incidents 2003/02
By Author

Starting: Sun Feb 02 2003 - 08:36:10 PST
Ending: Tue Mar 04 2003 - 07:44:08 PST

• Alberto Cozer
  • Re: Web Defacement (Mon Feb 17 2003 - 10:56:25 PST)
• Alexander Reelsen
  • webserver probes for php detection (Thu Feb 13 2003 - 05:10:03 PST)
• Alfred Huger
  • The 4 line ad at the bottom of this post.. (Wed Feb 12 2003 - 16:32:12 PST)
• Anders Reed Mohn
  • RE: ALEVRIUS! (Tue Feb 11 2003 - 08:41:23 PST)
  • RE: ALEVRIUS! (Fri Feb 07 2003 - 04:06:47 PST)
• Anders Thulin
  • Re: Weird Profile in Documents and Settings (Fri Feb 21 2003 - 00:20:27 PST)
  • Re: ICMP Destination Unreachable, Administratively Prohibited (Thu Feb 13 2003 - 23:12:18 PST)
• Andy Bastien
  • Re: email address probes (Fri Feb 07 2003 - 09:16:53 PST)
  • email address probes (Wed Feb 05 2003 - 12:54:19 PST)
• Anthony Kim
  • Re: ICMP Destination Unreachable, Administratively Prohibited (Fri Feb 14 2003 - 08:02:41 PST)
• Austin Ehlers
  • RE: Weird Profile in Documents and Settings (Fri Feb 21 2003 - 20:14:48 PST)
• Axel Beckert - ecos gmbh
  • Re: email address probes (Thu Feb 06 2003 - 09:30:15 PST)
• Baklarz, Ron
  • RE: Increased Kuang2 activity (Mon Feb 10 2003 - 12:01:54 PST)
• bob
  • Re: ICQ problem. (Fri Feb 21 2003 - 20:01:19 PST)
• Bojan Zdrnja
  • Re: Weird Windows logon attempts (Mon Feb 24 2003 - 01:07:55 PST)
• Boyan Krosnov
  • RE: FTP/Port 1038 (Tue Feb 04 2003 - 14:26:41 PST)
• Brad Arlt
  • Re: email address probes (Fri Feb 07 2003 - 09:29:02 PST)
  • Re: email address probes (Wed Feb 05 2003 - 14:26:12 PST)
• Brad Griffin
  • RE: www.nopop.net (Mon Feb 17 2003 - 14:27:01 PST)
• Brenna Primrose
  • RE: Suspicious file on Desktop (Mon Feb 10 2003 - 13:12:24 PST)
• Carmen Tache
  • RE: Weird apache logs (Wed Feb 26 2003 - 11:09:43 PST)
• Charles Hamby
  • TCP 445 Scan? (Thu Feb 27 2003 - 10:25:29 PST)
• Chris Brenton
  • Re: ICMP Destination Unreachable, Administratively Prohibited (Thu Feb 13 2003 - 15:26:46 PST)
• Christian Vogel
  • Re: Packets from 255.255.255.255(80) (was: Packet from port 80 with spoofed microsoft.com ip) (Tue Feb 04 2003 - 10:46:33 PST)
• Christopher Hummert
  • RE: Weird Profile in Documents and Settings (Sat Feb 22 2003 - 13:36:58 PST)
• Christopher Lyon
  • S4T4N1C Web Defacement (Thu Feb 13 2003 - 00:23:40 PST)
• Christopher Wagner
  • Spammers? (Thu Feb 27 2003 - 10:11:08 PST)
• Chuck Swiger
  • Re: logfiles of openssl-0.9.6e + GET_CLIENT_HELLO exploit... (Tue Feb 11 2003 - 19:00:01 PST)
  • logfiles of openssl-0.9.6e + GET_CLIENT_HELLO exploit... (Mon Feb 10 2003 - 16:45:53 PST)
• D.C. van Moolenbroek
  • Re: More /sumthin (Wed Feb 26 2003 - 16:59:08 PST)
