http scanning for cgi based mail-relays. Chip McClure (Wed Jul 18 2001 - 14:02:21 PDT)
    • Re: Http scanning for cgi based mail-relays. David Luyer (Wed Jul 18 2001 - 22:09:09 PDT)
• "Code Red" worm questions w1re p4ir (Wed Jul 18 2001 - 08:43:59 PDT)
  • Re: "Code Red" worm questions Nathan W. Labadie (Wed Jul 18 2001 - 10:13:57 PDT)
  • Re: "Code Red" worm questions Chris Keladis (Wed Jul 18 2001 - 10:37:04 PDT)
  • RE: "Code Red" worm questions Marc Maiffret (Wed Jul 18 2001 - 10:46:53 PDT)
    • RE: "Code Red" worm questions Johannes B. Ullrich (Wed Jul 18 2001 - 12:10:48 PDT)
      • RE: "Code Red" worm questions Marc Maiffret (Wed Jul 18 2001 - 13:30:41 PDT)
      • RE: "Code Red" worm questions Eric Chien (Thu Jul 19 2001 - 04:13:46 PDT)
  • Re: "Code Red" worm questions Brian McWilliams (Wed Jul 18 2001 - 11:54:14 PDT)
• IIS/FrontPage Script? McCammon, Keith (Wed Jul 18 2001 - 14:17:41 PDT)
• Full analysis of the .ida "Code Red" worm. aleph1at_private (Wed Jul 18 2001 - 23:17:51 PDT)
  • Re: Full analysis of the .ida "Code Red" worm. corecode (Thu Jul 19 2001 - 11:09:07 PDT)
    • RE: Full analysis of the .ida "Code Red" worm. Marc Maiffret (Thu Jul 19 2001 - 16:14:15 PDT)
• Anyone interested in full tcpdump trace of a Code Red breakin ? Arthur Donkers (Thu Jul 19 2001 - 12:21:31 PDT)
• The Code Red list GROWS! Colby Rice (Thu Jul 19 2001 - 13:37:18 PDT)
• Code Red Antonio Stano (Thu Jul 19 2001 - 08:14:21 PDT)
  • Code Red Alfred Huger (Tue Jul 31 2001 - 21:02:49 PDT)
• CodeRed Ryan Russell (Thu Jul 19 2001 - 14:17:56 PDT)
  • Re: CodeRed Ryan Russell (Thu Jul 19 2001 - 18:08:44 PDT)
    • Re: CodeRed Ryan Russell (Thu Jul 19 2001 - 20:50:53 PDT)
    • RE: CodeRed Ivan (Thu Jul 19 2001 - 20:30:08 PDT)
  • Re: CodeRed Ryan Russell (Thu Jul 19 2001 - 23:57:50 PDT)
  • Re: CodeRed James T Kirk (Fri Jul 20 2001 - 10:18:25 PDT)
  • CodeRed terminatorat_private (Fri Jul 20 2001 - 12:40:47 PDT)
    • RE: CodeRed Fulton L. Preston Jr. (Thu Jul 19 2001 - 20:25:22 PDT)
    • RE: CodeRed Tulchinskiy, Sasha (Fri Jul 20 2001 - 06:45:24 PDT)
      • SIRCAM WORM? borakovej (Mon Jul 23 2001 - 13:29:27 PDT)
      • RE: SIRCAM WORM? Tony Spurlin (Tue Jul 24 2001 - 08:03:27 PDT)
      • Re: SIRCAM WORM? acz [iSecureLabs] (Tue Jul 24 2001 - 08:04:14 PDT)
• Jetdirect card Attack??? James Edwards (Thu Jul 19 2001 - 10:07:09 PDT)
  • Re: Jetdirect card Attack???--Followup James Edwards (Thu Jul 19 2001 - 11:09:35 PDT)
    • Re: Jetdirect card Attack???--Followup kawaii (Fri Jul 20 2001 - 06:53:30 PDT)
  • Re: Jetdirect card Attack??? Ryan Russell (Thu Jul 19 2001 - 17:30:30 PDT)
    • RE: Jetdirect card Attack??? fuzzz (Thu Jul 19 2001 - 20:27:43 PDT)
      • Jetdirect card Attack???-Final from original poster James Edwards (Fri Jul 20 2001 - 10:45:54 PDT)
