Starting: Mon Feb 03 2003 - 09:34:20 CST
Ending: Thu Feb 27 2003 - 10:25:36 CST

• Re: Packets from 255.255.255.255(80) (was: Packet from port 80 with spoofed microsoft.com ip) Hugo van der Kooij (Sun Feb 02 2003 - 11:33:12 CST)
• Re: Packets from 255.255.255.255(80) Guy Reisenauer (Sun Feb 02 2003 - 14:27:04 CST)
• RE: Packets from 255.255.255.255(80) (was: Packet from port 80 with spoofed microsoft.com ip) Joel Tyson (Mon Feb 03 2003 - 09:40:02 CST)
• Re: Packets from 255.255.255.255(80) (was: Packet from port 80 with spoofed microsoft.com ip) Geert Kiers (Sun Feb 02 2003 - 11:45:32 CST)
• More /sumthin, maybe Sverre H. Huseby (Mon Feb 03 2003 - 02:52:54 CST)
• Re: Packets from 255.255.255.255(80) (was: Packet from port 80 with spoofed microsoft.com ip) Frederic Harster (Mon Feb 03 2003 - 09:56:23 CST)
• Speedera Ping, was "Packets from 255.255.255.255(80), etc." Neil Dickey (Mon Feb 03 2003 - 10:53:03 CST)
• DoS Attacks, Detecting the Source, and Service Providers Hamid (Mon Feb 03 2003 - 15:39:32 CST)
• Re: Packets from 255.255.255.255(80) (was: Packet from port 80 with spoofed microsoft.com ip) Valdis.Kletnieks_at_vt.edu (Mon Feb 03 2003 - 13:04:52 CST)
• Re: Packet from port 80 with spoofed microsoft.com ip zmajd fully (Mon Feb 03 2003 - 17:27:59 CST)
• RE: Packets from 255.255.255.255(80) (was: Packet from port 80 wi th spoofed microsoft.com ip) Tom Arseneault (Mon Feb 03 2003 - 13:22:36 CST)
• Re: DoS Attacks, Detecting the Source, and Service Providers james (Tue Feb 04 2003 - 12:35:53 CST)
• Re: Speedera Ping, was "Packets from 255.255.255.255(80), etc." Joe Stewart (Tue Feb 04 2003 - 12:59:57 CST)
• RE: Packets from 255.255.255.255(80) (was: Packet from port 80 with spoofed microsoft.com ip) James Kelly (Tue Feb 04 2003 - 12:26:56 CST)
• Re: Packets from 255.255.255.255(80) (was: Packet from port 80 with spoofed microsoft.com ip) Christian Vogel (Tue Feb 04 2003 - 12:46:33 CST)
• FTP/Port 1038 Hoof Hearted (Tue Feb 04 2003 - 12:49:55 CST)
• RE: FTP/Port 1038 Boyan Krosnov (Tue Feb 04 2003 - 16:26:41 CST)
• RE: DoS Attacks, Detecting the Source, and Service Providers Rob Shein (Tue Feb 04 2003 - 12:56:13 CST)
• Re: DoS Attacks, Detecting the Source, and Service Providers H C (Tue Feb 04 2003 - 14:44:06 CST)
• RE: Packets from 255.255.255.255(80) (was: Packet from port 80 wi th spoofed microsoft.com ip) Fitzgerald, John (Wed Feb 05 2003 - 03:51:14 CST)
• RE: Packets from 255.255.255.255(80) (was: Packet from port 80 wi th spoofed microsoft.com ip) Fitzgerald, John (Wed Feb 05 2003 - 03:44:38 CST)
• Re: Packets from 255.255.255.255(80) (was: Packet from port 80 with spoofed microsoft.com ip) Meritt James (Wed Feb 05 2003 - 08:35:44 CST)
• email address probes Andy Bastien (Wed Feb 05 2003 - 14:54:19 CST)
• Re: email address probes Kee Hinckley (Wed Feb 05 2003 - 20:01:26 CST)
• Re: email address probes Brad Arlt (Wed Feb 05 2003 - 16:26:12 CST)
• Re: email address probes Greg A. Woods (Wed Feb 05 2003 - 17:04:44 CST)
• RE: email address probes Johann Kruse (Wed Feb 05 2003 - 18:08:44 CST)
• Re: email address probes Dave Laird (Thu Feb 06 2003 - 01:57:41 CST)
• Re: email address probes Ned Fleming (Thu Feb 06 2003 - 09:07:05 CST)