• Dan Hanson
  • Incident Focus Area Article Announcement (Tue Feb 25 2003 - 16:14:22 PST)
  • Dead thread -- Distributed spam-based DoS in progress (Wed Feb 19 2003 - 19:46:18 PST)
  • Incidents list administrivia and introductions... (Sat Feb 15 2003 - 16:13:42 PST)
• Dan Harpold
  • RE: Web server crashed, now is trying to contact an IP by port 80 every morning. (Mon Feb 24 2003 - 17:19:38 PST)
• Dan Perez
  • RE: S4T4N1C Web Defacement (Thu Feb 13 2003 - 12:40:06 PST)
• Dave Aitel
  • Re: Scans on TCP port 135 (Fri Feb 21 2003 - 14:00:59 PST)
• Dave Hart
  • RE: Distributed spam-based DoS in progress (Tue Feb 18 2003 - 23:26:37 PST)
  • RE: Distributed spam-based DoS in progress (Tue Feb 18 2003 - 11:28:30 PST)
• Dave Laird
  • Re: email address probes (Wed Feb 05 2003 - 23:57:41 PST)
• davecat_private
  • RE: Increased Kuang2 activity (Mon Feb 10 2003 - 09:13:00 PST)
• David Hodges
  • Re: ftp server compromised (Wed Feb 12 2003 - 19:33:18 PST)
• Denis Dimick
  • RE: ftp server compromised (Wed Feb 12 2003 - 21:45:35 PST)
• Eric Greenberg
  • Correction: www.ethereal.com not www.ethereal.org RE: Suspicious file on Desktop (Mon Feb 10 2003 - 13:34:09 PST)
  • RE: Suspicious file on Desktop (Mon Feb 10 2003 - 08:54:58 PST)
• Fitzgerald, John
  • RE: Packets from 255.255.255.255(80) (was: Packet from port 80 wi th spoofed microsoft.com ip) (Wed Feb 05 2003 - 01:44:38 PST)
  • RE: Packets from 255.255.255.255(80) (was: Packet from port 80 wi th spoofed microsoft.com ip) (Wed Feb 05 2003 - 01:51:14 PST)
• Frederic Harster
  • Re: Packets from 255.255.255.255(80) (was: Packet from port 80 with spoofed microsoft.com ip) (Mon Feb 03 2003 - 07:56:23 PST)
• Geert Kiers
  • ALEVRIUS! (Thu Feb 06 2003 - 10:39:28 PST)
  • Re: Packets from 255.255.255.255(80) (was: Packet from port 80 with spoofed microsoft.com ip) (Sun Feb 02 2003 - 09:45:32 PST)
• Gene Yoo
  • Re: Weird Profile in Documents and Settings (Thu Feb 20 2003 - 19:34:40 PST)
• Gordon Ewasiuk
  • Questions: LKM, yoyo & rootkits (Fri Feb 21 2003 - 05:31:43 PST)
• Greg A. Woods
  • Re: email address probes (Wed Feb 05 2003 - 15:04:44 PST)
• Greg Wiedeman
  • Weird Profile in Documents and Settings (Thu Feb 20 2003 - 03:38:16 PST)
• Guy Reisenauer
  • Re: Packets from 255.255.255.255(80) (Sun Feb 02 2003 - 12:27:04 PST)
• H C
  • Re: UDP traffic on Port 52798 (Thu Feb 13 2003 - 10:32:33 PST)
  • Re: Netbios Name Scans/opaserv worm (Thu Feb 06 2003 - 14:02:50 PST)
  • Re: DoS Attacks, Detecting the Source, and Service Providers (Tue Feb 04 2003 - 12:44:06 PST)
• H D Moore
  • Re: /sumthin Revisited (Sat Feb 01 2003 - 12:59:50 PST)