      • Re: Jetdirect card Attack???-Final from original poster Gary Flynn (Fri Jul 20 2001 - 13:32:09 PDT)
  • Re: Jetdirect card Attack??? Brendan Murphy (Thu Jul 19 2001 - 16:42:29 PDT)
  • Re: Jetdirect card Attack??? Bojan Zdravkovic (Thu Jul 19 2001 - 17:00:42 PDT)
  • Re: Jetdirect card Attack??? Gary Flynn (Thu Jul 19 2001 - 17:27:50 PDT)
• HTTP connections Gillard, Paul (Thu Jul 19 2001 - 10:22:36 PDT)
  • RE: HTTP connections Dean Cunningham (Thu Jul 19 2001 - 18:15:37 PDT)
    • RE: HTTP connections Ryan Russell (Thu Jul 19 2001 - 20:17:32 PDT)
  • Re: HTTP connections Chris Freeze (Thu Jul 19 2001 - 16:38:23 PDT)
  • Re: HTTP connections Ryan Russell (Thu Jul 19 2001 - 16:39:35 PDT)
    • Other China Hack Attempts Concurrent With Code Red David E. Weekly (Thu Jul 19 2001 - 21:03:06 PDT)
  • RE: HTTP connections Lindsay (Sun Jul 22 2001 - 14:26:26 PDT)
• .ida Intrusion Attempt Joe Smith (Thu Jul 19 2001 - 09:18:20 PDT)
  • Re: .ida Intrusion Attempt Martin Roesch (Thu Jul 19 2001 - 10:11:54 PDT)
    • Re: .ida Intrusion Attempt Joe Smith (Thu Jul 19 2001 - 10:55:10 PDT)
  • RE: .ida Intrusion Attempt Keith.Morgan (Thu Jul 19 2001 - 10:58:25 PDT)
  • RE: .ida Intrusion Attempt Tulchinskiy, Sasha (Thu Jul 19 2001 - 11:19:30 PDT)
    • Re: .ida Intrusion Attempt Sebastian Ip (Thu Jul 19 2001 - 16:34:02 PDT)
      • Re: .ida Intrusion Attempt Kheos ml (Thu Jul 19 2001 - 20:27:09 PDT)
  • RE: .ida Intrusion Attempt Yom, Francis (Thu Jul 19 2001 - 11:08:34 PDT)
  • Re: .ida Intrusion Attempt Dr SuSE (Thu Jul 19 2001 - 10:24:36 PDT)
    • Re: .ida Intrusion Attempt bugtraq (Thu Jul 19 2001 - 08:37:55 PDT)
  • RE: .ida Intrusion Attempt Colby Rice (Thu Jul 19 2001 - 10:29:25 PDT)
    • RE: .ida Intrusion Attempt Tim Winders (Thu Jul 19 2001 - 16:43:57 PDT)
  • RE: .ida Intrusion Attempt Ulrich Keil (Thu Jul 19 2001 - 16:34:03 PDT)
  • Re: .ida Intrusion Attempt Russell Fulton (Thu Jul 19 2001 - 17:48:14 PDT)
    • Re: .ida Intrusion Attempt Stuart Staniford (Thu Jul 19 2001 - 20:48:04 PDT)
      • Re: .ida Intrusion Attempt E. Larry Lidz (Fri Jul 20 2001 - 06:53:36 PDT)
      • Re: .ida Intrusion Attempt Kyle R Maxwell (Fri Jul 20 2001 - 09:55:36 PDT)
• slice3 question Dirk Brockhausen (Thu Jul 19 2001 - 16:02:39 PDT)
  • RE: slice3 question Royans Tharakan (Thu Jul 19 2001 - 17:01:44 PDT)
  • RE: slice3 question Maher Odeh (Sun Jul 22 2001 - 01:52:47 PDT)
• Host Unreachable Scan Penn, Toby (IT.Ops Security Services) (Thu Jul 19 2001 - 18:00:10 PDT)
  • Re: Host Unreachable Scan Ian Jones (Thu Jul 19 2001 - 20:25:13 PDT)
• RE: Jetdirect card Attack???--Followup Dean Cunningham (Thu Jul 19 2001 - 17:59:29 PDT)
• Possible CodeRed Connection Attempts dave.goldsmithat_private (Fri Jul 20 2001 - 05:42:13 PDT)
  • RE: Possible CodeRed Connection Attempts Gregory_DeGennaroat_private (Fri Jul 20 2001 - 07:55:49 PDT)
