incidents 2003/02
By Thread

Starting: Sun Feb 02 2003 - 08:36:10 PST
Ending: Tue Mar 04 2003 - 07:44:08 PST

• Re: Packet from port 80 with spoofed microsoft.com ip Hulio Cortez (Fri Jan 31 2003 - 13:59:25 PST)
  • Re: Packet from port 80 with spoofed microsoft.com ip zmajd fully (Mon Feb 03 2003 - 15:27:59 PST)
• Re: /sumthin Revisited H D Moore (Sat Feb 01 2003 - 12:59:50 PST)
• Re: klez variant?? Nick FitzGerald (Fri Jan 31 2003 - 19:19:11 PST)
• Re: Packets from 255.255.255.255(80) (was: Packet from port 80 with spoofed microsoft.com ip) Hugo van der Kooij (Sun Feb 02 2003 - 09:33:12 PST)
  • Re: Packets from 255.255.255.255(80) (was: Packet from port 80 with spoofed microsoft.com ip) Geert Kiers (Sun Feb 02 2003 - 09:45:32 PST)
  • Re: Packets from 255.255.255.255(80) (was: Packet from port 80 with spoofed microsoft.com ip) Frederic Harster (Mon Feb 03 2003 - 07:56:23 PST)
    • RE: Packets from 255.255.255.255(80) (was: Packet from port 80 with spoofed microsoft.com ip) James Kelly (Tue Feb 04 2003 - 10:26:56 PST)
    • Re: Packets from 255.255.255.255(80) (was: Packet from port 80 with spoofed microsoft.com ip) Christian Vogel (Tue Feb 04 2003 - 10:46:33 PST)
      • Re: Packets from 255.255.255.255(80) (was: Packet from port 80 with spoofed microsoft.com ip) Meritt James (Wed Feb 05 2003 - 06:35:44 PST)
• Re: Packets from 255.255.255.255(80) Guy Reisenauer (Sun Feb 02 2003 - 12:27:04 PST)
• RE: Packets from 255.255.255.255(80) (was: Packet from port 80 with spoofed microsoft.com ip) Joel Tyson (Mon Feb 03 2003 - 07:40:02 PST)
  • Re: Packets from 255.255.255.255(80) (was: Packet from port 80 with spoofed microsoft.com ip) Valdis.Kletnieksat_private (Mon Feb 03 2003 - 11:04:52 PST)
• More /sumthin, maybe Sverre H. Huseby (Mon Feb 03 2003 - 00:52:54 PST)
  • Re: More /sumthin Philipp Hug (Wed Feb 26 2003 - 06:23:17 PST)
    • RE: More /sumthin Jonathan A. Zdziarski (Wed Feb 26 2003 - 13:14:37 PST)
      • Re: More /sumthin D.C. van Moolenbroek (Wed Feb 26 2003 - 16:59:08 PST)
• Speedera Ping, was "Packets from 255.255.255.255(80), etc." Neil Dickey (Mon Feb 03 2003 - 08:53:03 PST)
  • Re: Speedera Ping, was "Packets from 255.255.255.255(80), etc." Joe Stewart (Tue Feb 04 2003 - 10:59:57 PST)
• DoS Attacks, Detecting the Source, and Service Providers Hamid (Mon Feb 03 2003 - 13:39:32 PST)
  • Re: DoS Attacks, Detecting the Source, and Service Providers james (Tue Feb 04 2003 - 10:35:53 PST)
  • RE: DoS Attacks, Detecting the Source, and Service Providers Rob Shein (Tue Feb 04 2003 - 10:56:13 PST)
  • Re: DoS Attacks, Detecting the Source, and Service Providers H C (Tue Feb 04 2003 - 12:44:06 PST)