• Re: email address probes Axel Beckert - ecos gmbh (Thu Feb 06 2003 - 11:30:15 CST)
• Netbios Name Scans/opaserv worm rocky_scotti_at_na.dole.com (Thu Feb 06 2003 - 11:49:07 CST)
• Re: email address probes james (Thu Feb 06 2003 - 11:49:09 CST)
• ALEVRIUS! Geert Kiers (Thu Feb 06 2003 - 12:39:28 CST)
• Re: Netbios Name Scans/opaserv worm H C (Thu Feb 06 2003 - 16:02:50 CST)
• Re: FW: Packets from 255.255.255.255(80) (was: Packet from port 80 wi th spoofed microsoft.com ip) Alif The Terrible (Thu Feb 06 2003 - 16:54:32 CST)
• RE: ALEVRIUS! Rob Shein (Thu Feb 06 2003 - 17:31:32 CST)
• Re: email address probes Brad Arlt (Fri Feb 07 2003 - 11:29:02 CST)
• Re: email address probes Andy Bastien (Fri Feb 07 2003 - 11:16:53 CST)
• RE: ALEVRIUS! James C Slora Jr (Thu Feb 06 2003 - 17:43:51 CST)
• RE: email address probes Rob Shein (Thu Feb 06 2003 - 18:54:52 CST)
• RE: ALEVRIUS! Anders Reed Mohn (Fri Feb 07 2003 - 06:06:47 CST)
• RE: ALEVRIUS! Salisko, Rick (Fri Feb 07 2003 - 13:29:24 CST)
• RE: ALEVRIUS! NetSec Analyst (Fri Feb 07 2003 - 17:36:39 CST)
• Kuang2 on the rise... Jeff Kell (Sun Feb 09 2003 - 00:23:00 CST)
• Increased Kuang2 activity Jason Dixon (Sun Feb 09 2003 - 18:01:23 CST)
• Suspicious file on Desktop Patrick Fish (Mon Feb 10 2003 - 04:12:14 CST)
• RE: Increased Kuang2 activity Logan F.D. Greenlee (Mon Feb 10 2003 - 10:46:16 CST)
• RE: Increased Kuang2 activity davec_at_skooter.net (Mon Feb 10 2003 - 11:13:00 CST)
• Re: Increased Kuang2 activity Johannes Ullrich (Mon Feb 10 2003 - 10:55:45 CST)
• RE: Suspicious file on Desktop Eric Greenberg (Mon Feb 10 2003 - 10:54:58 CST)
• RE: Increased Kuang2 activity Jason Dixon (Mon Feb 10 2003 - 10:57:24 CST)
• RE: Suspicious file on Desktop Michael LaSalvia (Mon Feb 10 2003 - 10:58:56 CST)
• RE: Increased Kuang2 activity Rev. Kronovohr (Mon Feb 10 2003 - 11:01:03 CST)
• RE: Increased Kuang2 activity Jennifer Fountain (Mon Feb 10 2003 - 11:00:18 CST)
• Re: Suspicious file on Desktop PAUL_TAYLOR_at_qvc.com (Mon Feb 10 2003 - 11:11:54 CST)
• RE: Increased Kuang2 activity Logan F.D. Greenlee (Mon Feb 10 2003 - 12:37:29 CST)
• RE: Increased Kuang2 activity Baklarz, Ron (Mon Feb 10 2003 - 14:01:54 CST)
• RE: Increased Kuang2 activity James C Slora Jr (Mon Feb 10 2003 - 14:42:53 CST)
• RE: Suspicious file on Desktop Brenna Primrose (Mon Feb 10 2003 - 15:12:24 CST)
• Correction: www.ethereal.com not www.ethereal.org RE: Suspicious file on Desktop Eric Greenberg (Mon Feb 10 2003 - 15:34:09 CST)
• RE: Increased Kuang2 activity James C Slora Jr (Mon Feb 10 2003 - 15:35:52 CST)
• Identity theft scam against eBay users Patrick Bryant (Mon Feb 10 2003 - 16:50:37 CST)
• Re: Increased Kuang2 activity Kurt Seifried (Mon Feb 10 2003 - 19:04:12 CST)
• Re: Identity theft scam against eBay users Jordan K Wiens (Mon Feb 10 2003 - 18:17:22 CST)
• Re: Identity theft scam against eBay users Matthew Breitenstine (Mon Feb 10 2003 - 18:17:48 CST)
• RE: Increased Kuang2 activity Thierry Zoller (Mon Feb 10 2003 - 18:26:02 CST)
• logfiles of openssl-0.9.6e + GET_CLIENT_HELLO exploit... Chuck Swiger (Mon Feb 10 2003 - 18:45:53 CST)