  • Re: Possible CodeRed Connection Attempts Ken Eichman (Fri Jul 20 2001 - 08:12:01 PDT)
  • Re: Possible CodeRed Connection Attempts Ken Eichman (Fri Jul 20 2001 - 08:12:01 PDT)
• Code-Red: An analytic model of its spread Stuart Staniford (Fri Jul 20 2001 - 00:48:30 PDT)
  • Re: Code-Red: An analytic model of its spread Stuart Staniford (Fri Jul 20 2001 - 10:48:30 PDT)
• 'Code Red' list. Colby Rice (Fri Jul 20 2001 - 07:54:17 PDT)
  • RE: 'Code Red' list. Colby Rice (Fri Jul 20 2001 - 09:26:04 PDT)
• Forwarded: Re: Possible CodeRed Connection Attempts Ken Eichman (Fri Jul 20 2001 - 08:15:56 PDT)
• Code Red Worm, New information Alfred Huger (Fri Jul 20 2001 - 12:34:52 PDT)
  • Code Red Worm, New information Alfred Huger (Fri Jul 20 2001 - 12:34:52 PDT)
  • RE: Code Red Worm, New information Pat Moffitt (Fri Jul 20 2001 - 15:48:59 PDT)
• Proxy-Based .ida / .idq scanning tool available Kelvin (Fri Jul 20 2001 - 11:18:31 PDT)
• Re: CodeRed: the next generation Stuart Staniford (Fri Jul 20 2001 - 12:26:43 PDT)
  • Re: CodeRed: the next generation Stuart Staniford (Fri Jul 20 2001 - 12:26:43 PDT)
• Code Red worm address generator pattern Ken Eichman (Fri Jul 20 2001 - 12:34:47 PDT)
• CRv2 - Questions The Death (Fri Jul 20 2001 - 14:40:31 PDT)
  • Re: CRv2 - Questions Nick FitzGerald (Sat Jul 21 2001 - 16:42:58 PDT)
    • RE: CRv2 - Questions The Death (Sat Jul 21 2001 - 18:38:23 PDT)
      • Re: CRv2 - Questions Steffen Dettmer (Mon Jul 23 2001 - 02:39:47 PDT)
      • RE: CRv2 - Questions The Death (Mon Jul 23 2001 - 08:01:35 PDT)
      • RE: CRv2 - Questions Jose Nazario (Mon Jul 23 2001 - 12:31:49 PDT)
      • Re: CRv2 - Questions Ronald Tse (Mon Jul 23 2001 - 21:31:06 PDT)
      • RE: CRv2 - Questions The Death (Tue Jul 24 2001 - 14:07:24 PDT)
• Re: RED-CODE WORM PATCH possibly not working ???? fyom (Fri Jul 20 2001 - 15:17:44 PDT)
• ANOTHER possible Windows problem? David Bernick (Fri Jul 20 2001 - 13:15:21 PDT)
  • Re: ANOTHER possible Windows problem? Kris Carlier (Sun Jul 22 2001 - 04:40:47 PDT)
  • RE: ANOTHER possible Windows problem? Powers, James L. (Sat Jul 21 2001 - 18:08:52 PDT)
  • RE: ANOTHER possible Windows problem? Sander de Rijk (Sun Jul 22 2001 - 11:53:50 PDT)
  • Guess this is a hack attemp Gareth Hastings (Sun Jul 22 2001 - 00:46:01 PDT)
    • RE: Guess this is a hack attemp Chip McClure (Sun Jul 22 2001 - 14:09:26 PDT)
    • Re: Guess this is a hack attemp Alvin Oga (Sun Jul 22 2001 - 17:39:46 PDT)
• My list of default.ida connection attempts Sean Kelly (Sat Jul 21 2001 - 14:57:46 PDT)
  • Re: My list of default.ida connection attempts Vern Paxson (Sun Jul 22 2001 - 13:20:31 PDT)
    • Wide-scale Code Red Damage Assessment and Report Jon O . (Sun Jul 22 2001 - 14:50:53 PDT)