• RE: Packets from 255.255.255.255(80) (was: Packet from port 80 wi th spoofed microsoft.com ip) Tom Arseneault (Mon Feb 03 2003 - 11:22:36 PST)
  • RE: Packets from 255.255.255.255(80) (was: Packet from port 80 wi th spoofed microsoft.com ip) Fitzgerald, John (Wed Feb 05 2003 - 01:51:14 PST)
  • RE: Packets from 255.255.255.255(80) (was: Packet from port 80 wi th spoofed microsoft.com ip) Fitzgerald, John (Wed Feb 05 2003 - 01:44:38 PST)
• FTP/Port 1038 Hoof Hearted (Tue Feb 04 2003 - 10:49:55 PST)
  • RE: FTP/Port 1038 Boyan Krosnov (Tue Feb 04 2003 - 14:26:41 PST)
    • RE: FTP/Port 1038 perrierorat_private (Thu Feb 13 2003 - 12:18:24 PST)
• email address probes Andy Bastien (Wed Feb 05 2003 - 12:54:19 PST)
  • Re: email address probes Kee Hinckley (Wed Feb 05 2003 - 18:01:26 PST)
  • Re: email address probes Brad Arlt (Wed Feb 05 2003 - 14:26:12 PST)
    • Re: email address probes james (Thu Feb 06 2003 - 09:49:09 PST)
    • Re: email address probes Brad Arlt (Fri Feb 07 2003 - 09:29:02 PST)
  • Re: email address probes Greg A. Woods (Wed Feb 05 2003 - 15:04:44 PST)
    • Re: email address probes Axel Beckert - ecos gmbh (Thu Feb 06 2003 - 09:30:15 PST)
      • RE: email address probes Rob Shein (Thu Feb 06 2003 - 16:54:52 PST)
  • RE: email address probes Johann Kruse (Wed Feb 05 2003 - 16:08:44 PST)
  • Re: email address probes Dave Laird (Wed Feb 05 2003 - 23:57:41 PST)
  • Re: email address probes Ned Fleming (Thu Feb 06 2003 - 07:07:05 PST)
    • Re: email address probes Andy Bastien (Fri Feb 07 2003 - 09:16:53 PST)
• Netbios Name Scans/opaserv worm rocky_scottiat_private (Thu Feb 06 2003 - 09:49:07 PST)
  • Re: Netbios Name Scans/opaserv worm H C (Thu Feb 06 2003 - 14:02:50 PST)
• ALEVRIUS! Geert Kiers (Thu Feb 06 2003 - 10:39:28 PST)
  • RE: ALEVRIUS! Rob Shein (Thu Feb 06 2003 - 15:31:32 PST)
  • RE: ALEVRIUS! James C Slora Jr (Thu Feb 06 2003 - 15:43:51 PST)
  • RE: ALEVRIUS! Anders Reed Mohn (Fri Feb 07 2003 - 04:06:47 PST)
  • RE: ALEVRIUS! Salisko, Rick (Fri Feb 07 2003 - 11:29:24 PST)
  • RE: ALEVRIUS! NetSec Analyst (Fri Feb 07 2003 - 15:36:39 PST)
  • RE: ALEVRIUS! Anders Reed Mohn (Tue Feb 11 2003 - 08:41:23 PST)
• Kuang2 on the rise... Jeff Kell (Sat Feb 08 2003 - 22:23:00 PST)
• Increased Kuang2 activity Jason Dixon (Sun Feb 09 2003 - 16:01:23 PST)
  • RE: Increased Kuang2 activity Logan F.D. Greenlee (Mon Feb 10 2003 - 08:46:16 PST)
    • RE: Increased Kuang2 activity Jason Dixon (Mon Feb 10 2003 - 08:57:24 PST)
    • RE: Increased Kuang2 activity Rev. Kronovohr (Mon Feb 10 2003 - 09:01:03 PST)
  • Re: Increased Kuang2 activity Johannes Ullrich (Mon Feb 10 2003 - 08:55:45 PST)
  • RE: Increased Kuang2 activity Jennifer Fountain (Mon Feb 10 2003 - 09:00:18 PST)