• Re: Identity theft scam against eBay users Patrick Bryant (Mon Feb 10 2003 - 19:29:43 CST)
• Re: Identity theft scam against eBay users Nick FitzGerald (Mon Feb 10 2003 - 22:46:39 CST)
• Re: Identity theft scam against eBay users Thomas Giudice (Tue Feb 11 2003 - 05:32:48 CST)
• Traffic on UDP 1815 Sahr, Kenneth (Tue Feb 11 2003 - 09:21:12 CST)
• RE: ALEVRIUS! Anders Reed Mohn (Tue Feb 11 2003 - 10:41:23 CST)
• Re: Identity theft scam against eBay users Patrick Bryant (Tue Feb 11 2003 - 12:56:24 CST)
• Re: logfiles of openssl-0.9.6e + GET_CLIENT_HELLO exploit... Richard Rager (Tue Feb 11 2003 - 12:46:29 CST)
• Re: logfiles of openssl-0.9.6e + GET_CLIENT_HELLO exploit... root_at_darks (Tue Feb 11 2003 - 19:46:48 CST)
• Re: logfiles of openssl-0.9.6e + GET_CLIENT_HELLO exploit... jet (Wed Feb 12 2003 - 01:19:54 CST)
• Re: logfiles of openssl-0.9.6e + GET_CLIENT_HELLO exploit... Chuck Swiger (Tue Feb 11 2003 - 21:00:01 CST)
• RE: Traffic on UDP 1815 Sahr, Kenneth (Wed Feb 12 2003 - 07:14:27 CST)
• RE: Traffic on UDP 1815 Mark E. Donaldson (Tue Feb 11 2003 - 22:50:56 CST)
• The 4 line ad at the bottom of this post.. Alfred Huger (Wed Feb 12 2003 - 18:32:12 CST)
• ftp server compromised rbelchez_at_show-net.net (Wed Feb 12 2003 - 19:20:47 CST)
• RE: ftp server compromised Mark E. Donaldson (Wed Feb 12 2003 - 20:31:48 CST)
• Re: ftp server compromised Tibor Biro (Wed Feb 12 2003 - 20:10:11 CST)
• Re: ftp server compromised David Hodges (Wed Feb 12 2003 - 21:33:18 CST)
• RE: ftp server compromised Denis Dimick (Wed Feb 12 2003 - 23:45:35 CST)
• Re: ftp server compromised psion (Thu Feb 13 2003 - 00:52:56 CST)
• webserver probes for php detection Alexander Reelsen (Thu Feb 13 2003 - 07:10:03 CST)
• S4T4N1C Web Defacement Christopher Lyon (Thu Feb 13 2003 - 02:23:40 CST)
• UDP traffic on Port 52798 Kenneth Wilson (Thu Feb 13 2003 - 08:01:58 CST)
• Re: S4T4N1C Web Defacement Michel Angelo da Silva Pereira (Thu Feb 13 2003 - 12:35:34 CST)
• Re: UDP traffic on Port 52798 H C (Thu Feb 13 2003 - 12:32:33 CST)
• Re: S4T4N1C Web Defacement HggdH (Thu Feb 13 2003 - 13:43:11 CST)
• RE: FTP/Port 1038 perrieror_at_ssginfo.montclair.edu (Thu Feb 13 2003 - 14:18:24 CST)
• RE: S4T4N1C Web Defacement Dan Perez (Thu Feb 13 2003 - 14:40:06 CST)
• Summary of the responses (4 line ad) Alfred Huger (Thu Feb 13 2003 - 15:48:43 CST)
• ICMP Destination Unreachable, Administratively Prohibited Neil Dickey (Thu Feb 13 2003 - 16:35:11 CST)
• Re: S4T4N1C Web Defacement Michel Angelo da Silva Pereira (Thu Feb 13 2003 - 16:58:20 CST)
• Re: ICMP Destination Unreachable, Administratively Prohibited Chris Brenton (Thu Feb 13 2003 - 17:26:46 CST)
• Re: ICMP Destination Unreachable, Administratively Prohibited Russell Fulton (Thu Feb 13 2003 - 17:38:32 CST)
• Re: ICMP Destination Unreachable, Administratively Prohibited Anders Thulin (Fri Feb 14 2003 - 01:12:18 CST)
• Spies on Your PC HDrv Mr.Day (Fri Feb 14 2003 - 01:33:19 CST)
• Re: Web Defacement Ricardo Castanho de Oliveira Freitas (Fri Feb 14 2003 - 06:50:16 CST)
• Re: S4T4N1C Web Defacement security_at_imperialdesigns.com (Fri Feb 14 2003 - 07:36:39 CST)
• Re: ICMP Destination Unreachable, Administratively Prohibited Anthony Kim (Fri Feb 14 2003 - 10:02:41 CST)