• Hamid
  • DoS Attacks, Detecting the Source, and Service Providers (Mon Feb 03 2003 - 13:39:32 PST)
• HggdH
  • Re: S4T4N1C Web Defacement (Thu Feb 13 2003 - 11:43:11 PST)
• Holstein, Michael
  • Remote Access Software (Wireless Devices) (Tue Feb 25 2003 - 10:00:00 PST)
• Hoof Hearted
  • FTP/Port 1038 (Tue Feb 04 2003 - 10:49:55 PST)
• http-equivat_private
  • Interesting (Wed Feb 26 2003 - 12:01:34 PST)
• Hugo van der Kooij
  • RE: Distributed spam-based DoS in progress (Tue Feb 18 2003 - 22:49:55 PST)
  • Re: Distributed spam-based DoS in progress (Mon Feb 17 2003 - 22:48:20 PST)
  • Re: Packets from 255.255.255.255(80) (was: Packet from port 80 with spoofed microsoft.com ip) (Sun Feb 02 2003 - 09:33:12 PST)
• Hulio Cortez
  • Re: Packet from port 80 with spoofed microsoft.com ip (Fri Jan 31 2003 - 13:59:25 PST)
• Jacco Tunnissen
  • Re: Weird Windows logon attempts (Sun Feb 23 2003 - 19:08:42 PST)
• james
  • Re: email address probes (Thu Feb 06 2003 - 09:49:09 PST)
  • Re: DoS Attacks, Detecting the Source, and Service Providers (Tue Feb 04 2003 - 10:35:53 PST)
• James C Slora Jr
  • RE: Increased Kuang2 activity (Mon Feb 10 2003 - 13:35:52 PST)
  • RE: Increased Kuang2 activity (Mon Feb 10 2003 - 12:42:53 PST)
  • RE: ALEVRIUS! (Thu Feb 06 2003 - 15:43:51 PST)
• James Kelly
  • RE: Packets from 255.255.255.255(80) (was: Packet from port 80 with spoofed microsoft.com ip) (Tue Feb 04 2003 - 10:26:56 PST)
• Jasmine
  • Re: Kuang2 strikes again, is it just me? (Sun Feb 16 2003 - 06:00:48 PST)
• Jason Dixon
  • RE: Increased Kuang2 activity (Mon Feb 10 2003 - 08:57:24 PST)
  • Increased Kuang2 activity (Sun Feb 09 2003 - 16:01:23 PST)
• Jeff
  • Re: Kuang2 strikes again, is it just me? (Sun Feb 16 2003 - 09:39:10 PST)
• Jeff Kell
  • Kuang2 strikes again, is it just me? (Sat Feb 15 2003 - 17:35:02 PST)
  • Kuang2 on the rise... (Sat Feb 08 2003 - 22:23:00 PST)
• Jennifer Fountain
  • RE: Increased Kuang2 activity (Mon Feb 10 2003 - 09:00:18 PST)
• jet
  • Re: logfiles of openssl-0.9.6e + GET_CLIENT_HELLO exploit... (Tue Feb 11 2003 - 23:19:54 PST)
• Joe Stewart
  • Re: Speedera Ping, was "Packets from 255.255.255.255(80), etc." (Tue Feb 04 2003 - 10:59:57 PST)
• Joel Tyson
  • RE: Packets from 255.255.255.255(80) (was: Packet from port 80 with spoofed microsoft.com ip) (Mon Feb 03 2003 - 07:40:02 PST)
• Johann Kruse
  • RE: email address probes (Wed Feb 05 2003 - 16:08:44 PST)
• Johannes Ullrich
  • Re: Kuang2 strikes again, is it just me? (Sat Feb 15 2003 - 20:18:13 PST)
  • Re: Increased Kuang2 activity (Mon Feb 10 2003 - 08:55:45 PST)
• John Sage