  • RE: Increased Kuang2 activity davecat_private (Mon Feb 10 2003 - 09:13:00 PST)
  • RE: Increased Kuang2 activity Logan F.D. Greenlee (Mon Feb 10 2003 - 10:37:29 PST)
    • RE: Increased Kuang2 activity James C Slora Jr (Mon Feb 10 2003 - 12:42:53 PST)
      • Re: Increased Kuang2 activity Kurt Seifried (Mon Feb 10 2003 - 17:04:12 PST)
  • RE: Increased Kuang2 activity Baklarz, Ron (Mon Feb 10 2003 - 12:01:54 PST)
  • RE: Increased Kuang2 activity James C Slora Jr (Mon Feb 10 2003 - 13:35:52 PST)
  • RE: Increased Kuang2 activity Thierry Zoller (Mon Feb 10 2003 - 16:26:02 PST)
• Suspicious file on Desktop Patrick Fish (Mon Feb 10 2003 - 02:12:14 PST)
  • RE: Suspicious file on Desktop Eric Greenberg (Mon Feb 10 2003 - 08:54:58 PST)
  • RE: Suspicious file on Desktop Michael LaSalvia (Mon Feb 10 2003 - 08:58:56 PST)
  • Re: Suspicious file on Desktop PAUL_TAYLORat_private (Mon Feb 10 2003 - 09:11:54 PST)
  • RE: Suspicious file on Desktop Brenna Primrose (Mon Feb 10 2003 - 13:12:24 PST)
• Correction: www.ethereal.com not www.ethereal.org RE: Suspicious file on Desktop Eric Greenberg (Mon Feb 10 2003 - 13:34:09 PST)
• Identity theft scam against eBay users Patrick Bryant (Mon Feb 10 2003 - 14:50:37 PST)
  • Re: Identity theft scam against eBay users Jordan K Wiens (Mon Feb 10 2003 - 16:17:22 PST)
    • Re: Identity theft scam against eBay users Patrick Bryant (Mon Feb 10 2003 - 17:29:43 PST)
      • Re: Identity theft scam against eBay users Nick FitzGerald (Mon Feb 10 2003 - 20:46:39 PST)
  • Re: Identity theft scam against eBay users Matthew Breitenstine (Mon Feb 10 2003 - 16:17:48 PST)
  • Re: Identity theft scam against eBay users Thomas Giudice (Tue Feb 11 2003 - 03:32:48 PST)
  • Re: Identity theft scam against eBay users Patrick Bryant (Tue Feb 11 2003 - 10:56:24 PST)
• logfiles of openssl-0.9.6e + GET_CLIENT_HELLO exploit... Chuck Swiger (Mon Feb 10 2003 - 16:45:53 PST)
  • Re: logfiles of openssl-0.9.6e + GET_CLIENT_HELLO exploit... Richard Rager (Tue Feb 11 2003 - 10:46:29 PST)
    • Re: logfiles of openssl-0.9.6e + GET_CLIENT_HELLO exploit... jet (Tue Feb 11 2003 - 23:19:54 PST)
  • Re: logfiles of openssl-0.9.6e + GET_CLIENT_HELLO exploit... root@darks (Tue Feb 11 2003 - 17:46:48 PST)
    • Re: logfiles of openssl-0.9.6e + GET_CLIENT_HELLO exploit... Chuck Swiger (Tue Feb 11 2003 - 19:00:01 PST)
• Traffic on UDP 1815 Sahr, Kenneth (Tue Feb 11 2003 - 07:21:12 PST)
  • RE: Traffic on UDP 1815 Sahr, Kenneth (Wed Feb 12 2003 - 05:14:27 PST)
  • RE: Traffic on UDP 1815 Mark E. Donaldson (Tue Feb 11 2003 - 20:50:56 PST)
• The 4 line ad at the bottom of this post.. Alfred Huger (Wed Feb 12 2003 - 16:32:12 PST)