• Re: ICMP Destination Unreachable, Administratively Prohibited Valdis.Kletnieks_at_vt.edu (Fri Feb 14 2003 - 10:11:35 CST)
• Incidents list administrivia and introductions... Dan Hanson (Sat Feb 15 2003 - 18:13:42 CST)
• Kuang2 strikes again, is it just me? Jeff Kell (Sat Feb 15 2003 - 19:35:02 CST)
• RE: Kuang2 strikes again, is it just me? Rob Shein (Sat Feb 15 2003 - 22:02:48 CST)
• Re: Kuang2 strikes again, is it just me? Johannes Ullrich (Sat Feb 15 2003 - 22:18:13 CST)
• Re: Kuang2 strikes again, is it just me? Jasmine (Sun Feb 16 2003 - 08:00:48 CST)
• Re: Kuang2 strikes again, is it just me? Jeff (Sun Feb 16 2003 - 11:39:10 CST)
• Re: anoano.com ftpd dip.t-dialin.net Scott Harris (Sun Feb 16 2003 - 13:51:40 CST)
• RE: Kuang2 strikes again, is it just me? Trevor Metzger (Sun Feb 16 2003 - 17:28:36 CST)
• mIRC Trojan Variant - port 445 worm/Trojan kyle_at_kylelai.com (Sun Feb 16 2003 - 16:49:50 CST)
• RE: Kuang2 strikes again, is it just me? Tim Heagarty (Sun Feb 16 2003 - 23:16:39 CST)
• www.nopop.net Pascal Bouchareine (Mon Feb 17 2003 - 09:42:11 CST)
• Re: Web Defacement Alberto Cozer (Mon Feb 17 2003 - 12:56:25 CST)
• Re: Kuang2 strikes again, is it just me? Paul Dokas (Mon Feb 17 2003 - 11:57:34 CST)
• RE: www.nopop.net Brad Griffin (Mon Feb 17 2003 - 16:27:01 CST)
• Re: www.nopop.net Jon Rublack (Mon Feb 17 2003 - 19:00:51 CST)
• Distributed spam-based DoS in progress Transistor Sister (Mon Feb 17 2003 - 19:25:19 CST)
• port 17300 probe fingerprint analysis Royans Tharakan (Mon Feb 17 2003 - 22:00:31 CST)
• Re: port 17300 probe fingerprint analysis John Sage (Tue Feb 18 2003 - 09:06:36 CST)
• Re: Distributed spam-based DoS in progress Hugo van der Kooij (Tue Feb 18 2003 - 00:48:20 CST)
• Re: Kuang2 strikes again, is it just me? Kevin Patz (Tue Feb 18 2003 - 12:59:17 CST)
• RE: Distributed spam-based DoS in progress Dave Hart (Tue Feb 18 2003 - 13:28:30 CST)
• Re: Distributed spam-based DoS in progress Valdis.Kletnieks_at_vt.edu (Tue Feb 18 2003 - 13:48:38 CST)
• RE: Distributed spam-based DoS in progress Hugo van der Kooij (Wed Feb 19 2003 - 00:49:55 CST)
• Re: Distributed spam-based DoS in progress Kee Hinckley (Tue Feb 18 2003 - 17:05:57 CST)
• Re: Distributed spam-based DoS in progress Transistor Sister (Tue Feb 18 2003 - 20:35:33 CST)
• Re: port 17300 probe fingerprint analysis william.miller_at_gsa.gov (Wed Feb 19 2003 - 06:30:17 CST)
• RE: Distributed spam-based DoS in progress Dave Hart (Wed Feb 19 2003 - 01:26:37 CST)
• RE: Distributed spam-based DoS in progress Steve Drees (Wed Feb 19 2003 - 13:43:55 CST)
• Dead thread -- Distributed spam-based DoS in progress Dan Hanson (Wed Feb 19 2003 - 21:46:18 CST)
• Weird Profile in Documents and Settings Greg Wiedeman (Thu Feb 20 2003 - 05:38:16 CST)
• Re: Distributed spam-based DoS in progress Rohan Amin (Wed Feb 19 2003 - 23:04:43 CST)
• RE: Weird Profile in Documents and Settings Rob Shein (Thu Feb 20 2003 - 10:18:38 CST)
• Scans on TCP port 135 Kevin Patz (Thu Feb 20 2003 - 15:12:04 CST)
• RE: Weird Profile in Documents and Settings Lucas Zaichkowsky (Thu Feb 20 2003 - 17:08:40 CST)