    • Re: My list of default.ida connection attempts Vern Paxson (Sun Jul 22 2001 - 18:03:24 PDT)
    • Wide-scale Code Red Damage Assessment and Report Jon O . (Sun Jul 22 2001 - 14:50:53 PDT)
• "datapool is a DoS attacks kit" message steve (Sun Jul 22 2001 - 14:11:41 PDT)
  • Re: "datapool is a DoS attacks kit" message Daniel Martin (Sun Jul 22 2001 - 18:22:11 PDT)
• Code Red Worm, closing notes Alfred Huger (Sun Jul 22 2001 - 18:35:22 PDT)
  • Code Red Worm, closing notes Alfred Huger (Sun Jul 22 2001 - 18:35:22 PDT)
• code red - some questions Soeren Ziehe (Mon Jul 23 2001 - 05:03:00 PDT)
  • Re: code red - some questions Bronek Kozicki (Mon Jul 23 2001 - 08:44:42 PDT)
  • Re: code red - some questions Nick FitzGerald (Mon Jul 23 2001 - 07:16:14 PDT)
  • Re: code red - some questions Soeren Ziehe (Tue Jul 24 2001 - 03:23:00 PDT)
• Code Red packet dumps. Yotam Rubin (Mon Jul 23 2001 - 07:13:06 PDT)
  • Re: Code Red packet dumps. L. Christopher Paul (Mon Jul 23 2001 - 11:03:38 PDT)
• Re: JetDirect Card Attack Brian Eckman (Mon Jul 23 2001 - 09:52:06 PDT)
• Peak Activity of Red Worm? Tim Brown (Mon Jul 23 2001 - 11:19:30 PDT)
  • Re: Peak Activity of Red Worm? Ryan Russell (Mon Jul 23 2001 - 13:11:24 PDT)
• IPP (631/tcp) Scans Crist Clark (Mon Jul 23 2001 - 17:25:58 PDT)
• GET x HTTP/1.0 Greg Owen (Mon Jul 23 2001 - 18:19:53 PDT)
  • Re: GET x HTTP/1.0 Phil Sorber (Mon Jul 23 2001 - 21:40:10 PDT)
  • Re: GET x HTTP/1.0 jlewisat_private (Mon Jul 23 2001 - 21:40:04 PDT)
  • Re: GET x HTTP/1.0 John (Tue Jul 24 2001 - 22:02:31 PDT)
    • Re: GET x HTTP/1.0 Seth Milder (Tue Jul 24 2001 - 08:10:25 PDT)
  • Re: GET x HTTP/1.0 Ross Oldbury (Tue Jul 24 2001 - 01:53:36 PDT)
  • Re: GET x HTTP/1.0 dr john halewood (Tue Jul 24 2001 - 08:22:34 PDT)
  • RE: GET x HTTP/1.0 Portnoy, Gary (Tue Jul 24 2001 - 08:31:05 PDT)
  • Re: GET x HTTP/1.0 Patryk Chmielewski (Tue Jul 24 2001 - 08:08:15 PDT)
• Re: "Code Red" worm - there MUST be at least two versions. Ilya Zherebetskiy (Mon Jul 23 2001 - 16:30:32 PDT)
• Weird Web Requests Jonathan A. Zdziarski (Mon Jul 23 2001 - 14:37:03 PDT)
  • Re: Weird Web Requests Michael DeSimone (Mon Jul 23 2001 - 21:59:56 PDT)
  • RE: Weird Web Requests Ryan McDonnell (Tue Jul 24 2001 - 00:43:38 PDT)
• cisco local director DOS. Bill Robbins (Tue Jul 24 2001 - 08:12:57 PDT)
• telnetd bug Alin Bontas (Tue Jul 24 2001 - 11:37:46 PDT)
  • Re: telnetd bug matt sommer (Tue Jul 24 2001 - 12:58:02 PDT)
• Beta Testers Needed Alfred Huger (Tue Jul 24 2001 - 12:42:13 PDT)
• Xprobe 0.0.1p1 Ofir Arkin (Tue Jul 24 2001 - 13:05:05 PDT)
• New version of Code Red? Dean Cunningham (Tue Jul 24 2001 - 15:02:25 PDT)
  • Re: New version of Code Red? Jim Forster (Tue Jul 24 2001 - 15:24:53 PDT)
  • RE: New version of Code Red? Nick Lehman (Tue Jul 24 2001 - 19:43:08 PDT)