  • Re: port 17300 probe fingerprint analysis (Tue Feb 18 2003 - 07:06:36 PST)
• Jon Rublack
  • Re: www.nopop.net (Mon Feb 17 2003 - 17:00:51 PST)
• Jonathan A. Zdziarski
  • RE: More /sumthin (Wed Feb 26 2003 - 13:14:37 PST)
• Jordan K Wiens
  • Re: Identity theft scam against eBay users (Mon Feb 10 2003 - 16:17:22 PST)
• Jyri Hovila
  • Re[2]: Weird Profile in Documents and Settings (Fri Feb 21 2003 - 10:10:58 PST)
• Kee Hinckley
  • Re: Distributed spam-based DoS in progress (Tue Feb 18 2003 - 15:05:57 PST)
  • Re: email address probes (Wed Feb 05 2003 - 18:01:26 PST)
• Kenneth Wilson
  • UDP traffic on Port 52798 (Thu Feb 13 2003 - 06:01:58 PST)
• Kevin Patz
  • Scans on TCP port 135 (Thu Feb 20 2003 - 13:12:04 PST)
  • Re: Kuang2 strikes again, is it just me? (Tue Feb 18 2003 - 10:59:17 PST)
• Klayton Monroe
  • FTimes 3.2.0 Released (Fri Feb 21 2003 - 02:03:47 PST)
  • WebJob 1.2.3 Released (Fri Feb 21 2003 - 01:42:00 PST)
• Kurt Seifried
  • Re: Increased Kuang2 activity (Mon Feb 10 2003 - 17:04:12 PST)
• kyleat_private
  • mIRC Trojan Variant - port 445 worm/Trojan (Sun Feb 16 2003 - 14:49:50 PST)
• Leonard.Ongat_private
  • RE: Possible new backdoor: mspx-smss.exe ? (Thu Feb 27 2003 - 12:24:39 PST)
• Levinson, Karl
  • RE: Web server crashed, now is trying to contact an IP by port 80 every morning. (Tue Feb 25 2003 - 05:21:25 PST)
• Logan F.D. Greenlee
  • RE: Increased Kuang2 activity (Mon Feb 10 2003 - 10:37:29 PST)
  • RE: Increased Kuang2 activity (Mon Feb 10 2003 - 08:46:16 PST)
• lsi
  • Re: Web server crashed, now is trying to contact an IP by port 80 every morning. (Mon Feb 24 2003 - 16:30:29 PST)
• Lucas Zaichkowsky
  • RE: Weird Profile in Documents and Settings (Thu Feb 20 2003 - 15:08:40 PST)
• Mark E. Donaldson
  • RE: ftp server compromised (Wed Feb 12 2003 - 18:31:48 PST)
  • RE: Traffic on UDP 1815 (Tue Feb 11 2003 - 20:50:56 PST)
• Matthew Breitenstine
  • Re: Identity theft scam against eBay users (Mon Feb 10 2003 - 16:17:48 PST)
• Meritt James
  • Re: Packets from 255.255.255.255(80) (was: Packet from port 80 with spoofed microsoft.com ip) (Wed Feb 05 2003 - 06:35:44 PST)
• Michael LaSalvia
  • RE: Suspicious file on Desktop (Mon Feb 10 2003 - 08:58:56 PST)
• Michel Angelo da Silva Pereira
  • Re: S4T4N1C Web Defacement (Thu Feb 13 2003 - 14:58:20 PST)
  • Re: S4T4N1C Web Defacement (Thu Feb 13 2003 - 10:35:34 PST)
• Mr.Day
  • Spies on Your PC HDrv (Fri Feb 14 2003 - 01:33:19 PST)
• Ned Fleming
  • Re: email address probes (Thu Feb 06 2003 - 07:07:05 PST)
• Neil Dickey
  • ICMP Destination Unreachable, Administratively Prohibited (Thu Feb 13 2003 - 14:35:11 PST)