• ftp server compromised rbelchez@show-net.net (Wed Feb 12 2003 - 17:20:47 PST)
  • RE: ftp server compromised Mark E. Donaldson (Wed Feb 12 2003 - 18:31:48 PST)
    • RE: ftp server compromised Denis Dimick (Wed Feb 12 2003 - 21:45:35 PST)
  • Re: ftp server compromised Tibor Biro (Wed Feb 12 2003 - 18:10:11 PST)
  • Re: ftp server compromised David Hodges (Wed Feb 12 2003 - 19:33:18 PST)
  • Re: ftp server compromised psion (Wed Feb 12 2003 - 22:52:56 PST)
• webserver probes for php detection Alexander Reelsen (Thu Feb 13 2003 - 05:10:03 PST)
• S4T4N1C Web Defacement Christopher Lyon (Thu Feb 13 2003 - 00:23:40 PST)
  • Re: S4T4N1C Web Defacement Michel Angelo da Silva Pereira (Thu Feb 13 2003 - 10:35:34 PST)
  • Re: S4T4N1C Web Defacement HggdH (Thu Feb 13 2003 - 11:43:11 PST)
    • Re: S4T4N1C Web Defacement Michel Angelo da Silva Pereira (Thu Feb 13 2003 - 14:58:20 PST)
      • Re: Web Defacement Ricardo Castanho de Oliveira Freitas (Fri Feb 14 2003 - 04:50:16 PST)
      • Re: Web Defacement Alberto Cozer (Mon Feb 17 2003 - 10:56:25 PST)
      • Re: S4T4N1C Web Defacement securityat_private (Fri Feb 14 2003 - 05:36:39 PST)
  • RE: S4T4N1C Web Defacement Dan Perez (Thu Feb 13 2003 - 12:40:06 PST)
• UDP traffic on Port 52798 Kenneth Wilson (Thu Feb 13 2003 - 06:01:58 PST)
  • Re: UDP traffic on Port 52798 H C (Thu Feb 13 2003 - 10:32:33 PST)
• ICMP Destination Unreachable, Administratively Prohibited Neil Dickey (Thu Feb 13 2003 - 14:35:11 PST)
  • Re: ICMP Destination Unreachable, Administratively Prohibited Chris Brenton (Thu Feb 13 2003 - 15:26:46 PST)
    • Re: ICMP Destination Unreachable, Administratively Prohibited Anthony Kim (Fri Feb 14 2003 - 08:02:41 PST)
    • Re: ICMP Destination Unreachable, Administratively Prohibited Valdis.Kletnieksat_private (Fri Feb 14 2003 - 08:11:35 PST)
  • Re: ICMP Destination Unreachable, Administratively Prohibited Russell Fulton (Thu Feb 13 2003 - 15:38:32 PST)
  • Re: ICMP Destination Unreachable, Administratively Prohibited Anders Thulin (Thu Feb 13 2003 - 23:12:18 PST)
• Spies on Your PC HDrv Mr.Day (Fri Feb 14 2003 - 01:33:19 PST)
• Incidents list administrivia and introductions... Dan Hanson (Sat Feb 15 2003 - 16:13:42 PST)
• Kuang2 strikes again, is it just me? Jeff Kell (Sat Feb 15 2003 - 17:35:02 PST)
  • RE: Kuang2 strikes again, is it just me? Rob Shein (Sat Feb 15 2003 - 20:02:48 PST)
    • Re: Kuang2 strikes again, is it just me? Paul Dokas (Mon Feb 17 2003 - 09:57:34 PST)
  • Re: Kuang2 strikes again, is it just me? Johannes Ullrich (Sat Feb 15 2003 - 20:18:13 PST)
  • Re: Kuang2 strikes again, is it just me? Jasmine (Sun Feb 16 2003 - 06:00:48 PST)