    • Re: New version of Code Red? sleonard (Tue Jul 24 2001 - 22:47:35 PDT)
• *BSD Telnetd John (Wed Jul 25 2001 - 16:21:57 PDT)
  • Re: *BSD Telnetd John (Thu Jul 26 2001 - 16:02:03 PDT)
• Honeynet Project -> Know Your Enemy: Statistics Lance Spitzner (Tue Jul 24 2001 - 18:57:16 PDT)
• New Snort Signatures/ TESO Telnetd Overflow Alfred Huger (Tue Jul 24 2001 - 21:30:00 PDT)
• IIS Directory traversal vulnerability Lee Evans (Wed Jul 25 2001 - 02:34:33 PDT)
  • Re: IIS Directory traversal vulnerability Joe Smith (Wed Jul 25 2001 - 10:12:01 PDT)
    • Re: IIS Directory traversal vulnerability Jordan K Wiens (Wed Jul 25 2001 - 12:31:02 PDT)
    • Re: IIS Directory traversal vulnerability Jon Zobrist (Wed Jul 25 2001 - 14:21:28 PDT)
  • RE: IIS Directory traversal vulnerability Bryan Allerdice (Wed Jul 25 2001 - 13:19:28 PDT)
  • Re: IIS Directory traversal vulnerability Lee Evans (Thu Jul 26 2001 - 01:25:27 PDT)
• tcpdump traces of CodeRed (lab environment) lcpat_private (Wed Jul 25 2001 - 04:42:14 PDT)
  • Re: tcpdump traces of CodeRed (lab environment) Stuart Staniford (Wed Jul 25 2001 - 10:28:43 PDT)
  • Correction: Re: tcpdump traces of CodeRed (lab environment) L. Christopher Paul (Thu Jul 26 2001 - 04:56:27 PDT)
    • Re: Correction: Re: tcpdump traces of CodeRed (lab environment) L. Christopher Paul (Fri Jul 27 2001 - 05:43:20 PDT)
• Telnet scans Keith.Morgan (Wed Jul 25 2001 - 07:06:45 PDT)
• weird sequence in packet filter log Tobias Diedrich (Wed Jul 25 2001 - 07:12:24 PDT)
  • Re: weird sequence in packet filter log George Bakos (Wed Jul 25 2001 - 05:15:20 PDT)
• Tracking SirCam Peter Krawczyk (Wed Jul 25 2001 - 09:49:05 PDT)
  • Re: Tracking SirCam Don Hammond (Wed Jul 25 2001 - 12:11:39 PDT)
  • Re: Tracking SirCam Greg A. Woods (Wed Jul 25 2001 - 12:28:11 PDT)
    • Re: Tracking SirCam Nick FitzGerald (Wed Jul 25 2001 - 15:58:42 PDT)
  • Re: Tracking SirCam Gary Flynn (Wed Jul 25 2001 - 13:31:25 PDT)
    • Re: Tracking SirCam Nick FitzGerald (Wed Jul 25 2001 - 15:47:43 PDT)
• Network attack from S1 Corporation Kelvin (Wed Jul 25 2001 - 11:35:23 PDT)
  • Re: Network attack from S1 Corporation Kelvin (Thu Jul 26 2001 - 12:20:09 PDT)
    • Re: Network attack from S1 Corporation H C (Thu Jul 26 2001 - 13:38:28 PDT)
      • Re: Network attack from S1 Corporation Kelvin (Thu Jul 26 2001 - 16:54:39 PDT)
• Re: IIS Directory traversal vulnerability Reverend Lola (Wed Jul 25 2001 - 12:25:58 PDT)
• TCP probe on port 35540 from port 1 Paul Gear (Wed Jul 25 2001 - 14:22:50 PDT)
  • RE: TCP probe on port 35540 from port 1 Kester, Kelly (Thu Jul 26 2001 - 09:52:45 PDT)
• Is this a traceroute? Ford Prefect (Wed Jul 25 2001 - 20:31:23 PDT)
  • Re: Is this a traceroute? Blake Frantz (Thu Jul 26 2001 - 09:31:12 PDT)
• DNS Poisoning? FSS (Wed Jul 25 2001 - 20:56:29 PDT)
• MISC Large ICMP Packet Chris Hobbs (Thu Jul 26 2001 - 07:12:46 PDT)