  • Speedera Ping, was "Packets from 255.255.255.255(80), etc." (Mon Feb 03 2003 - 08:53:03 PST)
• NESTING, DAVID M (SBCSI)
  • RE: Weird apache logs (Wed Feb 26 2003 - 11:15:59 PST)
• NetSec Analyst
  • RE: ALEVRIUS! (Fri Feb 07 2003 - 15:36:39 PST)
• Nick FitzGerald
  • Re: Identity theft scam against eBay users (Mon Feb 10 2003 - 20:46:39 PST)
  • Re: klez variant?? (Fri Jan 31 2003 - 19:19:11 PST)
• Pascal Bouchareine
  • www.nopop.net (Mon Feb 17 2003 - 07:42:11 PST)
• Patrick Bryant
  • Re: Identity theft scam against eBay users (Tue Feb 11 2003 - 10:56:24 PST)
  • Re: Identity theft scam against eBay users (Mon Feb 10 2003 - 17:29:43 PST)
  • Identity theft scam against eBay users (Mon Feb 10 2003 - 14:50:37 PST)
• Patrick Fish
  • Suspicious file on Desktop (Mon Feb 10 2003 - 02:12:14 PST)
• Patrick R. Sweeney
  • Re: Weird Profile in Documents and Settings (Fri Feb 21 2003 - 15:36:12 PST)
• Paul Dokas
  • Re: Kuang2 strikes again, is it just me? (Mon Feb 17 2003 - 09:57:34 PST)
• PAUL_TAYLORat_private
  • Re: Suspicious file on Desktop (Mon Feb 10 2003 - 09:11:54 PST)
• perrierorat_private
  • RE: FTP/Port 1038 (Thu Feb 13 2003 - 12:18:24 PST)
• Philipp Hug
  • Re: More /sumthin (Wed Feb 26 2003 - 06:23:17 PST)
• psion
  • Re: ftp server compromised (Wed Feb 12 2003 - 22:52:56 PST)
• Rafael Coninck Teigao
  • Re: Interesting (Fri Feb 28 2003 - 09:38:35 PST)
  • Re: ICQ problem. (Mon Feb 24 2003 - 12:51:28 PST)
• rbelchez@show-net.net
  • ftp server compromised (Wed Feb 12 2003 - 17:20:47 PST)
• Rev. Kronovohr
  • RE: Increased Kuang2 activity (Mon Feb 10 2003 - 09:01:03 PST)
• Ricardo Castanho de Oliveira Freitas
  • Re: Web Defacement (Fri Feb 14 2003 - 04:50:16 PST)
• Richard Rager
  • Re: logfiles of openssl-0.9.6e + GET_CLIENT_HELLO exploit... (Tue Feb 11 2003 - 10:46:29 PST)
• Rob Shein
  • RE: Weird Profile in Documents and Settings (Thu Feb 20 2003 - 08:18:38 PST)
  • RE: Kuang2 strikes again, is it just me? (Sat Feb 15 2003 - 20:02:48 PST)
  • RE: email address probes (Thu Feb 06 2003 - 16:54:52 PST)
  • RE: ALEVRIUS! (Thu Feb 06 2003 - 15:31:32 PST)
  • RE: DoS Attacks, Detecting the Source, and Service Providers (Tue Feb 04 2003 - 10:56:13 PST)
• rocky_scottiat_private
  • Netbios Name Scans/opaserv worm (Thu Feb 06 2003 - 09:49:07 PST)
• Rohan Amin
  • Re: Distributed spam-based DoS in progress (Wed Feb 19 2003 - 21:04:43 PST)
• root@darks
  • Re: logfiles of openssl-0.9.6e + GET_CLIENT_HELLO exploit... (Tue Feb 11 2003 - 17:46:48 PST)
• Royans Tharakan
  • port 17300 probe fingerprint analysis (Mon Feb 17 2003 - 20:00:31 PST)
• Russell Fulton