  • Re: Kuang2 strikes again, is it just me? Jeff (Sun Feb 16 2003 - 09:39:10 PST)
    • RE: Kuang2 strikes again, is it just me? Trevor Metzger (Sun Feb 16 2003 - 15:28:36 PST)
      • RE: Kuang2 strikes again, is it just me? Tim Heagarty (Sun Feb 16 2003 - 21:16:39 PST)
    • mIRC Trojan Variant - port 445 worm/Trojan kyleat_private (Sun Feb 16 2003 - 14:49:50 PST)
  • Re: Kuang2 strikes again, is it just me? Kevin Patz (Tue Feb 18 2003 - 10:59:17 PST)
• Re: anoat_private ftpd dip.t-dialin.net Scott Harris (Sun Feb 16 2003 - 11:51:40 PST)
• www.nopop.net Pascal Bouchareine (Mon Feb 17 2003 - 07:42:11 PST)
  • RE: www.nopop.net Brad Griffin (Mon Feb 17 2003 - 14:27:01 PST)
  • Re: www.nopop.net Jon Rublack (Mon Feb 17 2003 - 17:00:51 PST)
• Distributed spam-based DoS in progress Transistor Sister (Mon Feb 17 2003 - 17:25:19 PST)
  • Re: Distributed spam-based DoS in progress Hugo van der Kooij (Mon Feb 17 2003 - 22:48:20 PST)
    • Re: Distributed spam-based DoS in progress Valdis.Kletnieksat_private (Tue Feb 18 2003 - 11:48:38 PST)
  • RE: Distributed spam-based DoS in progress Dave Hart (Tue Feb 18 2003 - 11:28:30 PST)
    • RE: Distributed spam-based DoS in progress Hugo van der Kooij (Tue Feb 18 2003 - 22:49:55 PST)
  • Re: Distributed spam-based DoS in progress Kee Hinckley (Tue Feb 18 2003 - 15:05:57 PST)
    • Re: Distributed spam-based DoS in progress Transistor Sister (Tue Feb 18 2003 - 18:35:33 PST)
      • Re: Distributed spam-based DoS in progress Rohan Amin (Wed Feb 19 2003 - 21:04:43 PST)
    • RE: Distributed spam-based DoS in progress Steve Drees (Wed Feb 19 2003 - 11:43:55 PST)
  • RE: Distributed spam-based DoS in progress Dave Hart (Tue Feb 18 2003 - 23:26:37 PST)
• port 17300 probe fingerprint analysis Royans Tharakan (Mon Feb 17 2003 - 20:00:31 PST)
  • Re: port 17300 probe fingerprint analysis John Sage (Tue Feb 18 2003 - 07:06:36 PST)
  • Re: port 17300 probe fingerprint analysis william.millerat_private (Wed Feb 19 2003 - 04:30:17 PST)
• Dead thread -- Distributed spam-based DoS in progress Dan Hanson (Wed Feb 19 2003 - 19:46:18 PST)
• Weird Profile in Documents and Settings Greg Wiedeman (Thu Feb 20 2003 - 03:38:16 PST)
  • RE: Weird Profile in Documents and Settings Rob Shein (Thu Feb 20 2003 - 08:18:38 PST)
    • Re[2]: Weird Profile in Documents and Settings Jyri Hovila (Fri Feb 21 2003 - 10:10:58 PST)
  • RE: Weird Profile in Documents and Settings Lucas Zaichkowsky (Thu Feb 20 2003 - 15:08:40 PST)
    • Re: Weird Profile in Documents and Settings Patrick R. Sweeney (Fri Feb 21 2003 - 15:36:12 PST)
      • RE: Weird Profile in Documents and Settings Austin Ehlers (Fri Feb 21 2003 - 20:14:48 PST)