  • Re: MISC Large ICMP Packet Opus (Thu Jul 26 2001 - 09:43:34 PDT)
    • Re: MISC Large ICMP Packet Chris Hobbs (Thu Jul 26 2001 - 09:52:10 PDT)
  • Re: MISC Large ICMP Packet Valdis.Kletnieksat_private (Thu Jul 26 2001 - 09:34:40 PDT)
• code red - c:\notworm Soeren Ziehe (Thu Jul 26 2001 - 09:38:00 PDT)
  • Re: code red - c:\notworm Jon Zobrist (Thu Jul 26 2001 - 09:24:40 PDT)
  • Re: code red - c:\notworm Soeren Ziehe (Sun Jul 29 2001 - 08:00:00 PDT)
• Subject: New Policy for the Incidents mailing list Alfred Huger (Thu Jul 26 2001 - 09:06:00 PDT)
• Cobalt Scan Ryan W. Maple (Thu Jul 26 2001 - 10:04:00 PDT)
  • RE: Cobalt Scan Jeroen Wesbeek (Fri Jul 27 2001 - 00:55:46 PDT)
    • RE: Cobalt Scan Sven Carstens (Mon Jul 30 2001 - 02:55:52 PDT)
      • RE: Cobalt Scan Tom Laermans (Mon Jul 30 2001 - 11:18:29 PDT)
• Vulernability in /cgi-bin/shopper.exe? Michael Katz (Thu Jul 26 2001 - 12:38:13 PDT)
  • Re: Vulernability in /cgi-bin/shopper.exe? David Kennedy CISSP (Fri Jul 27 2001 - 00:30:56 PDT)
• (Fwd) RE: logs George Bakos (Thu Jul 26 2001 - 08:34:15 PDT)
• Sneaky vuln-scanning, vulnerable list generation Keith.Morgan (Fri Jul 27 2001 - 10:08:34 PDT)
• BSDi telnetd exploitable... Sean Chittenden (Fri Jul 27 2001 - 14:34:14 PDT)
• ACB8DE69.ipt.aol.com scans Dino (Sat Jul 28 2001 - 05:48:51 PDT)
• Network Attack on my Home PC. Is it related to Kelvin at SEC33, You be the the judge... masterpat_private (Sat Jul 28 2001 - 12:58:57 PDT)
• Port 119 Scans Tom Laermans (Fri Jul 27 2001 - 13:58:53 PDT)
  • Re: Port 119 Scans Richard Johnson (Sun Jul 29 2001 - 11:00:12 PDT)
  • Re: Port 119 Scans Andreas Hasenack (Sun Jul 29 2001 - 11:18:52 PDT)
  • Re: Port 119 Scans Gary Maltzen (Tue Jul 31 2001 - 05:43:28 PDT)
    • Re: Port 119 Scans denis (Tue Jul 31 2001 - 10:16:41 PDT)
• Sec33.com etc. Bad moderation Alfred Huger (Sun Jul 29 2001 - 09:48:26 PDT)
• Unusual IIS decode requests Jason Robertson (Sun Jul 29 2001 - 13:59:14 PDT)
  • Re: Unusual IIS decode requests Thomas M. Ferris (Sun Jul 29 2001 - 21:42:52 PDT)
• Code Red and ISS Internet Scanner Mike Peterson (Mon Jul 30 2001 - 06:37:24 PDT)
  • Re: Code Red and ISS Internet Scanner Aj Effin Reznor (Tue Jul 31 2001 - 09:34:26 PDT)
  • RE: Code Red and ISS Internet Scanner Johnston, Jack (Tue Jul 31 2001 - 11:49:32 PDT)
• GET /BIBA.IDA Tulchinskiy, Sasha (Mon Jul 30 2001 - 09:49:54 PDT)
• RE: Increase in Sub7 scans h8macsat_private (Mon Jul 30 2001 - 10:55:44 PDT)
• Mail Issue Stephen Malenshek (Sun Jul 29 2001 - 19:55:27 PDT)
  • Re: Mail Issue Charles_Ebingerat_private (Mon Jul 30 2001 - 11:44:50 PDT)
  • Re: Mail Issue Harri Nyman (Mon Jul 30 2001 - 11:51:26 PDT)
  • Re: Mail Issue Gary Maltzen (Tue Jul 31 2001 - 05:28:33 PDT)
• .baa0xdd1r?? SecLists (Mon Jul 30 2001 - 08:48:05 PDT)