  • Re: ICMP Destination Unreachable, Administratively Prohibited (Thu Feb 13 2003 - 15:38:32 PST)
• Sahr, Kenneth
  • RE: Traffic on UDP 1815 (Wed Feb 12 2003 - 05:14:27 PST)
  • Traffic on UDP 1815 (Tue Feb 11 2003 - 07:21:12 PST)
• Salisko, Rick
  • RE: ALEVRIUS! (Fri Feb 07 2003 - 11:29:24 PST)
• Salomao Barguil
  • Backdoor ?? "Girlnextdoor_" TCP Ports 1025/1028 (Thu Feb 27 2003 - 16:40:23 PST)
• Scott Harris
  • Re: anoat_private ftpd dip.t-dialin.net (Sun Feb 16 2003 - 11:51:40 PST)
• securityat_private
  • Re: S4T4N1C Web Defacement (Fri Feb 14 2003 - 05:36:39 PST)
• Stephen J. Friedl
  • Re: Interesting (Thu Feb 27 2003 - 08:13:02 PST)
• Steve Drees
  • RE: Distributed spam-based DoS in progress (Wed Feb 19 2003 - 11:43:55 PST)
• Sven Pechler
  • Re: Possible new backdoor: mspx-smss.exe ? (Wed Feb 26 2003 - 13:19:15 PST)
  • Possible new backdoor: mspx-smss.exe ? (Fri Feb 21 2003 - 03:57:16 PST)
• Sverre H. Huseby
  • More /sumthin, maybe (Mon Feb 03 2003 - 00:52:54 PST)
• Thiago Madeira de Lima
  • ICQ problem. (Fri Feb 21 2003 - 09:26:59 PST)
• Thierry Zoller
  • RE: Increased Kuang2 activity (Mon Feb 10 2003 - 16:26:02 PST)
• Thomas Giudice
  • Re: Identity theft scam against eBay users (Tue Feb 11 2003 - 03:32:48 PST)
• Tibor Biro
  • Re: ftp server compromised (Wed Feb 12 2003 - 18:10:11 PST)
• Tim Heagarty
  • RE: Kuang2 strikes again, is it just me? (Sun Feb 16 2003 - 21:16:39 PST)
• Tom Arseneault
  • RE: Packets from 255.255.255.255(80) (was: Packet from port 80 wi th spoofed microsoft.com ip) (Mon Feb 03 2003 - 11:22:36 PST)
• Transistor Sister
  • Re: Distributed spam-based DoS in progress (Tue Feb 18 2003 - 18:35:33 PST)
  • Distributed spam-based DoS in progress (Mon Feb 17 2003 - 17:25:19 PST)
• Travis Read
  • Weird apache logs (Tue Feb 25 2003 - 17:57:20 PST)
• Trevor Metzger
  • RE: Kuang2 strikes again, is it just me? (Sun Feb 16 2003 - 15:28:36 PST)
• Valdis.Kletnieksat_private
  • Re: Distributed spam-based DoS in progress (Tue Feb 18 2003 - 11:48:38 PST)
  • Re: ICMP Destination Unreachable, Administratively Prohibited (Fri Feb 14 2003 - 08:11:35 PST)
  • Re: Packets from 255.255.255.255(80) (was: Packet from port 80 with spoofed microsoft.com ip) (Mon Feb 03 2003 - 11:04:52 PST)
• william.millerat_private
  • Re: port 17300 probe fingerprint analysis (Wed Feb 19 2003 - 04:30:17 PST)
• zmajd fully
  • Re: Packet from port 80 with spoofed microsoft.com ip (Mon Feb 03 2003 - 15:27:59 PST)

Last message date: Tue Mar 04 2003 - 07:44:08 PST
Archived on: Tue Mar 04 2003 - 07:44:10 PST

This archive was generated by hypermail 2b30 : Tue Mar 04 2003 - 07:44:10 PST