      • RE: Weird Profile in Documents and Settings Christopher Hummert (Sat Feb 22 2003 - 13:36:58 PST)
  • Re: Weird Profile in Documents and Settings Anders Thulin (Fri Feb 21 2003 - 00:20:27 PST)
  • Re: Weird Profile in Documents and Settings Gene Yoo (Thu Feb 20 2003 - 19:34:40 PST)
• Scans on TCP port 135 Kevin Patz (Thu Feb 20 2003 - 13:12:04 PST)
  • Re: Scans on TCP port 135 Dave Aitel (Fri Feb 21 2003 - 14:00:59 PST)
• WebJob 1.2.3 Released Klayton Monroe (Fri Feb 21 2003 - 01:42:00 PST)
• FTimes 3.2.0 Released Klayton Monroe (Fri Feb 21 2003 - 02:03:47 PST)
• Questions: LKM, yoyo & rootkits Gordon Ewasiuk (Fri Feb 21 2003 - 05:31:43 PST)
• ICQ problem. Thiago Madeira de Lima (Fri Feb 21 2003 - 09:26:59 PST)
  • Re: ICQ problem. bob (Fri Feb 21 2003 - 20:01:19 PST)
  • Re: ICQ problem. Rafael Coninck Teigao (Mon Feb 24 2003 - 12:51:28 PST)
• Possible new backdoor: mspx-smss.exe ? Sven Pechler (Fri Feb 21 2003 - 03:57:16 PST)
  • Re: Possible new backdoor: mspx-smss.exe ? Sven Pechler (Wed Feb 26 2003 - 13:19:15 PST)
    • Backdoor ?? "Girlnextdoor_" TCP Ports 1025/1028 Salomao Barguil (Thu Feb 27 2003 - 16:40:23 PST)
  • RE: Possible new backdoor: mspx-smss.exe ? Leonard.Ongat_private (Thu Feb 27 2003 - 12:24:39 PST)
• Re: Weird Windows logon attempts Jacco Tunnissen (Sun Feb 23 2003 - 19:08:42 PST)
  • Re: Weird Windows logon attempts Bojan Zdrnja (Mon Feb 24 2003 - 01:07:55 PST)
• Re: Web server crashed, now is trying to contact an IP by port 80 every morning. lsi (Mon Feb 24 2003 - 16:30:29 PST)
• RE: Web server crashed, now is trying to contact an IP by port 80 every morning. Dan Harpold (Mon Feb 24 2003 - 17:19:38 PST)
  • RE: Web server crashed, now is trying to contact an IP by port 80 every morning. Levinson, Karl (Tue Feb 25 2003 - 05:21:25 PST)
• Incident Focus Area Article Announcement Dan Hanson (Tue Feb 25 2003 - 16:14:22 PST)
• Remote Access Software (Wireless Devices) Holstein, Michael (Tue Feb 25 2003 - 10:00:00 PST)
• Weird apache logs Travis Read (Tue Feb 25 2003 - 17:57:20 PST)
  • RE: Weird apache logs Carmen Tache (Wed Feb 26 2003 - 11:09:43 PST)
  • RE: Weird apache logs NESTING, DAVID M (SBCSI) (Wed Feb 26 2003 - 11:15:59 PST)
• Interesting http-equivat_private (Wed Feb 26 2003 - 12:01:34 PST)
  • Re: Interesting Stephen J. Friedl (Thu Feb 27 2003 - 08:13:02 PST)
  • Re: Interesting Rafael Coninck Teigao (Fri Feb 28 2003 - 09:38:35 PST)
• TCP 445 Scan? Charles Hamby (Thu Feb 27 2003 - 10:25:29 PST)
• Spammers? Christopher Wagner (Thu Feb 27 2003 - 10:11:08 PST)

Last message date: Tue Mar 04 2003 - 07:44:08 PST
Archived on: Tue Mar 04 2003 - 07:44:10 PST

This archive was generated by hypermail 2b30 : Tue Mar 04 2003 - 07:44:10 PST