  • Re: .baa0xdd1r?? Bill Burge (Mon Jul 30 2001 - 14:08:48 PDT)
  • Re: .baa0xdd1r?? Lance Spitzner (Mon Jul 30 2001 - 13:08:17 PDT)
• The sky is falling, or so I am told. Alfred Huger (Mon Jul 30 2001 - 15:50:20 PDT)
  • Re: The sky is falling, or so I am told. Wichert Akkerman (Mon Jul 30 2001 - 16:19:40 PDT)
  • Re: The sky is falling, or so I am told. Wayne Conrad (Mon Jul 30 2001 - 17:44:51 PDT)
  • Re: The sky is falling, or so I am told. Pluto (Tue Jul 31 2001 - 04:20:00 PDT)
• Large ISP response to Code Red? Jon O . (Mon Jul 30 2001 - 17:21:09 PDT)
  • Re: Large ISP response to Code Red? Christian Kuhtz (Mon Jul 30 2001 - 17:45:50 PDT)
    • Re: Large ISP response to Code Red? David Hickman (Tue Jul 31 2001 - 08:49:13 PDT)
  • Re: Large ISP response to Code Red? Seth Arnold (Mon Jul 30 2001 - 17:54:43 PDT)
    • Re: Large ISP response to Code Red? Mike Johnson (Tue Jul 31 2001 - 05:39:02 PDT)
      • Re: Large ISP response to Code Red? Kris Carlier (Tue Jul 31 2001 - 09:53:54 PDT)
      • RE: Large ISP response to Code Red? Jonathan A. Zdziarski (Tue Jul 31 2001 - 10:04:59 PDT)
    • Re: Large ISP response to Code Red? Rob McCauley (Tue Jul 31 2001 - 07:23:11 PDT)
    • Re: Large ISP response to Code Red? Valdis.Kletnieksat_private (Mon Jul 30 2001 - 19:36:15 PDT)
  • Re: Large ISP response to Code Red? kath (Mon Jul 30 2001 - 21:10:43 PDT)
  • Re: Large ISP response to Code Red? Mike Lewinski (Mon Jul 30 2001 - 19:40:21 PDT)
  • Re: Large ISP response to Code Red? Blake Frantz (Tue Jul 31 2001 - 08:10:35 PDT)
  • RE: Large ISP response to Code Red? Jonathan A. Zdziarski (Tue Jul 31 2001 - 11:57:18 PDT)
    • Re: Large ISP response to Code Red? Seth Arnold (Tue Jul 31 2001 - 15:37:08 PDT)
• TCP port 6346 Dean Cunningham (Mon Jul 30 2001 - 22:44:04 PDT)
  • Re: TCP port 6346 Harri Nyman (Tue Jul 31 2001 - 10:29:24 PDT)
• Incident Response Desmond Irvine (Tue Jul 31 2001 - 08:06:32 PDT)
• Possible trojaned wlogon.exe? Thompson, John J (Tue Jul 31 2001 - 11:09:22 PDT)
  • Re: Possible trojaned wlogon.exe? Jim Zajkowski (Tue Jul 31 2001 - 17:21:30 PDT)
• CRv3? Or some other ida type Mike Baptiste (Tue Jul 31 2001 - 15:23:33 PDT)
  • Re: CRv3? Or some other ida type Jim Forster (Tue Jul 31 2001 - 16:04:32 PDT)
• UPDATED: Cisco Security Advisory: "Code Red" Worm - Customer Impact Cisco Systems Product Security Incident Response Team (Tue Jul 31 2001 - 13:00:00 PDT)
• Code Red, anyone? Alfred Huger (Tue Jul 31 2001 - 18:31:01 PDT)
  • Re: Code Red, anyone? Glenn Forbes Fleming Larratt (Tue Jul 31 2001 - 19:31:37 PDT)
  • Re: Code Red, anyone? S. Staniford (Tue Jul 31 2001 - 20:06:22 PDT)

Last message date: Tue Jul 31 2001 - 21:05:32 PDT
Archived on: Tue Jul 31 2001 - 21:05:33 PDT

This archive was generated by hypermail 2b30 : Tue Jul 31 2001 - 21:05:33 PDT