• Re: Weird Profile in Documents and Settings Anders Thulin (Fri Feb 21 2003 - 02:20:27 CST)
• Possible stateful filtering problem? Security (Fri Feb 21 2003 - 04:29:16 CST)
• WebJob 1.2.3 Released Klayton Monroe (Fri Feb 21 2003 - 03:42:00 CST)
• FTimes 3.2.0 Released Klayton Monroe (Fri Feb 21 2003 - 04:03:47 CST)
• Questions: LKM, yoyo & rootkits Gordon Ewasiuk (Fri Feb 21 2003 - 07:31:43 CST)
• Re: Weird Profile in Documents and Settings Gene Yoo (Thu Feb 20 2003 - 21:34:40 CST)
• ICQ problem. Thiago Madeira de Lima (Fri Feb 21 2003 - 11:26:59 CST)
• Re[2]: Weird Profile in Documents and Settings Jyri Hovila (Fri Feb 21 2003 - 12:10:58 CST)
• Possible new backdoor: mspx-smss.exe ? Sven Pechler (Fri Feb 21 2003 - 05:57:16 CST)
• Re: Scans on TCP port 135 Dave Aitel (Fri Feb 21 2003 - 16:00:59 CST)
• Re: Weird Profile in Documents and Settings Patrick R. Sweeney (Fri Feb 21 2003 - 17:36:12 CST)
• Re: ICQ problem. bob (Fri Feb 21 2003 - 22:01:19 CST)
• RE: Weird Profile in Documents and Settings Austin Ehlers (Fri Feb 21 2003 - 22:14:48 CST)
• RE: Weird Profile in Documents and Settings Christopher Hummert (Sat Feb 22 2003 - 15:36:58 CST)
• Weird Windows logon attempts Harry Hoffman (Sun Feb 23 2003 - 18:27:54 CST)
• Re: Weird Windows logon attempts Jacco Tunnissen (Sun Feb 23 2003 - 21:08:42 CST)
• Re: Weird Windows logon attempts Bojan Zdrnja (Mon Feb 24 2003 - 03:07:55 CST)
• RE: Weird Windows logon attempts Terence Runge (Mon Feb 24 2003 - 01:00:50 CST)
• Web server crashed, now is trying to contact an IP by port 80 every morning. Dan Harpold (Sun Feb 23 2003 - 21:20:01 CST)
• Re: ICQ problem. Rafael Coninck Teigao (Mon Feb 24 2003 - 14:51:28 CST)
• Re: Web server crashed, now is trying to contact an IP by port 80 every morning. lsi (Mon Feb 24 2003 - 18:30:29 CST)
• RE: Web server crashed, now is trying to contact an IP by port 80 every morning. Dan Harpold (Mon Feb 24 2003 - 19:19:38 CST)
• RE: Web server crashed, now is trying to contact an IP by port 80 every morning. Levinson, Karl (Tue Feb 25 2003 - 07:21:25 CST)
• Re: Weird Windows logon attempts H C (Mon Feb 24 2003 - 05:38:10 CST)
• Incident Focus Area Article Announcement Dan Hanson (Tue Feb 25 2003 - 18:14:22 CST)
• Re: Weird Windows logon attempts Russell Fulton (Tue Feb 25 2003 - 17:14:56 CST)
• Remote Access Software (Wireless Devices) Holstein, Michael (Tue Feb 25 2003 - 12:00:00 CST)
• Weird apache logs Travis Read (Tue Feb 25 2003 - 19:57:20 CST)
• RE: Weird apache logs Carmen Tache (Wed Feb 26 2003 - 13:09:43 CST)
• RE: Weird apache logs NESTING, DAVID M (SBCSI) (Wed Feb 26 2003 - 13:15:59 CST)
• Re: More /sumthin Philipp Hug (Wed Feb 26 2003 - 08:23:17 CST)
• RE: More /sumthin Jonathan A. Zdziarski (Wed Feb 26 2003 - 15:14:37 CST)
• RE: Weird Windows logon attempts Mary McAllister (Wed Feb 26 2003 - 16:09:25 CST)
• Re: More /sumthin D.C. van Moolenbroek (Wed Feb 26 2003 - 18:59:08 CST)
• Interesting http-equiv_at_excite.com (Wed Feb 26 2003 - 14:01:34 CST)
• Re: Possible new backdoor: mspx-smss.exe ? Sven Pechler (Wed Feb 26 2003 - 15:19:15 CST)

Last message date: Thu Feb 27 2003 - 10:25:36 CST
Archived on: Thu Feb 27 2003 - 10:25:37 CST